Should Companies Ban Web 2.0? - Twenty-Four Seven Security

« Who Is Going to Secure Virtualization? | Main | Podcast with Configuresoft: The Security Pluses and Pitfalls of Virtualization »

October 03, 2007
Should Companies Ban Web 2.0?

There's an interesting interoffice point/counter-point going on over at the Intel bulletin boards over whether Intel should ban the use of Facebook, Twitter, Plaxo, Fileshare, and other Web 2.0 tools/time-wasters. While each tool does something quite different (and Plaxo and Fileshare have been banned by Intel, as they are address book and filesharing programs, and clearly pose a threat), each tool opens the company up to new and unknown vulnerabilities.

While it may be easy and expeditious for Intel to simply ban Web 2.0 outright with the argument that any employee using those tools isn’t being productive anyway, I think the argument is much more complex than that (and while writing the blog, Josh Bancroft observed that 3,500 Intel employees were currently on the Intel Facebook network).

The blogger actively uses both Facebook and Twitter at work, saying that if Intel was to make the argument that employees should only engage in work while at work, then Bancroft could rightly refuse to do any work during his off hours -- but with early morning and late night conference calls to all corners of the world, that’s an impossibility.

Then there’s the idea that people using Web 2.0 tools might actually be doing work, where, in the case of sales, or networking, or keeping an eye on competitors, those tools are absolutely essential. Also, there’s the idea that if an employee is determined to break the rules, or actually harm or steal data from their company, no amount of "corporate policy" is going to stop them, and is exactly why a company needs strict access controls and good database security to stop the rogue employee.

If you haven’t guessed already, I am one for openness, and while companies should definitely do a threat assessment and shut down the most obvious Web 2.0 threats, as well as protect their data assets, but otherwise, just like information wants to be free, so do employees.