What Web 2.0 and E2.0 Security Means to Me

E2.0 technologies must manage a delicate balance between collaborative freedoms they promise with the security, dependability and audit trail requirements that any enterprise has to have to let them in the door.

Paula Gregorowicz' review of Traction TeamPage 4.0 in October's Intranet Journal details how TeamPage 4.0 meets the challenge via a "moderation model which is likely to impact the face of entperise intranet architecture" and "packs a lot of knowledge management power into one platform."

While Gregoriwicz' review points mostly to intranet E2.0 scenarios, Marji McClure's recent article, Web 2.0 Security: Getting Collaborative Peace of Mind seeks to identify the security gaps in a range of Web facing platforms.

In the Web 2.0 Security article, McClure recounts the issue I raised about trust. Specifically, that users have come to trust web platforms for a variety of reasons - few of them based on careful review of any vendor's viability, track record or any other factor. Rather, we go where our friends and colleagues herd and hope for the best.

Why do we trust facebook?

The amount of personal information and content shared in social networks today - even just the connections made - is incredible. Why have people put so much faith in these systems? In part because friends trust it, but also because we tend to ignore the dangers.

In light of easy to find reports about major lapses in uptime, speed and security of Web 2.0 services, the issue of trust and a herd mentality as a guiding factor couldn't be made more apparent. Why else would the collective "We" tolerate it  when  Yammer Goes Down, Companies are Silenced? How about repeated incidences where LinkedIn is Very Slow Today? If you depend on Web 2.0 platforms, cases like these demonstrate where your productivity could come to a halt - and you'd have no control of the "cloud" that contains your identity, access to your own data, and the keys to your connections. Of greater concern of course are actual security breaches like the time Paris Hilton's pictures were leaked from Facebook or when Facebook users received other user's private inbox pages.

Do enterprises have any reason to be alarmed by employee activity in Web 2.0 social networking applications like LinkedIn or Facebook?

Sure. Employees certainly have every right to manage their own address book and professional network. And it would seem that their employers shouldn't have any cause for alarm as long as employees don't disclose confidential information. But there is no way to monitor for leaks. And beyond the simple matter of leaks, an employee's mere activity could be considered confidential . The waters get murky when you consider that an employee may connect to new partners and customers or prospects, and that the linking activity can be monitored by anyone that an employee is connected to. I remember backing off of LinkedIn many years ago when I saw a competitor make a series of connections to VC contacts I had. His fund raising goal and target list became instantly obvious. On the other hand, there are benefits we all reap by using these services and you can't control employees in mass - so a balanced view is required.

What are the drivers for using Web 2.0 and E2.0 Social Networks?  As a result, what are the security considerations?

In Web 2.0 social networks are organized around people and their personal information. Incentives to participate are driven by the desire to manage your personal network of friends and colleagues over your lifetime. People are concerned with authentication and the privacy of personal information. By "linking in" or "friending" another user on the system, you grant them permission to see personal details beyond a simple list of linked colleagues or confirmed friends.

In Enterprise 2.0, social networks are organized around content and the people that compose that content. Incentives to participate are driven by the desire (and need) to contribute to and interact with communities of practice and project teams. By contrast to Web 2.0, personal information such as e-mail address, telephone number and, other profile information is generally open for all colleagues and, possibly, partners, customers and other stakeholders. Its the content that's protected, and, since the content is organized around communities and teams, the gatekeepers are not the individual uses, but project or workspace managers. So, information privacy is driven more by policy than by each user's own decisions.

What are security considerations for E2.0?

The matter of security goes beyond simple authentication (am I who I say I am) and privacy control (who can see what information). Given my experience with Traction TeamPage, I've identified the following aspects of security which may be interesting to enterprise decision makers and users alike:

1. Authentication - Are you who you say you are?

2. Permissions / Access Control - What spaces and content can you SEE and what can you DO in the environment? Beyond content, can you see address book information. For example, maybe employees can see everyone's information but customers can't see all other customer's contact data.

3. Audit Trail - What happened over time? For example, who applied a given tag at what time? or what version of a page was e-mailed to a customer? 

4. Content Production Monitoring - Ability for users to keep up to date with new activity based on author, workspace of content specific criteria. Ability for administrators to monitor for malicious content, receiving instant notification or even suppressing the content as its posted.

5. Content Access Monitoring - In the case of an information leak (inadvertent or not), the ability for administrators to determine which users read what content when.

6. Content Moderation - This may include moderating comments on pages, working on several pages at once before publishing them simultaneously, or subjecting pages to a review process before publishing. It may also involve suppressing edit history from certain audiences or locking pages from being edited if they are in a final form.

7. Content Parsing - Is there a process that grooms content when its published? This sort of process can remove script tags and other types of elements that could be malicious.

These are all important considerations, but software has its limits. There is no protection better than a simple code of conduct and communication policy that applies to all venues, channels and contexts in which an employee may participate.