Generally speaking, there are two elements to combating unwanted applications: careful selection of the applications you use, and careful control over what you use them for. Before signing up for an online service or installing the latest app, users must stop and consider whether they will really benefit from using it. Some, like Gmail, provide obvious benefits, but others aren't valuable (at least not during the course of one's workday...
These are typically long, tedious documents written to deter users from reading to the end, but often buried deep within them are details of what may happen with data you provide or other services for which you may be automatically registered. This will help you make a more informed choice as to whether to proceed. For example, many Android Market applications have sent users' private information and location data to remote advertising servers without users being aware of what was being sent or to whom.
When gauging the security of a free Internet application, it's worth searching customer and research reviews on the Internet to see if existing users are complaining about privacy, security, or a lack of control over their data. Also, check what the experts say about the relative safety of an application before endorsing it; vulnerabilities have been exploited in online applications to spread malware, and aid phishing attacks and spam.
Unfortunately, even if users take all these precautions and configure their privacy and security settings to high, you may still find that they will end up enrolled in another service that can access their data. This is why it's important to follow best practices regarding posting personal information. Microblogging sites are designed to enable content and comments to be published quickly and easily but pause and think before hitting the submit button.
Personal information can be harvested and used for phishing or targeted malware attacks. So if it's not something you'd be willing to shout out loud in Times Square then don't post it. Information such as date of birth and home address is commonly used in identity verification and so can be used by criminals for the purpose of identity theft or social engineering attacks. Also, many of the answers to common security questions, such as favorite pet's name or name of first school can be found on people's online profiles. I would also think twice about using location-based social networks as the publication of location data has been linked to subsequent burglaries. The only way to help your users truly protect their privacy is to not allow use of these services in the enterprise, as generally you have limited ability to control how your corporate data is used.
Related Q&A from Michael Cobb
Application security expert Michael Cobb explores how different Web browsers handle SSL certificate revocation.continue reading
Expert Michael Cobb explains how password change frequency and reuse for third-party apps should be addressed in enterprise password policies.continue reading
Learn how a Web-based free spam-filtering service can secure email and prevent spam from attacking your enterprise.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.