Home > Security Tips > Threat Monitor > Does blogging pose enterprise information security risks?
Security Tips:
EMAIL THIS
 TIPS & NEWSLETTERS TOPICS 

THREAT MONITOR

Does blogging pose enterprise information security risks?


Mike Chapple
09.15.2006
Rating: -4.00- (out of 5)


Threat Monitor
Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google


There's more than one way to receive Threat Monitor

Listen to this blogging tip on your computer or MP3 player.
Blogging is growing in popularity and rapidly becoming a mainstream communication tool. Even companies are jumping on the bandwagon in record numbers, as a recent American Management Association/ePolicy Institute study of 416 U.S. businesses found 8% of organizations operate official corporate blogs. That's no surprise, given some of the high-profile business blogs, such as those by Justin Rattner of Intel and John Dragoon of Novell. However, the same survey also revealed some troublesome statistics regarding corporate blogging policies or lack thereof. Specifically:
  • 9% have policies about personal blogging during business hours
  • 7% have policies covering the use and content of business blogs
  • 7% cover employee's personal blogging activity from home
  • 6% prevent personal blogging on corporate blogs
  • 5% ban blogging at work outright
  • 3% have blog retention policies

Those are somewhat shocking numbers. While blogging is a powerful marketing and communications tool, it can pose significant risks to enterprise information security when not controlled. While some of these risks are obvious, such as inadvertent (or intentional) disclosure of trade secrets and risk to a company's reputation, other risks are more nuanced. Therefore, if your company is publicly traded, blog postings should be considered in light of applicable Securities and Exchange Commission regulations, because a blog post is like any other corporate communication.

Blogging policies
What can you do to control these risks? As with many security issues, the best place to start is with policy. Here are some questions you should consider when drafting your information security policies:

  • Does your organization permit blogging? If so, are there specific approved blogs or can any employee create their own? What is the new blog approval process?
  • Do you wish to place any restrictions on employees' use of personal blogs? Are these restrictions different depending upon whether they are blogging from home or from the office?
  • Are there any specific regulatory requirements that limit what you post to your corporate blog? Do these requirements extend to employees using personal blogs?
  • What is the approval process for postings to official corporate blogs?
  • How long will records of blog content be maintained and where will they be stored?
  • Are there any specific types of content that are taboo on corporate and/or personal blogs? For example, may blogs include the names of employees or customers? Are products in development fair game for bloggers?
  • Do you require that non-official blogs carry a disclaimer that the opinions expressed in the blog are those of the blogger only and do not necessarily represent the opinions of the organization?

For more information

Get advice for creating and managing policies in our resource center.

Want to learn how to reduce blogging risks? Ask Mike for help.

Blog risks go beyond policy-related concerns as well. A recent SPI Dynamics study noted that content feeds may be used as an attack vector to exploit vulnerabilities in news reader clients. Expect to see this threat develop over the next year, and be certain to keep your blog-reading software up-to-date on vendor security patches to reduce the risk to your enterprise.

About the Author: Mike Chapple, CISSP is an IT Security Professional with the University of Notre Dame. He previously served as an information security researcher with the National Security Agency and the U.S. Air Force. Mike is a frequent contributor to SearchSecurity, a technical editor for Information Security magazine and the author of several information security titles, including the CISSP Prep Guide and Information Security Illuminated.


Rate this Tip
To rate tips, you must be a member of SearchSecurity.com.
Register now to start rating these tips. Log in if you are already a member.




Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us    Add to Google


RELATED CONTENT
Threat Monitor
How to stop malware in a 'Flash'
How to detect system management mode (SMM) rootkits
Windows registry forensics: Investigating system-wide settings
Weaponizing Kaminsky's DNS discovery
Debian: A niche OS with a not-so-niche security flaw
Web advertising exploits: Protecting Web browsers and servers
Ransomware: How to deal with advanced encryption algorithms
Hidden endpoints: Mitigating the threat of non-traditional network devices
Protecting exposed servers from Google hacks (and Google 'dorks')
Countermeasures against targeted attacks in the enterprise

Emerging Information Security Threats
Security researchers leading way in biometrics, insider threats, encryption and virtualization
New worm attacks Windows smartphones
Critical infrastructure security grim, study finds
New malware exploits Microsoft RPC flaw
Smartphone security: The growing threat of mobile malware
Microsoft sees OS flaws drop, application breaches rise
Security Squad: Security pros face troubles
Trojan exploiting Microsoft RPC flaw
Malicious program poses as Windows Security Center
Adobe addresses clickjacking in latest Flash Player

RELATED GLOSSARY TERMS
Terms from Whatis.com − the technology online dictionary
DNS rebinding attack  (SearchSecurity.com)
drive-by pharming  (SearchSecurity.com)
JavaScript hijacking  (SearchSecurity.com)
man in the browser  (SearchSecurity.com)
phlashing  (SearchSecurity.com)
polymorphic malware  (SearchSecurity.com)

RELATED RESOURCES
2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
Search Bitpipe.com for the latest white papers and business webcasts
Whatis.com, the online computer dictionary

DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.



Research Solutions for Network Security, Access Control and Security Threats
More Security Resources for Resellers, VARs and OEMs
TechTarget Security Media
Information Security View this month\\'s issue and subscribe today.
Information Security Decisions Apply online for free conference admission.
SearchSecurity.com
HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
TechTarget provides enterprise IT professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective IT purchase decisions and managing their organizations' IT projects - with its network of technology-specific Web sites, events and magazines.

TechTarget Corporate Web Site  |  Media Kits  |  Reprints  |  Site Map




All Rights Reserved, Copyright 2003 - 2008, TechTarget | Read our Privacy Policy
  TechTarget - The IT Media ROI Experts