Incremental risks in Web 2.0 applications

Abstract

PurposeThe purpose of this paper is to identify and investigate the security issues an organisation operating in the “new” online environment is exposed to through Web 2.0 applications, with specific focus on unauthorised access (encompassing hackers). The study aims to recommend possible safeguards to mitigate these incremental risks to an acceptable level.Design/methodology/approachAn extensive literature review was performed to obtain an understanding of the technologies driving Web 2.0 applications. Thereafter, the technologies were mapped against Control Objectives for Information and Related Technology (CobiT) and Trust Service Principles and Criteria and associated control objectives relating to security risks, specifically to hacker risks. These objectives were used to identify relevant risks and formulate appropriate internal control measures.FindingsThe findings show that every organisation, technology and application is unique and the safeguards depend on the nature of the organisation, information at stake, degree of vulnerability and risks. A comprehensive security program, including a multi‐layer technological, as well as an administrative component, should be implemented. User training on acceptable practices should also be conducted.Originality/valueObtaining an understanding of Web 2.0 and Web 2.0 security is important, as Web 2.0 is a new, poorly understood technology and with the growing mobility of users, the potential surface area of attack increases and should be managed. The paper will help organisations, information repository managers, information technology (IT) professionals, librarians and internal and external auditors to understand the “new” risks relating to unauthorised access, which previously did not exist in an on‐line environment, and will assist the development of a framework to limit the most significant risks.

Defining Web 3.0: opportunities and challenges

“…In an effort to clarify the paradigm shift, Getting (2007) described it as the greater collaboration between consumers, programmers, service providers, and organisations, which enabled them to re-use and contribute information, thereby enriching the content distributed between the collaborative parties on the web. Rudman (2010) summarised the key features of Web 2.0 sites into three components:…”

“…Rudman (2010) explained that the negative impacts associated with the different stages of web evolution are incremental. Some of these homogeneous vulnerabilities are:…”

Web 3.0: Governance, Risks and Safeguards

“… Non-compliance with regulatory governance, and the possibility of loss due to legal action.  Shortage in experienced technicians to ensure effective operation and monitoring of complicated systems and applications (Rudman, 2010).…”

“…Anti-malware software, including anti-spy and -virus software, should be installed in order to eliminate the threat of malicious infections of a system of both inbound and outbound electronic transmissions (Rudman, 2010). The implementation of a structure like Taiwan Malware Analysis Net (TWMAN) will mitigate the risk of infections associated with Web 3.0.…”

“…Complex and composite events within a Web service should be monitored. This will simplify the process of sharing events and content between IA's, and will contribute to the standardisation and internationalisation of Web content (Vaculín and Sycara, 2007;Rudman, 2010).  Network and underlying infrastructure security.…”