Security Concerns of Existing Social Networking Applications - Dissertation Example

 Security Concerns of Existing Social Networking Applications 1. Introduction With advancements in technology and the surge in the usage of computers, recreation has shifted from public parks to public spaces on the Web. Social networking sites have become popular not only in youngsters but in adults too. Such forums not only provide people a place to chat, but also to share their pictures, documents and to interact with each other through games, and social networking tools. A social network is a social structure where people are the nodes. The term was first proposed by a J. A. Barnes in the mid twentieth century. He regarded social network as a union of hundred to a hundred and fifty people. However, the numbers of users soared magnanimously over the years. A social network can be between organizations and entails relationships that extend from friendship, trade, kinship and epidemiology. A social network has two main components: the links and the nodes. Elaborating on these elements that sustain the network, nodes are the people and organization whereas links are the relationships between these nodes (Social Bookmarking Software, 2009). It is a place where people meet up with similar hobbies, family affiliations and work connections. Given the advantages of social networking sites, there are certain legal, ethical and security considerations that accompany online socializing. This paper explores such concerns to the university and gives recommendations on how they can be averted. On the same hand, it suggests if the university should adapt commercially available social networking software or develop a new bespoke social networking application. 2. Legal, Ethical and Security Concerns of Existing Social Networking Applications Despite differences in culture, caste and creed as well as geographical distances, a social network connects people with similar interests and serves as a platform for them to socialize. The first social network, Classmates.com, originated in the late 1990s (Goetchius, 2007). Today there are a number of social networking sites like Facebook, LinkedIn, My Space and Twitter. The site allows people to share information about themselves, from their age, gender, work occupation, interests and dislikes. In fact people make a profile that gives an overview of their personality. 2.1. Legal Concerns The content uploaded on social networking applications is subject to a number of legal issues such as upload of illegal content and defamation. Users might not have the right to post third party content and other concerns such as uploading information with a copyright can have legal implications for the university. People who are operating the application also need to consider what information is accessible to the IT personnel. Other legal issues that arise in social networking is that when a user deletes his or her profile, what information is deleted along with the profile and what is still available for use by the application. Moreover, content that has been uploaded can be alleged for defamation and can be subject to laws that protect users from intentional infliction of emotional distress on interference with advantageous economic relations. Moreover cyberbullying and individuals accused in such acts can be held liable on the basis of criminal charges (Ossian, 2001). 2.2. Ethical Concerns An advantage that social networking sites offer for organizations is that they recruit prospective employees. For a university, social networking can help generate a sense of belonging between students. They can socialize and make friends with people whom they might have little interaction with in the university or college. Teachers and staff can also interact with students, post updates and documents about their course and get to know their colleagues and students better. Social networking sites can be accessed online and people who are way from college can know the latest happenings of the college through these websites. However this might present with its own set of problems. The usage of social networking sites can compromise the productivity of the employees. They can be engaged in updating their profiles, posting information online and sharing pictures. If there is a 50-strong workforce and each employee spends half an hour socializing via a social network every day, the organization could lose 6,500 hours of productivity in a year. Even though this is a generalization, losing 25 hours of productivity every day is bound to translate into slower progress (Kelleher, 2009). Moreover, it has a negative effect on the morale of other employees. Employees would not consider it fair if they have to work more to cover up for employees who are spending their time in recreation on social networks. This presents an ethical issue for a university milieu where the concerted efforts of colleagues working in the same department, or students working together on a project, are important in the proper functioning of the institution. University records and databases and searching the university’s collection of literary materials and other documents on the Internet have become very common and are representative of the shift from print form to digital form. This shift necessitates increased usage of the Internet. Posting “band-width hungry video links” poses a problem for IT administrators since it would take up huge amounts of bandwidth, and the access of information for academic purposes would become difficult due to low connectivity. 2.3. Security Concerns However there are many privacy issues that rise in conjunction to the sharing of information on public forums. One of the risks of sharing information is that people might use it to bully and harass others. Cyber bullying has become commonplace in the world of social networking. People can use personal information to sexually harass and bully others. They can blackmail them and gain advantage of the target individual by threatening to release the information into forums with public access. There is limited privacy on such forums and pictures and personal information can circulate in public channels. Groups who are most vulnerable to online bullying and harassment include old girls and teenagers. Bullies can harass people by sharing private instant messages on public forums, posting threatening information on their profiles or circulating false information as well as sharing photographs that might be a source of embarrassment for the victim. Insignificant information and gossip can be publicized to an international audience. As a result, people become the centre of rumors. In a college setting, this presents a major problem since students and faculty members have a long-term commitment to the college and have to bear the brunt of rumors and gossip through out their stay. It can be a major reason for emotional anguish for students and the faculty alike and can cause serious lapses in their performance. Social networking sites also pose a likely threat to teenagers since they can become easy targets to pedophiles. Social networking sites allow often allow people to keep their identity confidential and to make fake profiles. Therefore, it becomes easy for deceitful and dishonest people to target innocent students and use them to further their wrong motives. Another concern that IT personnel of the university have to deal with is the threat of hackers and viruses. Social network sites can be the breeding grounds for viruses and malware as hackers can use them to launch spam and to commit fraud (Kelleher, 2009). 3. Summary Report As a computer security consultant, I believe that the development of bespoke social networking software has greater benefits for the University as compared to using an existing social networking application. Bespoke networking software refers to a software that has been developed for a specific purpose for an organization and is different from other existing software. It is custom-made and serves to meet the specific needs of the client. They are preferable for large organizations (Malone, 2003); thus, it is feasible to introduce a bespoke social networking application in a university. One of the arguments against developing a bespoke networking application is the cost of developing it. The first generation of bespoke networking sites were expensive to make. However, with advances in designing, the costs associated with the development of new sites have decreased substantially. A new generation of Web designing and software agencies is offering cheap tools that allow new sites to be made and organizations to incorporate social networking into their existing Web platforms (Kohlbacher & Herstatt, 2008). Social software that is custom made to the needs of the students and the faculty would mirror the qualities of typical social networks, yet provide additional features that would enable students and faculty to interact in a more user-friendly way than in other existing applications. Developing such an application could allow IT professionals to tailor the features of the application to allow for greater formal and informal learning. It could give individuals an incentive to be part of a vibrant social network that not only allows them to bond with people from their university, and with those sharing common aims and interests, but also to feel a sense of ownership. This sense of ownership is further promoted by encouraging individuals to tailor the appearance and feel of the online forum themselves in a personalized way (Williams & Remenyi, 2008). A social network operated solely for individuals involved with the University can become integral to its culture. The faculty can keep in touch with former students; moreover it can create greater communal feeling amongst people living in hostels than other sites because of the personal feel of the bespoke application (Alemán & Wartman, 2009). Making bespoke social networking software would allow the University to develop and market its own vision of social interaction in virtual communities. Since the application is made by the University itself and promotes the philosophy of the University, it could generate a sense of belonging in students and faculty. The University would be able to produce more functionality in a custom-made social networking application. An application that has been made by the University itself instills a sense of belonging in the users since they can realize that they have a voice and listeners coming from the same community with which they interact with during a major part of the day. Moreover, the individuals can feel a greater sense of belonging to the social application, and subsequently to the University, if they are allowed to expand, run and own their places of user-defined content. Managing one’s own area is only possible through a bespoke application that provides special features to empower the user to participate more. Williams and Remenyi (2008) observe that this can create exponential opportunities for learning experience. Furthermore, having a custom-made social networking application can enable the University to use those tools like pictures, videos and blogs, which are relevant to the user and draw their interest, in any way that they like and to have the freedom to present them on the application in any way that they find suitable. Using existing software would limit the creativity of the material presented, since it would have to be presented in the format and the outlook that the application supports. The University could also choose color themes that go with its logo, representing the greater scope for creativity and design that a custom-made application can offer in contrast to existing ones. Other potential advantages that bespoke social networking application can offer over existing ones include lesser legal liability. A custom-made application can be tailored in a way such that there is a high security protocol and advanced measures can be taken in areas that are considered to be high risk for information leaks and privacy issues. The data can be easily tracked by the staff appointed to regulate and administer the application. The value of developing such an application is that it will fit the needs of the University like a glove. The University can use an existing social networking application and existing social networking sites like Facebook and LinkedIn offer tools for giving the user a personalized experience through their settings for customization (Wauters, 2008). However, I would still prefer bespoke networking application for the University because generic software packages do not make use of half of the capabilities that they offer and so end up being an added burden on IT resources. As a result, they tend to slow down the computer network (Parker, 2009). Bespoke application can enable the University to develop only those features that are required, and IT resources would not be employed in providing things that are of little use to the students and the faculty. Security Policy Document For Developing A Bespoke Social Networking Application1 Author Date SCOPE 1. The scope of the information security includes the protection of the data of the social networking application users. 2. The framework for the managing information security applies to all the individuals of the University of Glamorgan, who are using the application, as well as the IT personnel and related staff who are responsible for managing it. 3. The policy and the standards apply to all the information that is considered to be private. RISK MANAGEMENT 1. A comprehensive analysis of the social networking application will be carried out by the Computer Services Department of the University of Glamorgan. The analysis would be done to document the threats that arise regarding the information shared on and through the social networking application. From the juxtaposition of the threats, susceptibilities and asset values, an evaluation of the risks to the integrity, availability and confidentiality of the information will be decided. 2. Based on the regular review of the threats to security, steps will be taken to mitigate the effect of security threats by decreasing the amount and extent of the vulnerabilities. INFORMATION SECURITY DEFINITIONS Availability: data or information that is of use and in demand. Confidentiality: data or information that is not made available to unauthorized people. Integrity: data or information that has not been modified or destroyed in an unauthorized manner. INFORMATION SECURITY RESPONSIBILITES 1. Information Security Officer: a. Make sure that all the standards of protection of information are in place and being followed by the application users. b. Installing a high security application that makes it difficult for hackers to launch malware and spam attacks. c. Drafting a Terms of Use so that infringement of the rights of the Third Party does not occur. d. Making and implementing the measures that need to be taken if an individual has been involved in the infringement of rights, harassment and violation of security. e. Keeping an inventory of all the devices and applications that are used. f. Turning off services that are not in use since they are targets for hackers. g. Blocking specific formats of information that is being shared by users, such as .bas, .bat and .exe. 2. User Management: responsible for managing the users. The tasks include: a. Allowing users to control the amount of information that is accessible and available to other users. b. Implementing high security for passwords and following a strict protocol for changing passwords so that unauthorized individuals can not change it. c. Introducing security change requests. d. Making sure that all users read the Terms of Use before singing up. e. Raising the awareness of users about changing the privacy settings according to their needs. f. Regulating and taking steps against fake profiles that people might make, infringement of rights of individuals and cyberbullying by blocking a profile of the individual reported to have been involved in harassment or illegal activities. g. Removing and expiring all information posted by an individual when he or she deletes the profile. h. Removing any defamation content that has been uploaded by the users. i. Reviewing and approving requests for people who want to join the network. j. Instructing users to not to share information such as PIN numbers, bank account numbers, credit card information and other confidential information (Ashley, 2008). COMPLIANCE ACTION Compliance action will be taken against, but is not limited to, the following: 1. Unauthorized disclosure of information like passwords, private messages, private pictures and contact information. 2. Individuals involved in defamation and distribution of content illegally. 3. Individuals attempting to use someone else’s password. 4. Hackers and people trying to launch spam and malware attacks. 5. People involved in the deliberate destruction of information. 6. Using fraudulent documents and information to gain access into other people’s profile. REFERENCE LIST Alemán, A. M. M. & Wartman, K. L., 2009. Online social networking on campus: understanding what matters in student culture. New York (NY): Taylor & Francis. Ashley, M., 2008. 12 tips for social networking. [Online] Available from: http://www.networkworld.com/community/tips-for-safe-social-networking Goetchius, A., 2007. Career Building Through Social Networking. New York (NY): The Rosen Publishing Group. HIPAA Information Security Policy - Sample Template, n.d. [Online] Available from: http://www.docstoc.com/docs/25480360/HIPAA-Information-Security-Policy---Sample-Template Kelleher, D., 2009. 5 Problems with Social Networking in the Workplace. [Online] Available from: http://www.information-management.com/specialreports/2009_165/social_networking_media-10016208-1.html [Accessed 6 July 2010]. Kohlbacher, F. & Herstatt, C., 2008. The silver market phenomenon: business opportunities in an era of demographic change. Verlag: Springer. Kelleher, D., 2009. 5 Problems with Social Networking in the Workplace. [Online] Available from: http://www.information-management.com/specialreports/2009_165/social_networking_media-10016208-1.html [Accessed 6 July 2010]. Malone, S. A., 2003. How to set up and manage a corporate learning centre. 2nd ed. Hampshire: Gower Publishing, Ltd. Ossian, K. L., 2001. Legal Issues in Social Networking. [Online] Available from: http://www.millercanfield.com/media/article/200120_LEGAL%20ISSUES%20IN%20SOCIAL%20NETWORKING.pdf [Accessed 6 July 2010]. Parker, S., 2009. The Advantages Of Bespoke Software Development. [Online] Available from: http://www.content4reprint.com/computers/software/the-advantages-of-bespoke-software-development.htm [Accessed 6 July 2010]. Social Bookmarking Software, 2009. Social Networking Definition. [Online] Available from: http://www.pingspider.com/socialbookmarking/social-networking-definition/ [Accessed 6 July 2010]. Wauters, R., 2008. SocialGO, yet another social network maker. [Online] Available from: http://thenextweb.com/2008/10/06/socialgo-yet-another-social-network-maker/ [Accessed 6 July 2010]. Williams, R. & Remenyi, D., 2008. The Proceedings of the 7th European Conference on e-Learning, Agia Napa, Cyprus, 6-7 November 2008. Academic Conferences Limited. Read More