BIOS: Technology Means Business

News that online research company ComScore Networks takes virtual photos of every Web page viewed by its one million participants, including secure session transactions, and then sells the information to large organisations should come as no surprise at all, according to holistic security consultants Context Information Security.

"While it is conceivable that tracking software could be downloaded without a user's consent this discussion somewhat clouds the debate about privacy, because in the main this is not the modus operandi of online research companies.

Typically, market research organisations will provide users with a free game or piece of software. In return for this, the user has to agree to the organisation's terms and conditions. Acceptance of these includes the user downloading and running the organisation's software, which is usually a tracking application or some other form of Spyware.

The terms and conditions should clearly reference what the user is downloading, giving the user the choice as to whether or not to download the software. Where organisations fail to disclose this information, they may find themselves in breach of privacy laws.

However, in the majority of cases, organisations which package tracking applications in this way provide adequate information on what the user is downloading. Indeed, it is often the user who fails to properly read the Ts & Cs and understand the implications of their actions. For example, how many times have you simply skipped the blurb and clicked the 'yes - I have read and understood the terms and conditions box'? In this case the apparent breach of privacy is likely to have arisen from the user's failure to read the terms and conditions relating to the software they wish to download.

This is clearly a user related issue, but to a certain extent it is understandable. These terms and conditions are often very complicated, long-winded and written in a 'legalese' that it difficult for the average user to understand. Nevertheless users need to exercise more responsibility and common-sense when considering downloading software that comes bundled with tracking applications and Spyware; this includes taking the time to fully read and understand the terms and conditions - if you don't understand them, don't accept them.

More serious problems arise when users are duped into downloading content from malicious Web sites. Attackers can quite easily offer free games, screensavers and applications to attract unsuspecting users to download their software, which may be bundled with Trojans, worms and other malware. These can then be used to steal confidential information from the user's systems and in some cases allow the attacker to take control of the user's computer. However, this should be less of a threat in the corporate environment because businesses should prevent users from downloading executables from the internet. Furthermore, any downloaded files should be scanned by appropriate security solutions prior to being opened.

Context would go so far as to suggest companies ban the playing and distributing of games - and any application for which there is no business case - completely! It may seem like Scrooge has entered the office environment, particularly at this time of the year when the cycle of Christmas parties contributes to a lighter office atmosphere, but the stance should be: If there is no business reason for workers playing games, then they shouldn't be allowed to do it, nor should they be permitted to use corporate resources to send them to their colleagues. This should be included in the 'acceptable usage' policy that employees are required to sign up to when joining the company and any breach of this policy linked to disciplinary procedures.

People need to get wise to the tactics used to extract information from them. Ask yourself why a developer would create a free game for you to play and pass on to friends endlessly - because they're altruistic - I don't think so! Securing the systems of the home-user is, unfortunately, more difficult. This is because users have to manage the security process themselves and have to take decisions regarding what to download and what not to download. We would urge users to exercise caution; if they do not fully understand what they are installing on their systems, or if they have any suspicions whatsoever, they should not download and install. In any case, we advise that home users install and regularly update appropriate security solutions. They should also scan their computer regularly to ensure that any malicious software is detected and removed."

[Best Security Software Pricing UK]
[Best Security Software Pricing US]