EU agency issues position paper on security for Web 2.0

9 January 2009

The European Network & Information Security Agency (ENISA) has issued a new report that explains the risk of Web 2.0 — photo sharing, wikis, social bookmarking and social networking — and 'malware 2.0', a new breed of web-borne infections you can catch just by visiting a web page. The report also gives advice on how to tackle the new breed of infections.

Web applications have become amazingly sophisticated to keep up with the demand for new services. “Web 2.0 applications are pushing existing Web technologies to their limits — as a result, even the best developers have had to resort to ‘hacks’ and loopholes in the system to make their applications work.” says Giles Hogben, an ENISA expert.

"It’s no surprise that criminals are attacking these applications, and are using them as vehicles to distribute malicious code to users." The black-market in malware installations is now so well-organised and lucrative that criminals are offering package deals with standard prices per 'installation'.

The success of Web 2.0 is fundamentally about enabling users to contribute content and communicate. But, at the same time, that success creates new challenges: for example it is more difficult to know whether to trust information when you don’t know who the original author was or where it came from.

The related ENISA survey analyses what tactics people use to decide if a web page is fake. The result is highly surprising: most people will trust a source as long as it appears more than once on the web. The tendency of blogs and wikis to replicate rumours means this is no longer a rational strategy.

For example, some stories originating in the blogosphere about US vice-presidential candidate Sarah Palin have since been proven false. Another example is web-based pump-and-dump stock rumours where share prices are artificially inflated.

“We need better ways to establish trust in information in the Web 2.0 world”, says Mr. Andrea Pirotti, Executive Director of ENISA.

ENISA compiled the report using input from a group of international web security experts. It recommends a set of initiatives in web standards and architecture, as well as policy actions. These include eg, incentives for more secure programming and measures to protect personal data exchanged among private individuals.

Further information

The full report:
www.enisa.europa.eu/doc/pdf/deliverables/enisa_pp_web2.pdf

Survey results:
www.enisa.europa.eu/doc/pdf/deliverables/enisa_survey_web2.pdf

Have your say! To influence the future of European Network and Information Security give your opinion in the online public consultation:
http://ec.europa.eu/yourvoice/ipm/forms/dispatch?form=InfsoNis

Bookmark this page

To top