Site Sponsor:

mcafee_logo.gif
line

Now Available:

Featured Resource:

line

Newsletter

Email Address:


line

Ask the Expert

Have a question for our resident expert? Email your questions to Dan or post a comment to the blog.

« Targeted Attack Steals Confidential Data from Government and Contractors in Transportation Sector | Main | Malware 2.0 - Avoiding Detection »

Microsoft and Google Desktop/Web Integration Offer Too Little, Bring Too Many Risks

Microsoft and Google have decided there is money in your hard drive, and they want to get it. We have Microsoft filing patents on an advertising framework that includes the ability to scan the contents of your hard drive so it can better target ads to your interests. Google is pushing Google Desktop which brings search down to the local drives but businesses are raising legitimate concerns about security. The real problem though is two-fold:

1. Both Microsoft advertising framework and Google Desktop threaten to breakdown the distinction between the public and private realms of our computer activities.

2. These tools can become an avenue of attack for information theft

Microsoft claims its nosing around your hard drive is good for you because it will allow them to push more products that you are interested in. I'm sure if a bunch of salespeople followed me around all day, searched my house, and picked through my office they could make all kinds of suggestions on products I should be buying. No thanks. But that is exactly what Microsoft is proposing to do.

From Microsoft's patent application:

An advertising framework may reside on a user computer, whether it's a part of the OS, an application or integrated within applications. Applications, tools, or utilities may use an application program interface to report context data tags such as key words or other information that may be used to target advertisements. The advertising framework may host several components for receiving and processing the context data, refining the data, requesting advertisements from an advertising supplier, for receiving and forwarding advertisements to a display client for presentation, and for providing data back to the advertising supplier. Various display clients may also use an application program interface for receiving advertisements from the advertising framework. An application, such as a word processor or email client, may serve as both a source of context data and as a display client. Stipulations may be made by the application hosting the display client with respect to the nature of acceptable advertising, restrictions on use of alternate display clients, as well as, specifying supported media.

I wonder what insurers offering data loss insurance would think of something like this.
Google continues to promote security but businesses aren't convinced Google Desktop is ready for prime time. From Infoworld:

In the Ponemon survey of more than 600 IT security specialists who indicated that they were familiar with the Google Desktop vulnerability, an overwhelming 71 percent said that they believe that the product likely harbors other security flaws.

The results gathered by Ponemon -- an Elk Rapids, Mich.-based firm that has gained acclaim in recent years for its studies regarding the cost and causes of data breaches -- illustrate the growing apprehension among businesses about the security implications of Google's applications, said Dr. Larry Ponemon, the research company's founder and chairman.

So called advertising frameworks and integrated local/Web search tools bring too many risks and not enough benefit, at least not for the user.

TrackBack

TrackBack URL for this entry:
http://www.realtime-websecurity.com/type/mt-tb.cgi/358

Post a comment

(All comments are approved by site leader before appearing here. Thanks for commenting!)

line

Dan Sullivan's Bio:

Dan Sullivan is a systems architect with 20 years of IT experience that includes engagements in enterprise security, application design, and systems architecture. His experience includes a broad range of industries, including financial services, manufacturing, government, retail, gas and oil production, power generation, and education. Dan’s security-related project work has ranged from requirements analysis for enterprise information security to designing and implementing security for database applications and enterprise portals. Dan has written about information security and other enterprise information management topics for Business Security Advisor, DM Review, Intelligent Enterprise, and E-Business Advisor. You can contact Dan at: dan_sullivan@realtimepublishers.net