Facebook and plug-ins putting enterprises at risk, says Zscaler

Attacks from social networking sites and blended attacks on browsers have joined mobile malware as top security concerns, according to security firm Zscaler ThreatLabZ's latest quarterly report.

Zscaler said its monitoring platforms have found many end-users continuing to run outdated and insecure versions of their browser and web plug-ins. Among the most commonly-spotted unpatched plug-ins are Adobe Shockwave, Java and Adobe Reader.

By leaving systems unpatched, Zscaler warned that many firms are leaving themselves vulnerable to "blended" attacks that target browser plug-ins.

"This is an area where enterprises are currently struggling," the company said in its report.

"It becomes clear that most companies have little control over the type of plug-ins that their employees are using, or the specific version of plug-ins in use."

Additionally, Zscaler found that social networking continues to be a particularly troublesome area for enterprise security managers. The report found that the use of services such as Twitter and LinkedIn had risen during the quarter, while Facebook remained the most popular platform.

"Social networking was once again the most dominant category of browsed web applications through the Zscaler cloud in Q3," the company said.

"And, given its dominance in enterprise web application use, Facebook once again led the pack."

The company said Facebook's pre-eminence meant it faced an increased risk of attacks.

The company noted that scams such as phishing and like-jacking remain a threat to Facebook users. Systems can also be put at risk from common web-based attacks such as malicious iframes on third-party sites.