The booming dot com era is certainly long gone, but even so, every month, more new Internet services make their debut, and not quite as frequently, new devices and gadgets are brought to market. Inevitably, some of these items will make their way into your network environment, often carrying with them considerable security risks.
A good case in point popped up last week. A relatively new company called Pudding Media announced its new VoIP solution called ThePudding.com. The company intends to employ a lure typical of many new online services. Anyone will be able to use ThePudding.com's VoIP service for free to make calls in North America because the company intends to profit through the insertion of targeted advertising. Sounds reasonable, but there's a new twist.
According to the company's privacy policy (at the URL below), "Our technology detects spoken keywords during a conversation and brings you rich media, news and offers, related to the very topics you talk about during your calls. The conversation keywords are not kept in our system after they are processed, and the conversation can not be reconstructed."
http://thepudding.com/media/app/privacy_notice.html
Therein resides the risk. One of your employees or contractors might decide to use the VoIP service, thinking that by doing so they could save themselves or your business money. If the person discussed sensitive information, it could leak out.
Pudding Media says it won't store keywords, and you might decide to trust the company. But there already are known ways to potentially eavesdrop on VoIP calls. Because this particular VoIP solution will, by design, be able to listen to conversations to discover keywords to use for targeted advertising, it stands to reason that the solution will have such capabilities built right into the VoIP software. And if that's the case, listening in might become even easier for intruders.
Whether to allow the use of ThePudding.com is a decision you need to make before the service explodes into widespread use. You can read numerous stories about the service by checking Yahoo! News at the URL below.
http://news.search.yahoo.com/news/search?p=ThePudding&c=
The overall point I'd like to make here is that if you hadn't learned about the service, you wouldn't even know that such a risk exists. So it's probably a good idea to read lots of news, follow the trends, research the overall computing industry to some extent, weigh the security impact of your findings on your environment, and take appropriate actions sooner rather than later.
To stay up to date on news and trends, you can use some of the more obvious sources, such as major magazines and newspapers and even the news aggregation features of major search engines. However, a few more specialized sites can help you learn about trends faster than weeding through a huge pile of news. Next week, I'll tell you about some of the sites I use to follow trends. So stay tuned.
