Five virtual world security worries for business

Companies need to think about security and risk management before they get too excited about virtual worlds, according to analyst group Gartner.

The risks businesses face as a result of getting involved in virtual worlds can be significant, according to Gartner vice president Steve Prentice. These risks shouldn't be ignored, he said - but neither should the potential opportunities and benefits that arise from using these new environments for corporate collaboration and communications.

Gartner said the issues facing corporations fall into five categories:

Second Life - the business evolution

Click on the links below to see pictures of some of the many real-world businesses that have set up outposts in Second Life.

Toyota
Nissan
Intel
Dell
Cisco
IBM
Circuit City
Sears
Wired
ABN Amro
Samsung
Field Fisher Waterhouse
AOL
Adidas
Nissan
Sun Microsystems
Reebok
Penguin
American Apparel
Reuters
CNET Networks
PA Consulting
Yankee Stadium

IT risks
According to the analyst, the IT risks of virtual worlds deal with the applications needed to run virtual worlds being downloaded to desktop systems. And while there are no indications these client applications represent a higher risk than other comparable applications, Gartner said that at this time, the high frequency of updates makes the control of a large application difficult.

Identity and access management
It's difficult - if not impossible - to ensure that any avatar is the real-life person it claims to be, according to Garter. This lack of verifiable identity control or access management is a "major deficiency" in public virtual worlds and is having a significant impact on the potential use of virtual worlds for internal collaboration purposes, the analyst house said. As a result companies should seriously evaluate the availability of private virtual-world environments, hosted internally and existing entirely inside the enterprise firewall.

Confidentiality
Discussions involving confidential and commercially sensitive information shouldn't take place inside Second Life or any other virtual world - or in an open, internet-supported social-networking site, Gartner warned. But by moving to a private virtual world the issues of privacy, confidentiality and identity can be controlled. The analyst also says non-US organisations may wish to avoid virtual worlds that are subject to US jurisdiction because this may result in stored information being subject to legal scrutiny.

Brand and reputation
Uncontrolled virtual worlds represent an environment "fraught with danger" for enterprises that are sensitive to brand and reputation issues, the analyst said, so enterprises should exercise extreme caution in their virtual-world activities.

Productivity
Many senior executives view virtual worlds as a waste of time as well as computing and bandwidth resources. But while unconstrained use of virtual worlds for all staff is "probably inappropriate and unnecessary", enterprises should keep an open mind and evaluate trials carefully to avoid premature and inappropriate decisions, it said.