A Subtle Shift in File Sharing Usage

Since the inaugural Application Usage and Risk Report (Spring Edition, 2008), browser-based file-sharing usage in terms of frequency has steadily increased to the point where it now exceeds that of peer-to-peer file sharing.

Comparative growth of browser-based file sharing usage.

To be clear: we are talking about how often browser-based file sharing was found during our traffic analysis. The increased frequency is not too surprising really. The business benefit to browser-based file-sharing applications is they make if very easy to move large files such as a presentation or a graphic. Users are no longer forced to split a file up or take other steps to get around the email attachment limitations.

This is not to say that P2P file sharing has gone away or dropped off in use. On the contrary, in almost all measurable aspects, P2P is still tops in terms of file sharing. A comparison of resource consumption and the number of variants found is shown in the table below.

Now let’s take a look at the risks. It would be inaccurate to say that browser-based file sharing pose the same level of risks that peer-to-peer applications pose. There have been no known errant distributions of confidential files through browser-based file sharing, possibly because they are user-to-user focused as opposed to the broadcast focus for P2P.

However, browser-based file sharing applications do pose some risks because they represent an avenue for purposeful transfer of confidential data. In addition to the potential data leakage risks, these applications provide a vector for the delivery of threats – either directly from someone pulling down an infected file, or indirectly through malware-infested advertising (a known delivery mechanism) as part of the application providers’ business model.

The action that you should take is first determine if these applications are in use and the reasons why. Then work with your constituents to apply security policies to protect network while enabling use.