Think KaZaA sounds cool? Think Again!...

P2P stands for Peer-to-Peer. For those who have been in IT for years, the phrase "peer-to-peer" may bring back memories of Windows 95/98 for Workgroups, but today P2P has the connotation of "file swapping" over the Internet. Although business software solutions may use P2P to communicate, P2P technology is used in many non-business applications to create virtual networks across the planet. Despite the design or stated intent, many of these popular applications, such as KaZaA, Gnutella or Morpheus, are used to share or swap pirated material, from music to software. KaZaA, for example, links computers connected to the Internet, together with other computers running KaZaA. The software does not have a central server component- thus the peer-to-peer relationship. Due to the popularity of sharing music, these P2P applications have been downloaded and installed in massive numbers, including on employee's work machines that are connected to a corporate network.

So why does Leapfrog think you should know about P2P applications? Let's look at four potential problems, all of which can have a significant impact on your organization if installed on your corporate network.

First, several of the applications, including the popular KaZaA, install "spyware" or "scumware" components with the application. Spyware is software that monitors Internet activity and generally reports to marketing firms. This software replaces or intercepts legitimate links on web pages that you view with its own links, thereby hijacking the page's links.
The next problem with P2P is that it can attract hackers. Hackers trying to invade a network or computer are primarily looking for open "file shares". The purpose of P2P file-sharing applications is just that! - file sharing. A P2P file-sharing application installed on a corporate computer is potentially an open door to intruders.
A third problem caused by P2P applications is the overuse of bandwidth. In a survey analyzing traffic on major Internet Service Providers, almost 60% of traffic was attributed to P2P applications. P2P connections can greatly increase the bandwidth use of an organization, prompting unnecessary Internet upgrades.
A fourth and final problem presented by P2P file-sharing applications is legal in nature. Since many of these applications are used to transfer illegal files, a company is at potential risk due to the illegal use of one of its computers. A judge recently ruled that an ISP was required to provide the name and personal information of a user that was suspected of piracy. Also, a bill was introduced into the US House last summer that would allow copyright holders to legally hack into P2P networks. and allow them to disable, block, or impair such networks.

If you can't tell already, Leapfrog strongly discourages P2P applications. We help our clients define corporate policy, even in companies that have Internet-use policies, to specify whether P2P applications are allowed to be installed by users. Leapfrog already blocks common P2P applications from communicating out of the internal network and can apply even more stringent firewall and router filtering if requested. Many corporate IT security risks come from use of the Internet and P2P is just another piece of the security puzzle that must be managed effectively.

This article originally appeared in the March, 2003 issue of FrogTalk.