Seventy percent more companies reported spam and malicious infections arrived via social networks in 2009 vs. 2008. By the end of last year, 72% of companies expressed concern that their employees' use of popular social sites could result in a security breach. And 60% of companies now consider Facebook to be the riskiest social network out there.

Those findings, released Monday, come from a survey of 500 companies worldwide conducted by security firm Sophos. They help quantify the rising tide of spam and malicious infections proliferating on Facebook, Twitter, MySpace, Bebo and other such social networks.

As the planet' s largest social network, Facebook might naturally be expected to emerge as the No. 1 target of cybercriminals, says Graham Cluley, a senior analyst at Sophos. But he says Facebook has exacerbated matters by asking its members to embrace a new, more granular privacy setting. Cluley demonstrates in this video how the new setting, in effect, authorizes Facebook to expose more of its member-generated content to everyone on the Internet.

Facebook's new privacy setting gives the company leeway to submit more content to Google, Microsoft Bing and Yahoo Search so the search services can incorporate more Facebook content into real-time search results, much as they've begun doing with Twitter microblog postings, says Cluley.

However, the wider release of Facebook members' data "inevitably means more information will be made available to cybercriminals who want to target you or you company for an attack," says Cluley.

Facebook continues to defend its new privacy setting as flexible and easy to change. But privacy advocates continue to criticize the move. And last week the Office of the Privacy Commissioner of Canada launched an investigation into a citizen's complaint about the new settings.

Meanwhile, Sophos' new survey includes extensive analysis about how Facebook, Twitter and other social networks have become like a candy store for data thieves. The fast-morphing Koobface social network worm is a case in point: