The only security risk it needs to be is to blind us from other security risks. That can be accomplished by its behavior in the network monitoring tool (many malware applications behave very similarly in a p2p fashion) or by putting us at risk of running over the amount of traffic we're licensed for in any of our tools. We're not in the business of buying licenses to support a program we explicitly disallow, so instead we're in the business of explicitly disallowing software that would put us over that license. P2P raises our risk level just by being noisy. iTunes does the same thing, and it's not P2P. It's just really, really chatty and it is also disallowed by policy. Chrome and Outlook don't put us in danger of being over our license or out of bandwidth.
Users don't understand. I get it. Information security is a young industry, and some decisions that are made might not be immediately clear. It's a negative job; if you're doing everything exactly right, users will be complaining that you're getting in their way and the bosses will be wondering why you even have a budget. If you're not doing everything exactly right, users will be complaining that they have odd charges on their credit cards and the bosses are wondering why they can't log into their email anymore.
You might not like my driving, but covering my eyes with your hands doesn't solve that problem. P2P blinds my network monitors just like your hands blind my eyes.
If bandwidth is the only issue, then it's not really a security risk, persay. China, for example, isn't going to own your network because you have a P2P client running somewhere.
I do get what you're saying about P2P filling up your network monitoring logs, though I would argue that the monitoring software might not be properly configured if such is the case. I don't know all that much about network monitoring tools though, so I don't know the specifics. I do know that it's possible to run a secure network and have P2P clients on that network, however.
Users don't understand. I get it. Information security is a young industry, and some decisions that are made might not be immediately clear. It's a negative job; if you're doing everything exactly right, users will be complaining that you're getting in their way and the bosses will be wondering why you even have a budget. If you're not doing everything exactly right, users will be complaining that they have odd charges on their credit cards and the bosses are wondering why they can't log into their email anymore.
You might not like my driving, but covering my eyes with your hands doesn't solve that problem. P2P blinds my network monitors just like your hands blind my eyes.