Take control of corporate IM: implement best management practices now!

Computer Technology Review, Feb, 2005 by Peter Shaw

For those of you who remember the late 1980s, instant messaging systems began with the early proprietary versions of AOL Instant Messenger (AIM), and the public Internet Relay Chat (IRC). It was also in the late 1980s when Bobby McFerrin's ("Don't Worry, Be Happy") was at the top of the music charts--but are IT executives still singing the same tune today when it comes to corporate communications?

Instant Messenger

Developed as a communications tool for interacting initially with friends and family, many of IM's most avid users (particularly 'knowledge workers' and those in technology-driven fields) brought IM into the workplace to leverage its presence awareness features (e.g., 'online', 'busy', 'away') to stay in touch with family, co-workers and friends. The Radicati Group predicts there will be 1.4 billion IM accounts by 2007--up from 590 million in 2003. In business, it expects 349 million accounts by 2007--up from 60 million in 2003.

In a nod to the overwhelming speed at which ad hoc IM adoption penetrated the business environment, most organizations have embraced (or at least not prohibited) the use of IM by their employees, even while they struggle to get it under control. For example, there are now a number of secure, proprietary enterprise IM systems designed specifically for businesses, yet more than 90% of the IM used in organizations relies on the same insecure public systems freely available to any individual.

In addition, fewer than half of all organizations have even specified one IM system as a corporate standard. And perhaps most significantly, seven out of ten have yet to establish any formal policies or implement systems to ensure its security and appropriate use.

What to Look Out For

The evolution from personal communication to workplace tool, combined with ignorance as to how the system works, means that most IM users are rarely aware of the potential risks that may affect the organization. Public IM systems operate 'in the open' where others (with modest effort) can eavesdrop. Additionally IM systems, both public and proprietary, often operate beyond the range of corporate firewalls and other security systems.

Some serious risks companies face by not managing their IM use include:

Information leakage: Either intentional or accidental revelation of confidential or proprietary information through IM sessions and/or file transfers.

Worms, viruses, malware, Spim (spam over IM): Numerous malware programs target public IM systems and allow them to bypass standard firewalls and mail server anti-virus systems.

Network hackers and intrusions: Hackers use IM operating ports to bypass other security barriers and enter the corporate network unimpeded.

Compliance, regulatory and/or legal violations: Organizations with government oversight and industry compliance mandates may find themselves creating legal issues by failing to properly monitor, log and regulate IM sessions and content.

Productivity loss: Idle chat can disrupt employee productivity.

Why You Need IM

The primary reason that IM has been such a success in the business environment is that its benefits, even when weighed against the risks, are both immediate and tangible. Presence awareness allows users to see who's available without the need to pick up the phone or travel to another part of the building. The real-time nature of the medium makes it a faster and more efficient means of getting answers, transferring documents and sending information, than email or the telephone. And IM provides a direct mode of communication with co-workers, customers and vendors that enables far closer and more personal relationships than is available in virtually any other means of electronic communications.

Not surprisingly, the vast majority of employees believe that the use of IM within their organization improves productivity, external relationships and their efficiency. More significantly, however, is that even business managers and IT personnel who are aware of the risks posed by IM, overwhelmingly favor its use noting that the added 'real' business performance more than offsets the potential risks.

How to Practice Safe IM

Best Management Practices (BMP) for business IM enable productive instant messaging within a secure and compliant framework. In applying BMPs, business executives, IT staff and corporate IM users work together to establish balanced policies and enforcement tools to minimize security risks while ensuring maximum benefit. BMPs for business IM consists of five specific practices:

* Discovery: Exploration and documentation of the organization's current IM assets, policies and needs

* Written policies: Clearly and explicitly define the acceptable and unacceptable uses of instant messaging within the business environment

* Technology: Includes implementation of standard client and network security procedures to ensure that IM gateways and access points are properly secured against viruses and malware, hacking and intrusion, and unauthorized inbound/outbound file transfers