Greynets - IM and other real-time, collaborative applications such as web conferencing, P2P file sharing and VOIP (eg skype) - all represent a tremendous competitive advantage because of their efficiency, cost savings and presence-orientation. However, the ubiquity that makes these applications so hugely popular requires much stealthier behavior on the network than traditional email and web browsing applications.
At the same time, email security has matured, leaving IM as the new target for viruses, spyware and other malware. But the traditional security infrastructure that was designed for email or web browsing is not equipped to handle the threats targeting these real-time applications. And, the risk of information leakage becomes a greater threat as use of these applications goes on uncontrolled.
Small businesses don’t necessarily need to invest in an enterprise IM system to ensure best practices for the safe and productive use of IM. But putting best practices in place for the use of public IM can be easily transported to an enterprise IM system when the time is right. The reality is that whether your business adopts an IM client like Jabber, IBM’s SameTime or Microsoft Live Communications Server (LCS) – or whether you use public clients such as AIM, MSN, Skype or Yahoo! – many of the security issues and business risks are similar between public and enterprise IM.
Best Practices for IM implementation should include three primary components:
a) Get some visibility into how employees are using the IM channels - what is it
really being used for in my organization? Is this helping the business?
b) Make decisions regarding acceptable business use policies.
1.Publish these policies and educate users on their value
2. “Coach” users by informing them of policy violations in real-time (as employees break the rules on the network, use IM to communicate policy violations and warning messages to users. This has an added benefit of letting employees know that they are being monitored – which usually makes the typical employee comply out of fear of “being caught”).
c) Implement corporate policy actively on the network with a product that secures and controls the IM channel by scanning for incoming threats, detecting and flagging potential information leaks in both IM conversations and file transfer attachments, and archiving both IM conversations, as well as file transfer attachments, that are embedded in those conversations.
It’s a double-edged sword – but as long as you understand how to properly secure your organization both from external threats and from potential information leakage from within, you’ll be on your way to reaping the productivity and efficiency benefits of IM.
—Frank Cabri, Vice President,
FaceTime
If readers take only one thing away from this discussion let it be
acknowledgement. Instant Messaging is the most commonly used, legitimate form of communication on the Internet. Every online business must assume their employees are instant messaging and decide how they want to regulate it.
While blocking IM altogether might seem like an attractive option for many organizations, it should be carefully considered. IM is a valuable business tool that allows co-workers and clients to communicate one-on-one in real time and easily see who is online and available, without the delay of email or having to drop everything to pick up a phone. Blocking IM can also be a tall task, as there are ways around most blocking techniques (port blocking, etc.); not to mention the fact that it doesn't exactly inspire a sense of trust between employees and management.
Regardless of the direction businesses choose, all should create and communicate a written policy that clearly states IM is a part of the company resources provided to employees. This policy should state that any instant message written, stored or transmitted using company resources may be accessed or saved by the organization and include a detailed description of what type of IM activity is permissible and what is not. This policy serves a minimum of two purposes. It protects organizations from legal ramifications due to negligent or illegal instant messaging by employees. It also serves as a deterrent, warning employees that management is aware of instant messaging and may be monitoring their activities which often is enough to prevent employees from abusing IM.
In conjunction with an IM policy, many organizations choose to implement IM technology to reinforce or execute their policy. One sensible option is to run a private, in-house IM service. Internal IM services provide co-workers with another avenue to communicate quickly and efficiently. They also provide management with the means to monitor and control IM; as well as the option to prevent employees from instant messaging out to the Internet, avoiding security and privacy risks. IM security and archiving systems are also available to monitor and control public IM usage (Yahoo, MSN, AOL, etc.), providing organizations with the tools to oversee all IM traffic and meet regulatory compliance provisions.
—Don Hoyt, Public Relations Coordinator,
Deerfield.
