Within the context of rapid communications growth, Instant Messaging (IM) has emerged as the fastest growing medium of all time. Compared to e-mail, it reached the benchmark of 50 million users in less than half the time and has held steady over the past several years with approximately 200 percent growth within the enterprise. Further, a recent survey by Radicati found that more than 85 percent of all organizations have some amount of IM use. However a large percentage of corporate IM use is occurring without IT sanction, so few companies have a clear picture of if and how IM is being used inside their organization.
IM offers real-time communications and presence awareness, combining the immediacy of the phone with the discreteness of e-mail. As a first step, organizations should determine whether IM is a viable communications tool for them and, if so, deploy it as an enterprise service. For many small businesses this means placing a management infrastructure on top of existing consumer networks, allowing the organization to leverage networks and clients they have today but also provide management, visibility and reporting on top of them.
Once IM is deployed as an enterprise service, organizations should move quickly to mitigate the most pressing threats. IM threats are generally in the form of viruses and worms that attack and compromise user desktops and corporate networks as a whole. Once those threats are neutralized, the company should focus its attention on enforcing policies that mitigate the broader spectrum of risks, including regulatory compliance, corporate governance and loss of intellectual property.
As IM usage is better controlled, secured and managed, organizations should establish a more comprehensive IM strategy. The strategy should include plans for reducing the costs of supporting real-time communications, identifying areas for building economies of collaboration through standardization and consolidation, and integrating real-time communications into the organization’s business processes.
Most organizations today spend a significant amount of time and money managing, securing and archiving e-mail communications. Few realize that IM not only carries with it much of the same security and legal risks as e-mail, but that the nature of IM creates its own unique management and security challenges. Therefore it’s important that organizations implement a security solution that addresses these challenges. Symantec IM Manager seamlessly manages, secures, logs, and archives corporate IM traffic with certified support for consumer IM networks and enterprise IM platforms. Granular policy enforcement and security controls for text messaging, file transfers, audio, video, VoIP, application sharing, and other real-time communication capabilities address the potential risks associated with the use of IM within the organization.
—Lee Weiner, Senior Product Manager,
Symantec.
Far from the realm of chatty teenagers, IM and especially presence (the indicator that you are online/offline and available/busy) is relied upon by upwards of 90 percent of business users according to a report from Osterman Research. Moreover, we know from working with Wall Street and government customers that IM and presence have become mission critical infrastructure in most sensitive and sophisticated environments because of the increased speed with which users are able to connect with one another and with the information they need to perform their jobs.
How IM is deployed and used though varies widely, differing in ways large and small from one office culture to another. While many large enterprises have caught on to the need for a coherent policy and administration of IM traffic, the truth is that the majority of business IM still occurs without any official sanction over the public networks provided by AOL, Yahoo!, MSN, Google, Skype, and others. While these networks can provide an easy (and seemingly free) mechanism to exploit the benefits of IM and presence, you do get what you pay for and may in fact be unnecessarily exposing your company to potential perils. Namely, for the same reasons your company probably does not use Hotmail (or any other free email service) for its business communications, your company should probably avoid using a free IM service for corporate messaging. Beyond the obvious security, policy and document retention issues, business relationships with key customers can be jeopardized by employee departures when public IM is used for communications. There is no easy way to re-establish these connections as the company has no record of the correspondence.
The approach a business takes to IM, in terms of IT management and appropriate use policies, should be consistent with how the company now manages email. That may mean bringing an IM server in house, it may mean relying on a hosted service, or it may be another solution. The bad news is that bringing IM into compliance with internal, and in the case of many regulated industries external, policies will require some investment in time and materials. For small businesses, the good news is that appliances – such as my company's JabberNow – have come to market in the last year that offer plug-and-play corporate IM based on the most widely deployed industry standards.
In all cases, it is important that employees are made aware that IM traffic is or may be subject to the same policies as email, and that an IM conversation can be archived and retrieved in much the same way as email, i.e. it is a permanent record with all of the according benefits and perils an archive offers.
—Dave Uhlir, Vice President of Marketing,
Jabber.
IM is a very useful tool for communicating with someone in real time and its underlying technology, presence, allows users to see who is available immediately to respond to a customer query or other real time information need. That said, IM also poses four serious risks to your organization:
1) Because most IM in the workplace consists of consumer IM clients, most or all of the information sent via IM is not encrypted, thereby potentially exposing your confidential information to the outside world.
2) Consumer IM clients do not offer namespace control. Your employee whose IM handle is 'HonkyTonkBob' can communicate with your customers and suppliers using this less-than-professional moniker. Plus, when Bob has left your organization, there is no indication to the outside world that he has done so.
3) IM represents a vehicle for intellectual property to leave your organization because it bypasses any content filtering systems you might have in place.
4) IM represents a major avenue for viruses, worms and other harmful content to enter your network. The number of IM threats exploded during 2005 and are continuing at a rapid pace today.
There are several things that any small organization should do to protect itself with respect to IM use:
First, determine to what extent IM is being used in your organization. You can install any of a number of products (some of them free) that will sniff out IM traffic on your network and report back on the IM clients in use, who is using them, how many instant messages are sent each day, etc.
Second, determine how important IM is to your employees by asking them how and why they use it. Some managers, upon finding significant use of IM and fearful of the consequences, will simply try to block all IM use. Because IM is so useful, blocking IM can actually have more negative consequences than they risk you face from allowing its unfettered use.
Third, determine how your organization should use IM now and in the future.
You may decide that you want to use consumer clients because your employees use a variety of these clients already, or you may want to swap out these clients for an enterprise-grade solution. If you opt for the former, you should deploy a system that will protect your organization from the four consequences noted above.
Fourth, think about how presence can be used in your organization. For example, you might want to integrate presence with backend systems to provide better functionality for your employees, such as allowing access to a corporate directory via an IM client.
In short, IM is an extremely useful technology and, if managed properly, can provide a variety of benefits for any organization.
—Michael Osterman, President,
Osterman Research.
