IM: An Underestimated Security Threat

Updated: September 21, 2015

Issue

 

Focused on email security, many network managers are overlooking the dangers presented by IM (instant messaging) technology. After all, IMing your sister-in-law an impromptu dinner invitation from your office cubicle seems pretty harmless. But IM in the enterprise is exploding, as 85 percent of organizations in North America report IM use, according to The Radicati Group.

What's the best way to protect your business from the threats posed by IM? Although IM is a relatively new technology, several effective strategies exist to help you secure your business.

 

Analysis

 

In the past, the security threat from IM was seen as an additional gateway to the enterprise as well as a concern for securing private corporate data. But that's not the issue anymore. Studies estimate that IM worms and viruses are growing exponentially. In fact, Akonix Systems tracked 297 malicious code attacks over IM networks in 2007 - a 20 percent increase in IM threats over the previous year. And while 60 percent of organizations monitor and secure email, studies estimate that 90 percent of organizations lack any form of IT sanction or control for IM. That equals exposure to a rash of security threats, data leakages and legal liabilities.

James Quin, a senior research analyst with Info-Tech Research Group said, "The vast majority of companies really aren't even aware that there's an issue associated with IM malware .... But when you look at the fact that IM is increasingly being used as a distribution platform for malware - viruses, worms, Trojan horses - and is also a very serious threat in terms of data leakage, organizations simply can't continue to take the track that IM is not something they need to worry about."

Quin said one of the greatest dangers posed by IM is data leakage. Unlike email which is typically logged, tracked and blocked by an organization, IM communications tend to exit an enterprise outside of the watchful gaze of an IT manager. "If I'm sending something through IM on a server that's not maintained by the company and it goes out through a generic traffic port, as far as the firewall is concerned, it's plain old Web traffic," he said. "It's a bit of a sneaky way to get information out of the enterprise."

There are steps companies can take, however, to wrest control of enterprise IM and to minimize exposure to security and legal threats. Here are just a handful of precautionary measures:

1. Get rid of it. Sure, IM lends itself far more easily to informal conversation than email, rendering it a faster and lighter alternative. But is it really necessary? What business value does it deliver? The first step, said Quin, is "determining if IM is something you feel is an appropriate part of your business communication strategy."

2. Get it off your public network. By preventing IM from being sent over public networks, companies can better manage security challenges. "Organizations should look at deploying an internal IM capability rather than using one of the freely available ones outside of the enterprise," said Quin. Microsoft's unified-communications suite, for example, delivers messaging capabilities, which enables companies to manage IM on internal servers and restrict communications to in-house usage.

3. Patch it up. Many public IM networks offer patches to protect against the latest program vulnerabilities. Network administrators need to install and update these IM patches regularly.

4. Turn to a third-party provider for high-level security protection. Symantec, for example, offers an IM-management tool that secures, logs and archives corporate IM traffic on both public and enterprise IM networks.

5. Institute a clear policy about IM use. "No technology should ever be deployed without a policy," said Quin. IM is certainly no exception. Companies must establish best practices for the uses of IM and any restrictions that apply. In addition, organizations should educate employees on the dangers of IM and inform them of important precautionary measures such as storing IM passwords, communicating with unauthorized sources and refusing file transfers and attachments.