Instant trouble

Email is no longer the biggest security threat

Many companies now do a decent job of monitoring email for trojans, viruses and other hazards. But newer forms of electronic communication, especially instant messaging (IM), are falling through the cracks – and more often than not, staff are installing these programs and using them unbeknown to the business.

Productivity issues aside, rogue IM programs create gaping holes in security features such as firewalls, spreading malware, leaking data and slowing vital systems. And unlike with email, where all most companies have to worry about is Outlook or Entourage, IM applications number in the thousands and keeping track of them is a staggering challenge.

‘The IM world has proliferated over the last few years,’ says Nick Sears, vice president of IM security firm FaceTime. ‘Right now your users are using IM or peer-to-peer networks to send information out of the company – information that would be stopped by email.

‘Fifty per cent of users admit they use real-time communications apps to send info out of the company that wouldn’t go through email channels.’

Sears describes the results of a scan of one company which had insisted it was free of such programs. Over three weeks, the scan detected 25,000 IM conversations with external sources, any of which could have contained sensitive data, and 20GB of peer-to-peer traffic (commonly used to download music and movies). Furthermore, one user’s PC had been remotely controlled by an IM program 11 times without their knowledge.

Legal issues
Beyond these threats, IM adds a few extra spikes to the compliance thorn-bush.
‘Some years ago “email” was replaced in the legislation with “electronic messaging”,’ Sears says. ‘The regulations make no distinction between email and IM, which means you need tools able to store and reproduce IM conversations in the same way as email.’
For all IM’s potential downsides, IT analyst Gartner forecasts it will be ubiquitous by 2010. Says Sears: ‘The younger generation is growing up with real time communications and some organisations are realising that you’ve got to have real-time communication apps if you want to attract the best talent. That’s an absolute fact.’