IM in Today's Enterprise
by Stephanie Jordan
As corporate adoption of IM continues, so do malicious attacks that use unprotected platforms to spread worms, malware and viruses on the network. According to Akonix Systems' April threat report, its researchers tracked 38 malicious code attacks over IM networks that month. The report noted that although IM threats are substantially higher than last year's overall, it was the first time in 2007 that the number of attacks increased when compared with the previous month. New IM worms identified included Pykse, Samo and Tiotua. Sohana was the most common with seven variants. "Malware continues to be released through IM networks, and is on the rise again for the first time since January," observes Don Montgomery, VP of marketing at Akonix. "Businesses cannot ignore the liabilities and potential damage they are opening themselves up to with unmanaged IM applications and networks."
How many enterprise organizations have IM today? A lot. "Real-time communications like IM have now penetrated approximately 90 percent of organizations, in most cases because employees felt they needed these collaborative applications," says Frank Cabri, VP of marketing for FaceTime Communications. Many companies are finding the collaborative benefits of IM can help the organization-for example by providing better service to customers, keeping remote workers in touch, saving money on long distance calls, plus many more. "Like email, IM has many benefits, but it can expose the organization to risks. Can you imagine the competitive disadvantages to an organization that does not have email? The same will be true for IM," predicts Cabri.
The Impact of IM Growth
According to Cabri, applications available to end-users are growing and are real-time in nature. This adoption is driving new requirements for security and performance, rather than forcing organizations to make a tradeoff. "Most organizations will find the need to adopt a dedicated IM hygiene and management solution to manage IM," anticipates Cabri. Cabri knows larger organizations have adopted archiving for their email records to assist in meeting the compliance requirements of other regulations, but far fewer have adopted the same disciplined approach to instant messaging and other real-time communications records. "In these days of multi-channel communications, a unified system of electronic messaging archival that not only encompasses the requirements of all relevant compliance legislation, but also the content generated by all electronic messaging systems is needed." Cabri believes that the new federal eDiscovery rules will drive compliance and archival requirements for IM and a host of other new communications applications.
Regulation and Compliance
As with the growth of email came regulatory and compliance requirements, so it goes for IM. "Corporate governance and acceptable use policy, which once just applied only to email and Web browsing, is now extended to public and enterprise IM networks, professional communities, as well as the chat capabilities associated with Skype and web conferencing." messagingnews.com 29 There are differences between email and IM requirements. Cabri notes that the challenges associated with information sharing occur throughout the enterprise, but IM poses a unique set of challenges. "These applications operate largely out of the sight and the control of IT departments, due to IMs use of multiple ports and protocols. Contrast this with email, which is static in the ports (Network Port 25) and protocols (SMTP) used. Logging and archiving, unauthorized use, circumvention, and network security risk are just a few of the issues compliance personnel must be aware of," says Cabri.
There is no doubt that IM regulation has been heavily influenced by email regulation. April sees the revised Federal Rules of Civil Procedure as evidence of that. "It clearly spells out that electronic communications include IM." Perhaps the biggest regulatory impact on IM is the new eDiscovery legislation that went into effect December 1, 2006 requiring organizations to keep track of all electronic records and be able to produce electronically stored information (ESI) as part of the litigation discovery process. "Almost any IM application can store the text history of the conversation on the user PC," points out Cabri. "Most legal representatives are not aware of this technical capability, which could establish the communication as ESI."
What Customers Want
As the growth of IM continues, IM users and those required to manage it are making their needs known. "Customers want one platform that can help them manage both email and IM," says April. "They also want the ability to be proactive. To modify enduser behavior as part of their role in enforcing internal use policies and external regulatory compliance. DYS Analytics' latest solutions expand on the features we've provided for proactive, automated control." April also believes that as unified communications takes hold- bringing email, IM, and even voice and video over a common network-companies will be looking to unify the management solutions they use. "In many ways, email, IM and all electronic communications share both regulatory and IT management requirements. So we're making sure we roll out solutions that serve our customer's more unified needs as well," states April.
Cabri sees that too. FaceTime customers are requesting controls for other modalities of Unified Communications (UC)-applying all the security and management capabilities for IM to other components of a UC suite including Web conference, VoIP, etc. "Our customers also want ease of integration with their existing environment including directories, storage systems, and other infrastructure. Organizations standardizing on an enterprise IM platform often want to monitor or prevent rogue public IM use," reports Cabri. Generally, it seems customers want more. "Our customers want large scale deployments and all the increased reporting, management, and highavailability requirements that come with a large, business critical application, such as increased requirements for security and compliance, and information leak prevention."
The Future
As for the future, Cabri believes that presence is evolving to become the new real-time communications platform, extending through the business network to become the nextgeneration dial tone. "Today, we're at the beginning of the UC curve with IM-focused presence. This is the beginning of a trend that will lead to presence as the unifying thread for all communications as they converge onto a single IP network with a single identify across phone, email, IM, Web conferencing, and more," expects Cabri. "The next step will be Enterprise IM ushering in a new era of 'rich presence' with multichannel, multi-site solutions. Mobility will soon be incorporated into a unified communications platform and business process change will follow, as presence becomes the new development platform."
Asked if the prevalent use of public IM will continue, Cabri says, "Today, the adoption of enterprise IM has not eliminated the widespread use of public IM. Two-thirds of enterprise IM users surveyed last year also used public IM. This trend is likely to continue as a fresh new class of graduates enters the workforce, and these new employees are very accustomed to using IM." Cabri notes that to these new workers, email has become the new snail mail. "Email has become the interoffice envelope of the previous generation - still useful, but in fewer instances."
April believes that in the short term many disparate consumer IM clients will continue to coexist, and IT will assemble solutions for managing them. "In the long term, we think that enterprise solutions such as IBM Lotus Sametime and its Gateway will expand their adoption. As that takes place, organizations will look for a single platform for managing all electronic communications including email and IM." SJ/TMP