Can Instant Messaging Really Be Safe?

As IM fever engulfs business, pricey products promise to secure it.

Frank Thorsberg, special to PCWorld.com

Instant messaging may have started out as a tool for teens, but it has morphed into a valuable communications tool for millions of business users. And as those businesses discover IM's benefits, they also encounter its risks--and a host of new products aimed at reducing those risks.

These new products are available from everyone from big-name companies such as Microsoft and America Online to smaller start-ups, such as IMlogic Software and FaceTime Communications. They vary greatly in price and scope, but most of the products offer similar features: risk and security management tools, including searchable storage, usage monitoring, and controls over employee usage.

But beyond the basic features, these products can vary widely. So how do you know if your company needs the security they offer, and whether you're getting your money's worth?

Small Firms, Big Worries

Companies of all sizes are discovering the advantages of using IM for rapid-fire communications with peers, partners, and customers. In 2002, there were 80 million IM users in the United States, and 25 million were business users, according to The Yankee Group. Those numbers are only going up: IM is expected to post a compound annual growth rate of 150 percent through 2005, according to the latest Yankee Group forecast.

But the advantages of IM come with some real risks.

Without messaging security, users could publicly expose sensitive company data and information. Unlike e-mail, IM leaves no record of communications. And IM file transfers aren't subject to server-level virus scans, so users face a real threat of virus infection.

Caught Napping?

Whether you're aware of it or not, IM is probably already widely used in your office. Millions of workers jumped from personal use to business use of IM tools before system managers realized what was happening.

"It's crept in from the bottom up, not from the top down," says Michael Gartenberg, research director for Jupiter Research. "Now that it's here, there are rules and policies, as well as technology, that have been used for voice mail and e-mail that they will have to (use) for IM as well."

It's up to businesses to provide the safety and security needed to gain the full benefits of IM for employees, experts say. Just as they have done with other communications systems like the telephone and e-mail, businesses need to centralize their IM systems and standardize how instant communications are implemented.

"If your employees are using AIM, Microsoft Messenger, or Yahoo Messenger, you have no central control like you have with an e-mail server or telephone switch," says Glen D. Vondrick, FaceTime president and chief executive officer. "There's a need to block key words, be protected from legal risk, security risk, virus risk--all of the things associated with information on your network leaving the firewalls and being inappropriate or subject to competitive risk."

Pick a Product

So, where should a small company turn for protection? Most small firms can rule out expensive hosted IM solutions (like Reuters Messenger) and enterprise server solutions (like IBM Lotus Sametime and Microsoft Exchange Server) as too costly and lacking interoperability with public systems like AOL Instant Messenger, Yahoo Instant Messenger, and MSN Messenger.

Several big-name technology players, including Microsoft, AOL, and Yahoo, have jumped into the business IM market. AOL's business IM service, in fact, may be a very viable option for smaller companies.

AOL's business offering uses the company's free, and very popular, AIM instant messaging service. (AOL claims more than 195 million registered AIM users.) Users get the same AIM interface they are accustomed to.

Behind the scenes is an added security service called AIM Enterprise Gateway. This software was developed by AOL using technology from FaceTime, which also markets its own IM security software.

The AIM Enterprise Gateway works as a proxy between AIM users behind a corporate firewall and AIM users on the public network. Companies pay between $34 and $41 per year for each user plugged into the gateway. The software allows your IT staff to manage and monitor IM traffic, log and audit messages, and limit access to certain features, such as file transfers.

More Software Solutions

Additional likely IM solutions for small businesses will come from platform-independent players like FaceTime and IMlogic. They offer similar features, including customer service controls and enhanced collaboration capabilities.

Both services allow instant messages to be stored in searchable archives, and can satisfy compliance and audit requirements. Like AOL's offering, these services can also map employee screen names to maintain consistent corporate identities, and can identify specific employee or workgroup usage. IT managers can control employee access to IM networks, and can block file transfers via IM.

But control isn't cheap. FaceTime's server and network license packages start at $5000. User fees range from $15 to $50 per employee, depending on volume. The pricing is based on a few different variables, including the number of networks being used, the number of users, and the number of servers.

IMlogic offers a "quick start" package for $15,000 that covers up to 100 employees. Included is support for all ten networks that IMlogic supports, including AOL, MSN, Yahoo, and IBM Lotus Sametime.

Added Benefits

IM isn't all about risk--it can deliver key benefits. "It's saving you telecommunications, network costs, and storage," says Francis deSouza, president and CEO of IMlogic.

DeSouza, former head of Microsoft's Real-time Collaboration Group, says that IMs save companies more than time.

"Sure, there are a lot of IMs, but each IM is very small in size or pretty short," he says. "It actually cuts down on e-mail traffic, and e-mail is very fat. So the odd thing we discovered is that it [IM use] actually drops overall network traffic and drops storage requirements."

Central controls on IM systems are a natural fit for the financial and legal industries, but they also have value for energy-trading and manufacturing companies, especially small companies that are suppliers to much bigger firms.

"It's especially valuable for any information knowledge industry where a lot of what they do is communicate with customers and suppliers...outside the firewall," deSouza says.

By their very nature, small businesses have a greater need for outside communications, and that makes them prime targets for increased IM usage.

"They have a lot of constraints--they are concerned about telecommunications costs, concerned with storage, and they have a lot of out-of-the-company communications, and their people are often more widely distributed and not necessarily in the same location," deSouza says. "Those are a lot of reasons you want to do IM, and why it can be an especially important tool for small business."