x



Loading... Please wait...

Advertising
advertise here
The Experts
Displaying 5 of 27 in this category
Click here to see all

James Blake
Mimecast
Group Chief Security Officer

Chris Atcheson
Reed Exhibitions
Information Security Director

David Emm
Kaspersky Lab
Senior Technnology Consultant

Stewart Room
Field Fisher Waterhouse
Partner

Peter Wood
First Base Technologies
Chief of Operations

Category: General
Posted: 13:48 pm, Mon 7th Dec 2009

Can anyone offer any advice on how to mitigate the security risks of instant messaging?

Answers
Piers Wilson wrote:

It depends on what you are trying to achieve - are you hoping to use it for business purposes as an organisation or are you looking to block it for your users.

If the former then the provision of enterprise wide instant messaging can provide an easy way to communicate across a business, even presence services can be useful to know if its worth calling someone.  Couple of things to watch though are the secrecy of messages - i.e. is the traffic protected from interception (if you have an internal service this is clearly easier than using an external facility); also what content controls and acceptable use policy do you want.  It is worth giving users a steer as to what is and is not acceptable and you also should notify them that all conversations will be logged (or that they consent to logging) so that you can introduce some control, deterrence and police its use.  Depending on the jurisdiction you may find logging/monitoring is illegal, or it may only be legal if you have told people its is happening, and in some cases only if they have given consent.

If you are allowing or blocking it for users using external MSN type services, then you have a number of issues from ingress and egress of files and information, media sharing and copyright controls and also productivity issues.  You might block it to avoid all of these, or you might allow it despite them if you have a valid business need - for example to communicate with third parties on activities.  Again, if you don't block it consider the sensitivity of the information (it may be possible to encrypt messages) and also make sure you have guidance and policy governing its use.  If it helps most people block the external type of service, but it may or may not be the right choice for you...

 

Hope this helps, as usual its hard to answer fully in this forum... contact me for more details if you want. 

   

© 2009 Reed Exhibitions | Contact Us | Privacy Policy

Infosecurity Adviser is produced by Reed Exhibitions with thanks to Tangent Labs