Growing IM Attacks Threaten the Enterprise

More and more companies are embracing the benefits of instant messaging as a corporate

application. But many are leaving such applications uncontrolled and vulnerable, and the

potential for attack is sending shivers down the spines of network administrators.

Email still takes priority over instant messaging (IM) when it comes to corporate security,

according to a recent poll of 100 organizations conducted by Akonix Systems, Inc., a San

Diego-based provider of IM security software. The survey shows that only 11 percent have IM

hygiene solutions in place, compared to 73 percent that take care of email. Additionally,

almost 50 percent of respondents say deploying an IM hygiene solution never crossed their

minds.

Industry observers say this gap between the security applied to email and that applied to IM

is particularly alarming since 47 percent of respondents indicate that the people in charge

of email also are responsible for securing instant messaging.

Globally, IM use is on the rise with nearly 12 billion instant messages being sent every

day, according to IDC, an industry analyst firm based in Framingham, Mass. IM use isn’t the

only thing on the rise, however. Attacks on instant messaging are going up, as well.

Akonix tracked 62 IM-based attacks last November, and saw a 226 percent increase over the

previous month, according to Don Montgomery, vice president of marketing for Akonix.

The primary reason organizations are not focused on IM security, despite the increase in

attacks, is that there hasn’t been a major IM virus outbreak yet, according to Osterman.

While email systems have been pounded by malware attacks, the viruses and worms hitting

instant messaging haven’t made as much of a splash yet since the damage has been low, so

far.

And many network administrators think the protections they already have in place will

safeguard IM, as well.

”There’s a perception that a lot of investments made in firewalls and perimeter security

will protect [networks] from viruses,” Osterman says. ”They would be wrong, though,

because instant messaging uses unique protocols and a firewall won’t be able to scan instant

messaging for content or for malicious URLs or for the file transfer for viruses.”

Osterman adds that firewalls work by shutting down ports. But public IM clients, like Yahoo,

AOL and MSN, which many employees use in lieu of a corporate standard, are port seeking.

”You can shut down one port and the public IM clients will find another,” he explains.

IT administrators at Kforce Professional Staffing, based in Tampa, Fla., aren’t going to let

that happen. The professional staffing firm has taken prescriptive steps to ensure that its

approximately 1,400 employees, who are situated around the U.S., are protected.

”We didn’t want to hinder productivity since… we believe [instant messaging] will be a

good tool for employees, especially if someone in one office wants to discuss a job with

someone in another office. It’s real time,” says Jon Portz, network security lead at

KForce. ”We had anti-virus software in place… but it can’t stop a direct attack on a

buddy list on AIM, which is quite vulnerable to buddy list hijacking.”

Administrators at Kforce decided to bring in an instant messaging security and management

system to handle ”uncontrolled use of IM, whatever the client”. Portz adds that they also

wanted to prevent ”information leakage”, and have the ability to track and log employees’

IM sessions.

The enterprise instant messaging security market is burgeoning. Other providers include

FaceTime Communications, IMLogic, which was recently acquired by Symantec Corp., Postini,

Inc. and ScanSafe, Inc.

Since moving to Akonix, which Portz says provided granularity of control and customization

features, KForce has standardized on MSN and AIM clients until it moves to an internal IM

solution.

Akonix gives Portz the ability to create reports on usage and do keyword searches if he

wants to check on employees discussing a particular subject. ”Compliance is gaining concern

here,” he notes. ”Our HR and legal departments have given us directives to treat IM as

email.”

Company administrators are looking at integrating Akonix with their Legato mail archive

system, which would give them the ability to archive all instant messages as if they were

email and attach the conversations to a specific user, Portz notes.

”If something questionable comes across Akonix, I get an email,” Portz says. Since Kforce

doesn’t allow use of the extended attributes of IM — raw chats only — an employee will

receive a notification that they have violated company policy if they try to do something

like an audio/visual session, for example.

”We also get an alert from Akonix if anything outside of the policy boundaries, like file

transfers, occurs,” he adds. ”Executives used to be very afraid of IM. Trying to lock it

all down and turn it all off is harder than you think… Having an instant messaging

security management system in place gives a heck of a lot more peace of mind.”

Osterman says it’s a given that there will be a big outage caused by instant messaging.

”Its not a matter of if, but when.”

He estimates the cost of implementing an IM security system at about $10 per user. ”We

point out to companies,” he notes, ”that they’re spending more on coffee every year for

their employees than to protect themselves from outside threats.”

RELATED NEWS AND ANALYSIS

• Ethics and Artificial Intelligence: Driving Greater Equality

  FEATURE |  By James Maguire,
  December 16, 2020

• AI vs. Machine Learning vs. Deep Learning

  FEATURE |  By Cynthia Harvey,
  December 11, 2020

• Huawei’s AI Update: Things Are Moving Faster Than We Think

  FEATURE |  By Rob Enderle,
  December 04, 2020

• Keeping Machine Learning Algorithms Honest in the ‘Ethics-First’ Era

  ARTIFICIAL INTELLIGENCE |  By Guest Author,
  November 18, 2020

• Key Trends in Chatbots and RPA

  FEATURE |  By Guest Author,
  November 10, 2020

• Top 10 AIOps Companies

  FEATURE |  By Samuel Greengard,
  November 05, 2020

• What is Text Analysis?

  ARTIFICIAL INTELLIGENCE |  By Guest Author,
  November 02, 2020

• How Intel’s Work With Autonomous Cars Could Redefine General Purpose AI

  ARTIFICIAL INTELLIGENCE |  By Rob Enderle,
  October 29, 2020

• Dell Technologies World: Weaving Together Human And Machine Interaction For AI And Robotics

  ARTIFICIAL INTELLIGENCE |  By Rob Enderle,
  October 23, 2020

• The Super Moderator, or How IBM Project Debater Could Save Social Media

  FEATURE |  By Rob Enderle,
  October 16, 2020

• Top 10 Chatbot Platforms

  FEATURE |  By Cynthia Harvey,
  October 07, 2020

• Finding a Career Path in AI

  ARTIFICIAL INTELLIGENCE |  By Guest Author,
  October 05, 2020

• CIOs Discuss the Promise of AI and Data Science

  FEATURE |  By Guest Author,
  September 25, 2020

• Microsoft Is Building An AI Product That Could Predict The Future

  FEATURE |  By Rob Enderle,
  September 25, 2020

• Top 10 Machine Learning Companies 2021

  FEATURE |  By Cynthia Harvey,
  September 22, 2020

• NVIDIA and ARM: Massively Changing The AI Landscape

  ARTIFICIAL INTELLIGENCE |  By Rob Enderle,
  September 18, 2020

• Continuous Intelligence: Expert Discussion [Video and Podcast]

  ARTIFICIAL INTELLIGENCE |  By James Maguire,
  September 14, 2020

• Artificial Intelligence: Governance and Ethics [Video]

  ARTIFICIAL INTELLIGENCE |  By James Maguire,
  September 13, 2020

• IBM Watson At The US Open: Showcasing The Power Of A Mature Enterprise-Class AI

  FEATURE |  By Rob Enderle,
  September 11, 2020

• Artificial Intelligence: Perception vs. Reality

  FEATURE |  By James Maguire,
  September 09, 2020