Instant messaging (IM) certainly has become a popular way to reach someone in a hurry. It lets us stay in touch with relatives near and far and permits us to conduct business no matter what our physical location. We can use IM to transfer files, have audio and video conversations, and to collaborate using tools, such as shared whiteboarding.

Cambridge, Mass.-based industry research group IDC expects that the number of IM users online will grow to more than 506 million by 2006. But with all the convenience and helpful tools that IM brings, it also holds some great security risks that need to be addressed regardless of whether you use IM at home or at the office. Home IM users should be concerned about three key security risks.

First, depending upon what firewall technology you might be using (and you are using a firewall, aren't you?), starting an IM session can leave ports open on your system that can then be used as attack points for hackers or as easy entry points for spyware. Check with your firewall vendor to be sure they protect your system while you use IM. If it doesn't, switch firewalls if you must use IM.

Second, information that you type into an IM session is not protected as it traverses the Internet. The data you send and receive is not encrypted, so it can be easily read by third parties. Unless you install and use a tool that specifically encrypts IM messages (and we'll discuss some of these in a minute), don't send any information across an IM session that is sensitive, such as your credit card number or the secret ingredients for your world-class barbecue sauce.

Third, IM sessions can be used to send and receive files in a peer-to-peer manner. This is a great convenience if you want to share information with others. However, it also provides an entry point for viruses. Check the virus software that you already use on your home systems (and you are using antivirus software, aren't you?) to see if it supports IM file transfers. If it does not, install and use a product that specifically protects data transferred by IM sessions. And never, ever accept IM file transfers from people you do not know.

Business headaches

IM also presents a huge headache for businesses. Instant messaging is becoming an integral part of business today and is routinely used as a part of workflow automation and end-user collaboration. This trend will likely continue and expand; many industry groups feel certain that instant messaging (once it is secured and can store messages persistently) will eventually replace e-mail.

Like home users, businesses need to be concerned with securing instant messaging. The same three things I identified earlier--port considerations, encryption, and antivirus technologies--are must-haves for businesses to secure instant messaging.

However, businesses also have two other security-related concerns that pertain to IM. First, employees can easily communicate sensitive company data (such as intellectual property) over an IM session to competitors. In addition, employees may spend too much time in IM sessions, thereby reducing their productivity at work. Employers need to implement an IM policy as part of their overall security plans and lets employees know that they will be monitored and their content will be screened and saved for scheduled auditing.

IM protected

So, how do you protect yourself at home if you want to IM and how do you protect your business from IM security risks? The technology available for securing IM is still rather limited at this stage, though I expect that the number of tools and services will expand greatly in the next six months.

If you're at home, you'll want to protect your system ports, encrypt IM data, and use antivirus technologies that support IM. If you're at work, you'll also want to do these things, but add tools that can authenticate users and monitor usage and content based on corporate policy.

Akonix L7 Gateway blocks public IM sessions and manages corporate IM sessions according to policy. It can integrate with CheckPoint Technologies Firewall and run pattern detection on content and screen for language.

Asynchrony's Envoke lets corporate administrators implement user-authenticated sessions using either an Envoke database, LDAP, or an NT Domain. Once authenticated, users can hold encrypted IM sessions with others and transfer files securely. Envoke can also bridge with other IM tools, such as Lotus Sametime.

Home users will definitely want to check out BitDefender's BitDefender for Instant Messaging, given its low cost (free). BitDefender provides antivirus capabilities for instant-messaging clients, such as MSN Messenger, Yahoo Messenger, and mIRC.

Central Command's Vexira Antivirus is another tool that you can use to protect IM file transfer operations. Vexira is available for Windows 95/98/Me/NT/2000/XP ($49.95) and for Linux ($29.95).

The Communicator Hub IM service is a strong option for businesses to consider. It supports identify management and controlled access to data and applications. Hub IM can integrate with corporate directories and it offers good auditing capabilities. Corporate users can also use Hub IM's Forums feature to carry out electronic meetings and store online discussions for later retrieval or continued operation.

CypherGuard currently offers two instant messaging security tools. One, CG MSN, encrypts and secures file transfers for those using MSN Messenger ($14.95). The other, CG Win, provides a standalone IM client that includes beefy encryption and works over public IM networks. CG Win costs $24.95.

Endeavor's Magi Secure IM secures users and can link to corporate directories. It provides encryption and can integrate with various antivirus tools to secure file transfers.

Another IM antivirus technology to consider is FaceTime IM, which blends McAfee antivirus technologies into its business IM offerings. The company supports IM auditing and IM integration into corporate applications in a secure manner.

Omnipod also offers a secure IM service for businesses. The offering is located in secured AT&T data centers and it supports secure IM sessions and file transfers while also offering management capabilities so that businesses can enforce an IM security policy.

Securing IM

The market for IM security tools is still in its infancy as I indicated earlier. These are just some of the available options and others will surely follow. IM appears here to stay and its capabilities will only grow. Have you secured your instant messaging yet?