Although Instant Messaging (IM) may be nearly ubiquitous in business environments today, it isn’t always the case that an enterprise made a conscious, calculated decision to deploy and utilize the tool. Often, IM penetration happens as a result of employee demand, greatly aided by the wide availability of free consumer IM tools. The problem with this approach is that it precludes IT leaders from ensuring that key business considerations are met – issues such as security, compliance, and availability. If IM capabilities are deemed valuable, now is the time for a solution that addresses these critical areas.

The Typical Approaches to IM: On or Off

In today’s work environments, where teams are commonly scattered across multiple locations, IM serves as a valuable tool for internal communications. Many enterprises elect to allow employees to utilize free external IM services, such as Windows Live Messenger and Google Talk, based on the fact they offer clear benefits in terms of real-time collaboration, at no cost. However, while external IM guidelines and corporate usage policies can be devised, the actual controls available to IT departments are minimal – which can subvert existing enterprise standards surrounding security and compliance.

To that end, legitimate security concerns – namely the threat of malware infection – and the overhead required to even begin to tackle issues such as regulatory compliance have led many organizations to ban services entirely. Banning external IM capabilities outright, via Web proxy or firewall, is a valid and necessary approach in high security environments. However, the fact remains that most organizations can, and largely do, benefit from IM capabilities, and may even consider the service indispensable.

The Case for Enterprise IM

Where IM is in fact considered a necessary service, an enterprise IM solution – one that affords greater administrative control over various facets of operation – is required. This does not necessarily mean the implementation of an on-premise corporate IM server; viable hosted enterprise IM solutions are also available. What is essential is that the solution provides greater IT oversight and control over the following areas:

• Management and security. The most visible advantages of implementing an enterprise IM solution are centralized administration and security management. For example, integration with the existing enterprise directory offers identity-based user access control as well as the ability to centrally disable specific features, such as file transfer capabilities.
• Compliance and archiving. An inability to ensure that IM adheres with specific industry compliance regulations as well as the broader e-discovery amendments made to the Federal Rules for Civil Procedure (FRCP) in late 2006 are key reasons that many have banned IM. Centralized archiving and auditing capabilities are simply not available with consumer-based IM tools.
• Uptime and availability. A primary issue with the usage of free public IM in an enterprise environment is that these services are offered to businesses and consumers alike, devoid of any type of service guarantees. While one could argue that these services have largely proven reliable, a severe outage such as that experienced by Skype in 2007 could easily disrupt operations, and indeed did for many small businesses. Deploying an internal IM server or an SLA-backed hosted IM service would entail net-new expenses, but is justified if IM is deemed critical.

Vendor IM Solutions

The enterprise IM space currently includes a number of server-based IM solutions as well as emerging hosted options, such as Cisco’s WebEx AIMPro Business Edition. With respect to on-premise solutions, platforms built on the Jabber set of open technologies have gained prominence as low cost, secure and effective alternatives to consumer IM. Leading Jabber-based enterprise solutions include Jive Software’s Openfire Server and Jabber Inc.’s XCP (recently selected as the IM platform for the US Marine Corps) and turnkey JabberNow appliance. Licensing for these products begins as low as $15 per seat.

Today, enterprise IM also falls under the larger umbrella of Unified Communications (UC) platforms, which integrate multiple communications elements, including voice, video, IM, into a single desktop client. Examples of leading UC platforms include IBM Lotus Sametime and Microsoft Office Communications Server. Per-seat licensing for these platforms begins as low as $20 to $30 per seat, but increases substantially as additional capabilities beyond basic IM, such as mobile device support and Web conferencing, are required.

Essentially, these enterprise options all address the fundamental issue with a reliance on consumer-based IM services: a lack of management control that ultimately limits IT’s ability to address key security, compliance, and availability concerns.

Recommendations

1. Examine current IM usage. Investigate whether external IM is currently being used in the organizations, including which services, by whom, and for what purpose.
2. Determine current IM risks or gaps. Essentially, for the same reasons that enterprises do not rely on consumer e-mail services, they should not rely on consumer IM.
3. Identify IM opportunities. Beyond real-time chat capabilities, the basic ability to view colleague presence and availability from within an IM client is valuable in a distributed team environment, helping to avoid “phone tag” issues.
4. Explore enterprise IM and UC solutions. Where requirements dictate, most enterprise IM solutions also offer the ability to interface with public IM networks, using standards-based specifications.
5. Investigate alternatives to securing IM. Where an enterprise IM solution is not justified, several solutions are available that can provide secure filtering and message archiving capabilities for external IM. Leading IM security vendors include Akonix, Barracuda, FaceTime, and Symantec.

Bottom Line

While IM is widely used as a collaborative tool, if its entry into the environment was entirely employee-driven, important business considerations might have been overlooked in the process. Even if informal IM usage is already sanctioned, closer investigation may reveal both unaddressed gaps and opportunities that warrant an enterprise IM solution.