Instant messaging poses a security risk?

  • Thread starter Thread starter Russell DeMarco
  • Start date Start date
R

Russell DeMarco

Does AOL or MSN instant messaging pose a security risk on our network?
We've noticed several users have installed them.
 
Russell said:
Does AOL or MSN instant messaging pose a security risk on our network?
Click to expand...

In general its certainly possible. Whether it poses a security risk for your
network in particular is really up to you.

If you keep tight controls over what comes into or goes out of your network
then uncontrolled instant messaging is a way around that and should be
viewed as a problem.

If you really don't care what your users do with the computer on their desk
as long as their work rolls up on schedule then its probably less of a
problem.

At the very least, users should probably be reminded not to use uncontrolled
IM clients to discuss business and certainly not to transfer files.

--
--
Rob Moir, Microsoft MVP for servers & security
Website - http://www.robertmoir.co.uk
Virtual PC 2004 FAQ - http://www.robertmoir.co.uk/win/VirtualPC2004FAQ.html

Kazaa - Software update services for your Viruses and Spyware.
 
In general its certainly possible. Whether it poses a security risk for your
network in particular is really up to you.

If you keep tight controls over what comes into or goes out of your network
then uncontrolled instant messaging is a way around that and should be
viewed as a problem.

If you really don't care what your users do with the computer on their desk
as long as their work rolls up on schedule then its probably less of a
problem.

At the very least, users should probably be reminded not to use uncontrolled
IM clients to discuss business and certainly not to transfer files.
Click to expand...


I guess part of my question is whether it opens anything up in our network
ports or router/firewall (bear with me, I'm an accountant) to "outsiders"?
Also, does it introduce add'l virus risks (if files are NOT being
transferred)?

Thanks again.
 
Russell DeMarco wrote:

I guess part of my question is whether it opens anything up in our
network ports or router/firewall (bear with me, I'm an accountant) to
"outsiders"?
Click to expand...

Not while instant messaging is not taking place. When someone is actually
using IM then the dangers depend on the specific system they use - some IM
programs are better than others and some activites are better than others.
Also, does it introduce add'l virus risks (if files are
NOT being transferred)?
Click to expand...

Well yes, because of two reasons

Users might well click "accept" on any file transfer they see - there have
been worms (a subset of viruses) that work this way in IM. I know you were
asking for risks besides file x-fers, but I'm considering that some clients
make it very easy to accept files by mistake, or even automatically without
the user being asked, so this can be going on and be a risk even when your
users are not doing it intentionally.

The instant messenger program is one more thing running on each system that
may or may not have bugs in it that may or may not have security issues that
may or may not be exploited to introduce a virus onto a system. And
depending on the program involved there may be some skill in setting it up
securely in the first place, and you can't guarantee an end user will know
how to do that.

As we're talking about unmanaged instant messenger stuff then you are
relying on each individual user to track the security needs of their
favourate program and to keep it up-to-date with all security patches,
properly set up, etc etc.

You can talk all day about how big a risk this is exactly as a practical
matter, I'd hate to put a number on it, but there is no doubt that a
computer with an IM program running is at more risk than one without.

--
--
Rob Moir, Microsoft MVP for servers & security
Website - http://www.robertmoir.co.uk
Virtual PC 2004 FAQ - http://www.robertmoir.co.uk/win/VirtualPC2004FAQ.html

Kazaa - Software update services for your Viruses and Spyware.
 
Thank you, you've been extremely helpful.

Russ


Robert Moir said:
Russell DeMarco wrote:



Not while instant messaging is not taking place. When someone is actually
using IM then the dangers depend on the specific system they use - some IM
programs are better than others and some activites are better than others.


Well yes, because of two reasons

Users might well click "accept" on any file transfer they see - there have
been worms (a subset of viruses) that work this way in IM. I know you were
asking for risks besides file x-fers, but I'm considering that some clients
make it very easy to accept files by mistake, or even automatically without
the user being asked, so this can be going on and be a risk even when your
users are not doing it intentionally.

The instant messenger program is one more thing running on each system that
may or may not have bugs in it that may or may not have security issues that
may or may not be exploited to introduce a virus onto a system. And
depending on the program involved there may be some skill in setting it up
securely in the first place, and you can't guarantee an end user will know
how to do that.

As we're talking about unmanaged instant messenger stuff then you are
relying on each individual user to track the security needs of their
favourate program and to keep it up-to-date with all security patches,
properly set up, etc etc.

You can talk all day about how big a risk this is exactly as a practical
matter, I'd hate to put a number on it, but there is no doubt that a
computer with an IM program running is at more risk than one without.

--
--
Rob Moir, Microsoft MVP for servers & security
Website - http://www.robertmoir.co.uk
Virtual PC 2004 FAQ - http://www.robertmoir.co.uk/win/VirtualPC2004FAQ.html

Kazaa - Software update services for your Viruses and Spyware.
Click to expand...
 
Back
Top