THREAT MONITOR
How to block IM applications in the enterprise
Mike Chapple
10.05.2005
Rating: -4.60- (out of 5)
|
Instant Messaging (IM) applications are a staple of modern communication. If you're not using AIM, Yahoo! Messenger or a similar tool, chances are your child, spouse or neighbor is an avid user. While these tools are great for providing us with "always on" access to colleagues and friends, they pose a significant challenge to enterprise security. Many of these applications are used as a vector for spreading malware and phishing scams. Let's look at several strategies you can use to block IM traffic in your organization.
The simplest action you can take to limit IM traffic is to block the associated ports at the firewall. Unfortunately, that's not sufficient to completely block these applications. Developers realized many organizations are blocking IM and have created workarounds that allow applications to bypass filters by tunneling traffic through commonly used ports (e.g. port 80).
However, IM developers aren't the only ones who can be clever! Firewall administrators have developed two techniques to further stymie IM traffic.
All of the techniques we've looked at so far attempt to block network traffic. Now we'll look at an alternative approach. This method prevents users from installing IM applications in the first place. There are a variety of third-party applications you can use to do this,
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
such as Microsoft's Software Restriction Policies. The following is the step-by-step procedure for using Software Restriction Policies:
[IMAGE] When users try to execute the blocked program, they'll receive the following error message:
[IMAGE] Of course, there's a catch! You'll need to do this for every version of IM software released by all of the major providers – AIM, Yahoo!, MSN and ICQ. That's certainly not a simple task!
As you may have realized by now, blocking IM applications is not an easy task -- there are flaws with each of the techniques you can use to limit this type of traffic. If you're serious about blocking IM traffic on your network, combine these techniques with strong desktop management policies and you'll have the best chance of keeping your network free of IM activity.
About the Author
Mike Chapple, CISSP is an IT Security Professional with the University of Notre Dame. He previously served as an information security researcher with the National Security Agency and the U.S. Air Force. Mike is a frequent contributor to SearchSecurity, a technical editor for Information Security magazine and the author of several information security titles including the CISSP Prep Guide and Information Security Illuminated.
|
|
Rate this Tip
|
To rate tips, you must be a member of SearchSecurity.com.
Register now
to start rating these tips. Log in if you are already a member.
|
DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
|
|
|
|
|
|
|
