How VPNs interact with instant-messaging applications

VPNs allow secure, encrypted connections between an organization's private network and remote users through a third-party service provider. The goal is to extend trusted relationships across the Internet, without sacrificing security. When a company's server is accessed through a VPN, the traffic between the user's PC and the server travels over the Internet using cryptographic tunnelling protocols to provide protection and security. If your company's VPN is configured to require that all IP traffic must pass through the VPN tunnel, then, all outside connections must pass through the company's firewalls. This ensures you have the same level of protection as you do when working at the office.

If you use an instant messaging (IM) service to connect with other Internet users who are not part of your corporate network, once your message leaves your network it be will be in clear text. It's important to note that it is unlikely your IM traffic will be allowed to travel through your company's firewall, because IM's are inherently insecure and I imagine that your company's VPN and firewall policies are set to only allow acceptable traffic. Since you installed AIM yourself, I assume your organization does not allow IM traffic through its firewall. If this is the case, you are connecting directly to the Internet and not through your company's VPN. Therefore, unless you have a desktop firewall, antivirus and antispyware software on your home PC, you put yourself at risk of attack and/or infection by malicious code.

While more recent versions of AIM allow you to digitally sign and encrypt your chat and file transfers by using a personal digital certificate, free Internet IM programs generally do not, therefore, you should never assume your IM conversations are completely secure. On a final note, to be safe, I would first check with your network administrator to determine whether you are allowed to install and run programs such as AIM on a PC that is used to connect to the company network.

---

More Information

Test your knowledge of IPsec and SSL VPNs with this quiz.

Have an application security question from Michael? Submit your question here.

---