You have all your e-mail and Web-filtering software in place, and you carefully monitor message logs for signs of abuse. But little do you know that for months, a disgruntled employee has been instant messaging company secrets to a friend who works for one of your competitors. And hes been using commonly available utilities to disguise sensitive files as MP3s, which he shares openly using peer-to-peer file-sharing services. The explosion of instant messaging and P2P file-sharing applications in the workplace is a new security challenge. Employees can easily download such applications for free, often without IT detection. The threat from such applications amounts to much more than simply lost productivity and wasted time.
Divulging company secrets is only one of the serious threats posed by IM and P2P applications. Both provide new entry points to your network for intrusions, data theft, denial-of-service attacks, viruses, and worms. In fact, security vendor Symantec reported in one of its biannual Internet Security Threat Reports that the number of attacks over IM and P2P systems quadrupled from January to June 2003. Both applications are adept at bypassing firewalls using port-scanning and tunneling techniques. And none of the popular IM clients offers strong authentication or encryption, so they are vulnerable to account hijacking and eavesdropping for valuable or damaging company information divulged by unwitting employees.
Then there are the bandwidth issues. Since each P2P node is acting as both a client and a server, your precious network bandwidth may be devoured not only by your internal P2P and IM users but also by P2P users all over the planet downloading songs from your users shared directories.