IM INSTANT MESSAGING SECURITY
1 Introduction 1 11 Purpose and Audience 1 12 What to Expect from This Book 2 13 What Is IM? 2 131 IM and Its History 3 132 IM as an Integrated Communications Platform 6 133 Common IM Application Approaches 7 134 Who Uses IM? 7 135 What Are the Advantages of Using IM? 11 136 What Are the Risks of Using IM? 15 14 Summary 27 15 Endnotes 27 2 How Does IM Work? 31 21 High-Level View of IM 31 211 The Presence Service 32 212 The Instant Messaging Service 38 22 Basic IM Features 40 23 Enterprise Instant Messaging Considerations 42 231 Operating System 42 232 Database 43 233 Directory Services 43 234 Interoperability 43 235 Schema Change Requirements 43 236 Standards Based for Third-Party Support 44 237 Compliance Management 44 238 Remote Access 44 239 Cost Considerations 44 24 An Enterprise EIM Nightmare Scenario 45 25 An Overview of Mobile and Wireless Instant Messaging 46 251 What Is Mobile Instant Messaging? 46 252 What Is Wireless Instant Messaging? 47 253 Short Message Service 47 254 Wireless Application Protocol 47 255 General Packet Radio Service 48 256 The Future of WIM 48 257 The Future of MIM 49 26 Selecting and Securing a WIM Solution 49 27 Summary 51 28 Endnotes 52 3 IM Standards and Protocols 53 31 Extensible Messaging and Presence Protocol—RFC 2778 53 311 Jabber and the IM Community 57 32 Jabber Protocol and XMPP 58 321 Architectural Design 59 33 Instant Messaging/Presence Protocol—RFC 2779 65 34 Session Initiation Protocol 66 341 SIP Security 68 342 Existing Security Features in the SIP Protocol 69 343 Signaling Authentication Using HTTP Digest Authentication 69 344 S/MIME Usage within SIP 69 345 Confidentiality of Media Data in SIP 70 346 TLS Usage within SIP 70 347 IPsec Usage within SIP 71 348 Security Enhancements for SIP 71 349 SIP Authenticated Identity Body 71 3410 SIP Authenticated Identity Management 71 3411 SIP Security Agreement 72 3412 SIP End-to-Middle, Middle-to-Middle, Middle-to-End Security 73 3413 SIP Security Issues 73 35 SIP for IM and Presence Leveraging Extensions 75 Contents 36 The Future of IM Standards 76 37 Endnotes 78 4 IM Malware 81 41 Overview 81 411 Instant Messaging Opens New Security Holes 83 412 Legal Risk and Unregulated Instant Messaging 85 42 The Use of IM as Malware 86 43 What Is Malware? 87 431 Viruses 88 432 Worms 88 433 Wabbits 88 434 Trojan Horses 89 435 Spyware 90 436 Browser Hijackers 90 437 Blended Threats 91 438 Backdoors 91 439 Exploits 93 4310 Rootkits 93 44 How Is IM Used as Malware? 95 441 As a Carrier 96 442 As a Staging Center 99 443 As a Vehicle for General Hacking 100 444 As a Spy 104 445 As a Zombie Machine 107 446 As an Anonymizer 109 45 Summary 111 46 Endnotes 111 5 IM Security for Enterprise and Home 113 51 How Can IM Be Used Safely in Corporate Settings? 116 511 Understanding IM and Corporate Firewalls 116 512 Understanding IM File Transfers and Corporate Firewalls 119 513 Blocking and Proxying Instant Messaging 120 514 IM Detection Tools 122 52 Legal Risk and Corporate Governance 122 521 Legal Issues with Monitoring IM Traffic 124 53 Corporate IM Security Best Practices 124 531 Start from the Firewall 125 532 Consider the Desktop 125 533 Install Patches to IM Software ASAP 126 534 Enforce Client-Side IM Settings 126 535 IM Proxy Gateways 126 536 VPNs 127 537 Antivirus 128 538 Set up Containment Wards 128 539 Secure Information with Encryption 129 5310 IM System Rules, Policies, and Procedures 130 5311 Monitor to Ensure IM Client Policy Compliance 131 54 Security Risks and Solutions for Specific Public IM Clients 132 541 MSN Messenger 132 542 Yahoo! Messenger 137 543 America Online Instant Messaging 145 544 ICQ 153 545 Beware of IM Third-Party Clients and Services 156 55 Home IM Security Best Practices 158 56 Summary 161 57 Endnotes 161 6 IM Security Risk Management 165 61 IM Is a Form of E-mail 165 62 IM Security and the Law 166 63 Cybersecurity and the Law 169 631 The 1996 National Information Infrastructure Protection Act 170 632 President’s Executive Order on Critical Infrastructure Protection 170 633 The USA Patriot Act of 2001 171 634 The Homeland Security Act of 2002 175 64 IM Must Be Managed as a Business Record 188 65 IM Risk Management 189 66 Summary 191 67 Endnotes 191 7 The Business Value of IM 195 71 Ubiquitous Presence and Workflow 195 72 It’s All about Culture 200 73 Overall ROI for IM 202 74 The Choice Is Yours 204 75 Endnotes 205 8 The Future of IM 207 81 The Pervasive Network 209 82 Peer-to-Peer Instant Messaging 211 83 Peer-to-Application (the Human-Computer Interface) 211 84 Machine-to-Machine (Application-to-Application) 212 85 Jabber 214 86 Security and Government Compliance 215 87 The Business Impact 217 88 Endnotes 218