Slashdot Mirror
Enterprise IM?
Jsf72672 asks: "With the recently-passed Sarbanes-Oxley legislation, and the looming HIPAA compliance requirements a constant thorn in the side of IT staff, Enterprise Instant Messaging seems to be overlooked. Most users are using AIM or MSN. Microsoft and Yahoo! both have products tailored to the Enterprise, but no one wants to rely their technology to keep them out of jail, or from paying huge fines. Jabber looks attractive but our already overtaxed IT staff does not have the time to compile, secure and test homegrown solutions. What are Slashdot-reading IT Managers doing? I found these guys and their InterIM line of products, and they look pretty good. Is anyone using them? Are there other low-cost solutions you have employed?"
I'm trying to figure this out myself.
The questioner doesn't have time to check out Jabber (a ``homegrown'' solution in his words) but seems to be willing to use a commercial product with presumably little or no testing.
WTF?
Perhaps I've been reading too many issues of Cryptogram, but it seems that its a crapshoot when a company advocates 'security'. For every product like PGP security, there seems to be a horde of products that are on par with ROT13 or XOR encryption.
Guess what - you need to test and analyze that commercial solution as well. What sort of encryption does it use? Where does it store logs? Are the logs encrypted? What happens if there is no global server? What happens when the network is faulty?
**Grumble** **Grumble**
Look at Jabber, its a good protocol. It does support SSL-connections. Some of the clients support encrypted logs. Its cross platform. Its extendable. It supports local servers. What more do you need?
If your company is going to be depending on an IM system, you better know how it works, how it scales, and what to do when it goes wrong.