Start-Up Aims for Secure Instant Messaging

Houston-based start-up IM-Age Software last week added its name to the growing list of vendors that are offering products aimed at fostering more secure use of instant messaging software within corporate networks.

The company says its IM-Age for Desktops tool lets IT managers capture, archive, audit, and report on all IM traffic generated by public client software such as America Online's Instant Messenger and ICQ products and Microsoft's MSN Messenger.

IM-Age's tool, which users install on their desktop systems, also offers security features such as user authentication and an option that lets users encrypt both internal and external IM sessions. Prices start at $39.95 per user.

Growing Concern

Richard Stiennon, an analyst at Gartner in Stamford, Connecticut, says IM-Age's tool and others already on the market address an area of growing concern for companies: how to control the unfettered use of public chat software on corporate networks while taking advantage of its benefits.

Some companies have run into major problems because of the inherent weaknesses of public IM clients, such as their susceptibility to viruses or the ease with which outsiders can snoop on conversations, he says.

The capabilities that IM-Age's software provides can help companies get a handle on their IM use and comply with the auditing and reporting requirements mandated by regulations such as the Gramm-Leach-Bliley Act, says IM-Age Chief Executive Officer David Pulaski.

Put to the Test

For example, Calpine is using the software to store and audit IM messages in anticipation of regulatory requirements. The San Jose-based power generator has installed IM-Age's tool on 200 desktops in its energy trading group and plans to eventually roll it out to more than 3,500 users, says Stephen Webster, director of infrastructure engineering.

Calpine evaluated several products but chose IM-Age because it was compatible with all the IM applications being used within the company and was inexpensive and easy to install, Webster says.

"Just about every other vendor we looked at had either a proprietary client or proprietary middle-tier server, or it involved reconfiguring ports on the firewall," he says.

Other Alternatives

Other companies that offer products or managed services aimed at providing secure IM capabilities include WiredRed Software in San Diego, Communicator in White Plains, New York, Raytheon in Lexington, Massachusetts, and Omnipod in New York.

But while IM-Age is focusing on public IM software, proprietary client technology can offer more robust security features and is tuned better for corporate needs, says WiredRed Chief Executive Allen Drennan. For instance, he says, WiredRed's ePop Audit and Reporting Server technology lets companies group users by role and department and is interoperable with existing directory structures.

"It's also a standard internal application," says Kevin Ott, vice president of technology at Terra Nova Trading, a financial services firm in Chicago that uses ePop. "I don't have to worry about my users signing up for an external third-party application, and I don't have to worry about my traffic going over a public network."