Instant messaging strategies: Usage policy and training are key

Some people still believe that unified communications begins and ends with Voice over IP. But instant messaging is just as critical, if not more so. And establishing an instant messaging strategy is essential. Otherwise everyone in an enterprise will use consumer technology.

Instant messaging (IM) is essential to unified communications, but enterprises have not yet adopted the technology broadly. If a company is not ready to form a broader unified communications strategy, it should at least create an IM strategy, with usage policies that can help protect a company from the risks associated with employee adoption of consumer IM products.

David Mario Smith, senior research analyst with Gartner Inc., estimates that 35% to 40% of organizations currently use enterprise-class instant messaging products, such as IBM Sametime and Microsoft Office Communications Server (OCS). He said that percentage isn't higher because IM still has a stigma attached to it – a stigma that is a legacy of its consumer cousins, such as Yahoo and AOL.

"Security is the main thing," Smith said. "That is the one thing that those consumer services represent. They are unmanaged and in the cloud. There are virus vulnerabilities that can come in through those clients into the enterprise. I've seen companies -- even those that have enterprise IM systems such as IBM Sametime -- get viruses from having federated connectivity to public IM services."

Consumer IM services represent a high risk to enterprises. They can serve as a conduit for malicious attacks on a network. Sensitive corporate data can pass over these services without any corporate controls, posing a compliance risk for companies in highly regulated industries.

In fact, most experts recommend that enterprises reduce or eliminate the use of consumer-class IM within the enterprise and build an IM strategy that is based on an enterprise-class IM product.

"Our strong recommendation is to go with an enterprise system," Smith said. "You can use [consumer] tools in a complementary fashion through federation for communication with business partners. But you should make sure those connections with those external partners are trusted. I would recommend an internal IM system behind the firewall, and only use public IM services when you can protect that communication."

Bill Pray, an analyst with Burton Group, said enterprises should always use an enterprise-class IM product because the risk associated with consumer IM is simply too high to tolerate.

IM usage policies and procedures should be the first step in an IM strategy so that IT can reduce or eliminate the use of consumer services by employees, Pray said. Unfortunately, enterprises have not embraced IM broadly, he said. Because of this, they often lack policies and procedures, and employees start using consumer IM products on the job, for business and personal use.

"It's an interesting situation because consumer IM is so easy to access and bring into an environment," he said. "The best way to deal with consumer use is to start with a policy. The policy should be to use business-supplied tools, and you handle it as an HR issue when something comes up. If you're a more sensitive industry like finance, you might want to adopt more technology for locking down desktops and blocking it out entirely with firewalls. Even if you were able to lock out consumer IM, employees are still using social networking sites, they're using their cell phones to Twitter. So while enterprises can't lock down everything in IM, by putting policy and practices in place, they can limit their risk. But it all comes down to behavior. If people choose to violate policy, you have to deal with that at a human level."

Consumer IM services continue to plague the enterprise, despite the risks associated with their use. Firewall vendor Palo Alto Networks recently published its "Application Usage and Risk Report (PDF-registration required), which looked at network activity inside 60 large enterprises across more than seven vertical industries, including financial services, manufacturing, healthcare and government. According to the report, the following applications were detected on at least 75% of those networks: Gmail-chat, Yahoo-webmessenger and AIM-express. Yahoo-IM and AIM showed up at least 50% of the time.

Because consumer IM is so readily available, companies should be building an IM strategy, if not a broader unified communications strategy, Pray said. Turning a blind eye to the technology and potential employee use of consumer products just won't work.

Unfortunately, he said, many companies are ignoring IM altogether because they don't see the value of the technology.

"They understand the value in the sense that it's real-time communications, but it's not as compelling to them because they have email that is near real-time," Pray said. "So they say, 'Why do I need to add IM? It is text-based and I have email, which is also text-based.' There's just not enough incentive to push them over to the notion that they really need to have this technology, especially when they look at their budgets and the expense of implementing it with some hidden costs that come with it, such as compliance."

Pray said that some of these companies may be right when they say enterprise IM just doesn't have enough value for them, but when an enterprise looks at the broader picture of unified communications and collaboration, that story changes.

The business value of IM becomes more apparent when it is integrated into voice, video, email and other communications streams, so that users can elevate communication from a chat session to a voice call or video call with the click of a mouse, Pray said. When this occurs, the speed with which employees can make critical business decisions and resolve customer issues become obvious.

"IM is a feature of UC," he said. "Now it becomes a launching point for different methods of communication. When IM is a part of UC, then you see the value beyond the consumer application. IM becomes multichannel."

Pray pointed out that IM is now a core component of the products from three of the leading unified communications vendors on the market: Cisco Systems, IBM (Sametime) and Microsoft (Office Communications Server).

In addition to policy and vendor selection, an IM strategy should also consider how the user will derive value from the technology. Not all employees will automatically use the technology to its full potential.

"That's probably the biggest challenge, educating and training employees how to use these tools," said Vanessa Alvarez, industry analyst with Frost & Sullivan. "UC is more about using four or more [communications] tools at the same time. That's what UC is. It's not IM. It's not video. It's not Web conferencing. It's all these things being used together."

She said many people use IM on the job for quick and simple tasks, like asking a co-worker if he can take a call or whether he has the phone number of a business contact.

"That's a consumer-ish use," Alvarez said. "But the true benefit of IM is as a presence engine, where someone can launch a call or a Web conference from a chat. Those things are still not done. When you see Cisco and Avaya do a demo [at VoiceCon] where they bring all these different applications together and go from a chat over to a Web conference to a video conference and end up with a desktop sharing session. That's not really happening yet."

Alvarez said that the tools are available for accomplishing this new form of communications agility. But end users are just not completely ready for it.

"I think part of that is that vendors really need to start helping organizations learn how to use these tools effectively," she said. "They need to help organizations train their employees to use these tools together."

Let us know what you think about the story; email: Shamus McGillicuddy, News Editor

Dig Deeper on Unified Messaging