Establish an IM policy

IM at our facility is strictly forbidden and blocked by the firewall. Systems found to have Yahoo, MSN, ICQ, etc running on them are deleted. Intrusion Detection alerts us to active IM and we locate the system with it and delete it. Program downloading and installation are blocked by permissions.

While the article was interesting, it was pretty short-sighted on solutions for those who still see the benefits within a specific environment.

We set up and use our own chat server. First, we have a large environment where you want to get questions out to everyone, so it is a plus. Only those who are ready to answer questions keep their sessions open as a result. And, you can open a one on one chat if you want. Our chat area is completely self-contained behind our firewall and not accessible to the public. We don't allow users to use it for other chat (not to say that it is impossible). It allows us to gain the benefits while minimizing the risk to an acceptable level.

While the article was interesting, it was pretty short-sighted on solutions for those who still see the benefits within a specific environment.

We set up and use our own chat server. First, we have a large environment where you want to get questions out to everyone, so it is a plus. Only those who are ready to answer questions keep their sessions open as a result. And, you can open a one on one chat if you want. Our chat area is completely self-contained behind our firewall and not accessible to the public. We don't allow users to use it for other chat (not to say that it is impossible). It allows us to gain the benefits while minimizing the risk to an acceptable level.

Interestingly enough my company has a dual policy.
One for users and one for the IT departement.
1) for the users it's strictly forbidden. We scan the networkd for IM clients and bandwidth usage on specific known IM ports, and remove automatically any IM clients and installation files. (we also block with Websense the download sites) The firewall also blocks most of them but some people have figured out they could find alternate IPs and ports to use.
2) The IT Support team is quite large and divided to 4 sites, we have deployed an internal IM called Epop and authorize the use of MS Messenger for office use.

Personally from a security perspective I don't like to idea of running IM clients on administrators stations, but the practical applications of having instantanous access to one's social resources can be very valuable.

I do prefer the internal epop system which is secure and allows some mesure of security to be implemented.