Page 873 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

Instant messaging (IM) is a mechanism that allows for real-time text-
based chat between two users located anywhere on the internet. Some

IM utilities allow for file transfer, multimedia, voice and
videoconferencing, and more. Some forms of IM are based on a peer-
to-peer service while others use a centralized controlling server. Peer-
to-peer-based IM is easy for end users to deploy and use, but it’s
difficult to manage from a corporate perspective because it’s generally
insecure. It has numerous vulnerabilities: It’s susceptible to packet
sniffing, it lacks true native security capabilities, and it provides no

protection for privacy.

Many forms of traditional instant messaging lack common security
features, such as encryption or user privacy. Many stand-alone IM
clients have been susceptible to malicious code deposit or infection
through their file transfer capabilities. Also, IM users are often subject
to numerous forms of social-engineering attacks, such as
impersonation or convincing a victim to reveal information that

should remain confidential (such as passwords).

There are several modern instant messaging solutions to consider for
both person-to-person interactions and collaboration and
communications among a group. Some are public services, such as
Twitter, Facebook Messenger, and Snapchat. Others are designed for
private or internal use, such as Slack, Google Hangouts, Cisco Spark,

Workplace by Facebook, and Skype. Most of these messaging services
are designed with security as a key feature, often employing
multifactor authentication and transmission encryption.