Verizon IM: Good For Your Business?

Verizon Business announced today the availability of its Hosted Secure Instant Messaging, a pair of secure IM services based on Microsoft's Live Communications Server (LCS) software and Symantec's IM Manager. The services have the price point and capabilities to be both an IT dream and nightmare, depending on one's perspective.

Verizon's announcement isn't in a vacuum. Gain a context for the new IM service and see who else is offering a competing offering by clicking here.

Details and deliverable of the Verizon announcement can be found here.

What will it mean for you? Click here for the bottom-line analysis.

Complaints, comments, and kudos can be sent to yours truly via e-mail or Skype. Actually, I'm also available as NetMagDave across every major IM system.--Dave "IM Maniac" Greenfield, aka "Da" Site Editor

IM is increasingly finding traction within today's businesses. The Radicati Group estimates that there are 374 million IM users worldwide, and 54% of enterprises indicate that they use IM. While many of them rely on IM for casual intra-company communications, 12% are using IM for external communications with partners.

At the same time, IT must address the growing security threat in IM. Viruses and Spam for Instant Messaging (SPIM) are increasingly popular. In January, FaceTime Communications, an IM security and logging provider, reported that threats over IM and P2P networks increased by more than twentyfold since the start of 2005, and 2,200% over 2004. Akonix Security Center, a division of Akonix Systems, another IM security and logging provider, issued a report stating that there were roughly 2,300% more SPIM and malware-filtering updates in 2005 than in 2004 (233 in 2005 vs. eight in 2004).

Business-grade IM services from MessageLabs (formerly Omnipod), Reuters Instant Messaging, and now Verizon address this need by supplying security controls to disable file transfers and block virus attacks, as well as log messages for compliance purposes. They also supply numerous management controls that improve the use of IM, such as the ability to enforce consistent usernames and disable features for individual users.

The Hosted Secure Instant Messaging service announced today is part of an overall package of outsourced IT services from Verizon Business, the combination of MCI and Verizon Enterprise Solutions Group. Those services divide into IT Infrastructure Service, Managed Applications, and Managed IT Services. Hosted Secure Instant Messaging is part of the latter service.

The Hosted Secure Instant Messaging service consists of two offers. Those businesses that require IM among employees will choose Verizon's Enterprise Instant Messaging service. With this service, Verizon hosts Microsoft LCS 2005 and equips users with the Office Communicator client. The LCS offering authenticates users and encrypts messages. Enterprise Instant Messaging doesn't provide external IM access.

Those businesses that want external IM will choose the second option, Verizon's Managed Public Instant Messaging service. The offering allows IT to secure access to the major IM services--AOL, MSN, and Yahoo. Jabber currently isn't offered. Aside from blocking threats, IM Manager also allows IT to exercise numerous controls over the services, including blocking file transfers, filtering IMs not in conformance with corporate policy as defined by IT, and inserting customized legal disclaimers.Both IM services are managed through a common security and management infrastructure. Verizon enforces content filtering and session logging with IMlogic's IM Manager. Filters are kept current by IMlogic's security service, the IMlogic Threat Center. Virus protection is provided through Sybari Software's IM security software.

Verizon has developed it own overall Web-based management console to overlay these products. Tiered administration is possible with the console, enabling IT to assign or restrict an administrator's access rights only to his or her workgroup. Those administrators can assign, add, or delete users, assign access rights, and view usage statistics from the console.

Pricing for the Verizon IM services is based per user, with a minimum of 25 users. Enterprise IM starts at $5.95 per user per month, while Managed Public IM starts at $3.50 per user per month. By contrast, IBM's Sametime, the leading enterprise IM solution today, carries a one-time $47.59-per-user license and then charges $9.52 a year for ongoing maintenance and support. However, that doesn't include external IM access, or the additional operational costs associated with security, compliance, and ongoing management.

IM, and more specifically the presence technologies it uses, provides a valuable service that all too often is ignored or, even worse, viewed as a threat by IT. The possibility of circumventing corporate logging tools, tunneling through firewalls, providing a backdoor for attacks, and just plain annoying users with those pop-ups have contributed to the technology's bad reputation.

Such a stance, though, will become more tenuous as the workforce increasingly demands the IM and presence capabilities they can so readily get out of the office. What's more, as blue-chip vendors such as Avaya, Cisco, IBM, and Microsoft stand behind the technology and embed it within their other products, enterprises will find it increasingly difficult not to develop some sort of IM and presence strategy.

Services such as those from Verizon can do a lot to help IT introduce IM and presence while minimizing the security risk and still stay within an affordable price point. At under $6 per user, Verizon further recognizes that it needs to compete with the free public IM services, which are probably the most prevalent IM solution in businesses today.However, hosted IM services are probably better suited for small businesses lacking IT resources, or collections of companies looking for an industry-wide solution--less so for the individual midtier or large business of 500 or more users. Those companies, the target of Verizon's efforts, will find several issues with the Verizon offering that require further evaluation.

Compliance will be a major challenge. The Verizon service will institute a compliance policy, but can't plug into existing compliance engines, says Rick Dyer, director of IT solutions product management for Verizon. Companies will need to institute the operational policies to ensure that corporate requirements are defined and instituted across all IM communications.

Logs of IM conversations are also stored on Verizon's premises. IT will want to explore Verizon's processes and procedures in how it handles those logs, as instances of missing backup tapes have exposed other companies to potential lawsuits, lost revenue, and damaged reputations. Cases in point include Bank of America, Ameritrade, Time Warner, and Citigroup, which saw backup tapes lost with the account information or Social Security numbers of 5.9 million people.

Integration of IM and presence into the fabric of the business is increasingly important. Verizon scores on this front by tying its IM services into Exchange and corporate e-mail systems, but the company has to go further. As was illustrated at VoiceCon, companies will increasingly integrate their telephony and IM servers. Ultimately, there will need to be a master presence server spanning both technologies. This requires deep integration work that, though conceivable, seems unlikely to occur when the IM server is located offsite and managed by a different organization.

Such presence integration will need to also occur between IM servers in different departments, business units, and organizations in order for business partners to gain the full benefits of secure IM and presence. That's achieved by federating the IM services, something that's not offered today by Verizon, but will be available in the next few months, says Dyer.Finally, licensing issues have forced Verizon to deliver separate services for enterprise IM and for secure access to external services, yet products exist today from LCS to AIM, Yahoo, and MSN. While Verizon may be unable to include those products in its offer because of licensing restrictions, those same rules don't apply to IT. For businesses where external and internal IM access are equally important, an in-house solution may be the better approach, enabling them to roll out a single client today for both public and enterprise IM services.