CertiGuide to Security+  9  Chapter 2:  Communication Security (Domain 2.0; 20%)       9  2.3  The Web            9  2.3.3  Instant Messaging

2.3.3.2  8.3 Naming Conventions 1 2.3.3.4  Privacy

As noted earlier, a significant security issue with IM is that packet sniffing enables an attacker to view any unencrypted traffic on the network, including IM traffic. If a user within your organization is using IM to communicate with, say, a supplier or support person across the Internet, it’s possible that customer numbers, system or network passwords, and all manner of other information you’d rather see kept private, is traveling in clear text across the Internet, from your network to the other party’s.

Of course, this point of vulnerability has an up side in other situations. A Network based IDS (Intrusion Detection System) can use packet-sniffing to observe an entire network looking for previously discovered attack signatures, and take action to warn administrators and safeguard the network. As of 2003, IDS may be vulnerable to issues with IPv6²¹⁰.

2.3.3.2  8.3 Naming Conventions 1 2.3.3.4  Privacy