CertiGuide to Security+  9  Chapter 2:  Communication Security (Domain 2.0; 20%)       9  2.3  The Web

2.3.2  HTTP/S 1 2.3.3.1  Vulnerabilities

Following the official Security+ Domains outline from CompTIA, we now take a brief trip, in the middle of web technologies, into Instant Messaging. While it seems to us, to be a separate category on the level of Email, Web or Directory Services, we decided it was best to stay with the official outline.

Instant messaging, or IM, is used to converse with others on the Internet in near-real-time, typically on a sentence-by-sentence basis. It is generally a direct peer-to-peer, person-to-person communication technology rather than a “conference” technology such as IRC that allows multiple people to contribute to a group discussion shared among all participants.

Additional features often provided by an instant messaging service in addition to this include: informing a user when someone in their “favorite users” or “buddy list” logs in or out, the ability to set a descriptive indicator to tell your “buddies” whether you are not to be disturbed, if you are available to take calls, etc., and transferring files in addition to text messages.

Several instant messaging standards exist, and there is limited interoperability between them. Prominent instant messaging protocols include those used by ICQ (AOL’s entry in the Instant Messaging sweepstakes) and MSN Messenger.

In the meantime, many IM vendors are backing the SIMPLE (Session Initiation protocol for Instant Messaging and Presence Leveraging Extensions) protocol, an open alternative to the proprietary protocols in primary use today. Among other things, it specifies standards for voice transmission and conferences over the net.

IM was originally a personal application, popularized by individual users around the Internet using IM to keep in close contact with friends around the world. Then corporate America realized that this technology had a use within the organization as well, increasing productivity by allowing staff to send short notifications to each other without creating yet another email message or dealing with the all-too-likely voicemail message they’d receive via phone. As a result of this shift, IM vendors have begun to put more emphasis on corporate-friendly capabilities such as conversation logging, confidential messaging, etc.

As of late 2001, it is estimated that 180 million business users currently use IM of some sort, and that in late 2003, 70% of businesses we’re using IM.¹⁹⁷

2.3.2  HTTP/S 1 2.3.3.1  Vulnerabilities