Noted e-mail and IM analyst David Ferris, head of Ferris Research, says you can expect IM spamming to become widespread. Though current IM spam levels are not as high as what you'd usually see with e-mail, IM spam will get much worse; it's becoming just as easy to do and it's harder to block.

Though IM spam doesn't eat up that much bandwidth or server performance, it can cause significant trouble at your people's desktops. In the same way an email can bear a virus, IM spam also leaves your PCs open to viruses. Fortunately, however, there are a few things you can do to ward off IM spam:

Control IM use. The only way you can ever get a measure of control over IM spam is to control corporate IM use. At the very least, you should come up with a corporate policy for IMing. For starters, I'd go with four user level options:

1. No use: Don't let employees have or use IM clients.
2. Corporate use: Employees can use a corporate IM client within the corporate firewall with an internal IM server.
3. Partner use: User can use a client within the corporate intranet and extranet with your business partners, with the server hosted by either your company or a partner.
4. Unlimited user: User may use corporate IM client, and possibly other clients, to reach Internet IM users. At this level, you give up control so only users with a need to communicate to anyone on the Internet--sales or technical support, for example--should be given this level.

Many users won't like this; but let's face it, not everyone needs IM for their work. And for those who do, most only really need it to talk to people within the company. A much smaller number of people--for example, developers and managers--need to talk to partners. And then there are those few executives, sales, and technical support people who might need to talk to anyone at any time. The exact details will vary from network to network, but with the right combination of user groups, access control lists, and firewall settings, establishing IM policies shouldn't be too difficult.

After you've set your policy, tell everyone to get rid of their non-approved IM clients and then use software auditing to ensure that this happens. Don't allow multiple clients for everyone on your network. Besides IM's own special headaches, multiple software programs of any kind always lead to technology management trouble, because each additional program requires more technical support.

Block IM spam addresses. You can also try to block IM spam, but it's much more difficult because you can't "turn the volume down" by blocking addresses that are known for spamming. Even though AOL and Yahoo officials tell me--and I believe them--that they kill IM addresses used for spam as fast as they find them, scripts exist that allow IM spammers to launch new accounts and start spamming again almost as soon as their old accounts are killed.

Restrict most users to buddy lists or company directory IM access. Of course, this capability depends on the client; almost all do buddy lists, and the programs I recommend below can also be linked into a corporate directory. This will block spam at the desktop, but it won't stop spammers from getting to the network. To try to do that while allowing IMing, have your people use business-only IM names at work.

For example, one way that spammers find addresses are through public chat groups. If a business IM name never shows up in a "Steelers Rule!" or "Olympic Figure Skating" chat group, a spammer can never attack it. If your users use their business IM names only inside the business or with company partners, this will help stop IM spammers from getting their messages into your network.

Use an in-house IM system. Don't stop at managing the IM clients; make sure you manage the IM servers, too. As a result, you'll have much more control over what's becoming an increasingly important network service, and you'll also be able to supervise quality of service. To do that, you need to run your own IM services.

For corporate use, I like Jabber, because it's open source, based on the XML open standards, can use SSL, and your top users can use it to chat with MSN and Yahoo users. You can also install Jabber and then selectively let clients have outside access, but this is more difficult to implement.

I'm also becoming increasingly fond of Lotus Sametime and Novell DigitalMe. DigitalMe is a free service that you can sign up for on the Novell site. Both have top corporate support, come ready to work with directory services (Jabber requires an additional module), and your users can use it to talk to AIM users.

IM spam may not be an all-encompassing issue for you now. But it's a sure bet that it will become a problem. Address it before your CEO tells you to fix it.