I D C T E C H N O L O G Y S P O T L I G H T T r e n d s : Why C I Os Should Rethink E n d p o i n t D a t a P r o t e c tion in the Ag e o f

Transcription

1 I D C T E C H N O L O G Y S P O T L I G H T T r e n d s : Why C I Os Should Rethink E n d p o i n t D a t a P r o t e c tion in the Ag e o f M o bility November 2014 Adapted from Worldwide Enterprise Storage for Public and Private Cloud Forecast by Ashish Nadkarni, Laura DuBois, et al., IDC # Sponsored by Druva This IDC Technology Spotlight examines the impact of mobile devices on business IT departments, particularly how the use and implementation of mobile devices relate to data protection. The document assesses trends in data protection, specifically with respect to mobile devices, bring your own device (BYOD), and remote employees, and discusses the role that Druva's solutions play in this strategic market. Introduction For many firms, a BYOD approach to technology is an effective way to leverage employee resources for maximum impact. While desktop and notebook PCs continue to be the primary platforms for heavy computing, smartphones and tablets have transformed working lives and created efficiencies that could not have been realized prior to the widespread development and availability of consumer and enterprise mobile applications. However, BYOD is not without its shortfalls. BYOD has been a thorny issue for IT managers, particularly with the consumer smartphone boom as well as the transformation caused by tablet usage within the business. IT managers have struggled with what amount of access to allow these mobile devices. No industry standard has emerged regarding mobile device data access. Each company is left to determine its own policy regarding mobile devices and their access to company data. The resulting policies vary widely across the spectrum: zero tolerance, access only, corporate application access, and full access to proprietary company data. Data Protection for BYOD Devices Another, even greater, challenge for IT managers is data protection surrounding mobile/byod devices. Many of these devices reside outside the company's firewall, making it difficult to control what data is stored on mobile devices, who the data is shared with, and if the data is backed up/ protected. To complicate matters further, many end users turn to both IT-sanctioned and non-itsanctioned cloud file storage to work around a lack of local on-device storage, access company files, and share data with those inside and outside the business. However, enterprises and small businesses alike need to continue to look at BYOD as a viable, capex-saving option. BYOD not only meets the demand from employees to be able to use their personal mobile devices but also allows for savings for the business in terms of hardware. IT must invest in mobile enterprise management (MEM), data protection, and security solutions to ensure proper management, backup, and security of corporate data on employee-liable devices. IDC 1807

2 (M) BYOD: Key Industry Trends Managing data loss and protecting critical information are growing concerns in the modern age of business. New factors are impacting how data is stored, managed, and shared. Mobile devices (specifically as BYOD), remote/decentralized workforces, and the consumerization of technology have changed employee expectations regarding the tools needed to accomplish one's job. Employees are no longer satisfied with only the tools corporate IT gives them; now, they expect to be able to use whatever tools necessary to meet their needs and have the ability to go outside of IT to do so (e.g., EFSS, Evernote). Being able to adapt to these new factors will be fundamental for future data management and governance. Historically, data has been managed very differently. IT was based on centrally managed services, with data being managed and controlled solely by the IT administrator. These IT administrators would oversee exactly where the data was stored, with 100% of the data on company hardware. IT administrators could set up rules for where data was stored within the company datacenter or employ auto-tiering to do it. The Smartphone Phenomenon Smartphones have introduced a new way to connect to business information, and their growth for BYOD business use has been significant. In fact, IDC data shows that BYOD devices accounted for a substantial number of business-use smartphones shipped in That trend is expected to continue through 2018 (see Figure 1). BYOD started to become popular as employees wanted to be able to use their own mobile devices for both work and personal purposes. Many IT departments were caught off guard by the quick adoption of mobile devices. With BYOD, there is no standard device on which IT can establish policies and standards. F i g u r e 1 Worldwide Business-Use Smartphone Shipments by User Type, ,400 1,200 1, Source: IDC, June 2014 Consumer Employee liable Corporate liable IDC

3 Another issue for IT departments was the speed of adoption. Mobile device adoption and demand for BYOD ramped up so quickly that IT didn't realize the extent to which these devices were used for work. Initially, IT was concerned with data security and managing how people were able to use/access work data from the devices. However, other concerns arose, including that no policies were in place for backup of mobile devices, wiping of devices, and mobile access to storage. The overarching shadow over all of BYOD is that data now resides outside the company firewall. The Rise of the Mobile Workforce In addition to BYOD, mobile devices coupled with laptops have helped usher in the rise of the mobile/off-premise workforce. Remote workers are often not connecting to the company network for backup or using the VPN. The inability to use the VPN or run backups consistently can be attributed to remote workers being online for only short periods of time versus on-premise workers who are plugged into the company network for the entire workday. Remote workers then have less of an opportunity to back up/capture data in addition to offsite networks often being unsecure or having insufficient bandwidth to handle a backup stream. Also, remote workers often access their data from different networks and with different devices in contrast to employees who work from a corporate office and are interacting with the data via the company's secure LAN and company-issued laptops. The combination of BYOD and a remote workforce makes it difficult for IT to manage and control corporate data. Compliance Issues Beyond the issue of backing up or securing mobile devices, increased regulation and compliance requirements have added to the stress of IT administrators. Companies must comply with a growing number of data regulations and standards. Implementing compliance programs within a company's datacenter is difficult enough, never mind expanding them to mobile devices and offsite employees. IT departments must have the ability to quickly identify regulated data or data that's pertinent to compliance, and they must be able to collect and provide data for litigation or ediscovery in a timely manner. The sheer size of data stores being created, especially outside of a company's firewall, becomes an issue when dealing with data protection. Corporate data is doubling roughly every 14 months. However, an increasing amount of this data is created and stored on devices that corporate IT has little to no visibility into. The reliance on third-party sites for data sharing only adds to this situation. The use of personal accounts, via Dropbox and Box, to share data with both internal and external sources makes IT departments susceptible to data loss as much as the inability to back up the data or properly secure it. The use of third-party sites outside of IT's purview to send or receive data also leaves companies without a record of who the data is going to and where it is sourced from. Dependency on third-party sites introduces security risks and removes IT's visibility into and control over data. Increasing utilization of unauthorized third-party sites also leaves IT departments flat-footed when it comes to fully enforcing data governance on mobile devices when they need to. While this blind spot of data beyond the firewall may have been a headache to IT a few years ago, today such a lack of preparedness is a C-level threat, bringing increased legal and financial risk to companies in the face of rising regulatory or compliance requirements related to data and how it is handled. The Public Cloud: Enabling the Trend Toward Enterprise Mobility The move to utilize public cloud is slightly different because it is typically initiated by IT and not by an individual employee. Although data now resides outside of a company's datacenter, data can still be accessed and managed by IT, giving a level of control not available with non-it-sanctioned services IDC 3

4 In addition, the move to public cloud can bring with it the potential for companies to be more nimble and responsive in terms of their datacenter: No need for forklift upgrades: Cloud infrastructures allow companies to take advantage of the latest features and functions, minimizing the need to constantly refresh on-premise datacenter hardware or do an entire forklift upgrade to integrate new technology. Pay for only the storage/compute that is used: IT administrators no longer need to overprovision storage or plan/purchase for future use. Potentially lower total cost of ownership (TCO): By moving data to the cloud, businesses reduce their spending on datacenter hardware, as well as the power and cooling necessary to keep the datacenter healthy. Cold storage offering: Public cloud storage is very good for cold storage, offering excellent $/GB price points, yet better availability than data stored on tape if access to the data is necessary. Disaster recovery options: Data now resides in an off-premise, and hopefully physically distant, datacenter, ensuring that if a natural disaster occurs, a company's data will be protected. In addition, many public cloud disaster recovery services allow for companies to quickly fail over to data on the cloud, minimizing any interruption in service. Cloud Integration Cloud integration and utilization will be key for IT departments to successfully manage the influx of mobile devices as well as protect the data stored, shared, and created on these devices. Specifically, IDC sees a number of trends that will help define how data is managed, as it relates to mobile devices and offsite employees: Continued integration of cloud and mobile devices: Cloud integration is hardwired into most mobile devices, and employees expect to be able to use the same cloud functionality on both a personal level and a work level. The ability to efficiently and effectively integrate/manage these technologies will be key. Utilization of cloud services to improve IT efficiency: Businesses must take advantage of storage software and integrated solutions from third-party vendors. In addition, they must fully embrace the cloud for appropriate data that can be offloaded to it, while mission-critical and sensitive data stays in an on-premise datacenter. Policies driven by compliance and regulation standards: As new regulations are introduced, businesses need to develop policies to effectively handle these requirements. Data must also be easily accessible so that companies can comply with increasing ediscovery/litigation requests, regardless of whether the data is on-premise or in the cloud. In addition, the ability to customize how long data is stored is necessary because duration requirements differ depending on the regulation some regulations require longer storage periods. A new approach/solution is required to help companies meet these evolving needs. Countering the issue BYOD presents will require continuous backup of information on end-user devices, with specific focus on data encryption and loss prevention. This approach will require better corporate information governance and communication with employees. IT will need visibility into and control over corporate data across all laptops/desktops/smart devices. This strategy will allow for necessary access control and the ability to set granular policies on how data is stored, protected, and shared. To effectively implement these tasks, IT will need a central management tool that can efficiently carry out these policies across the entire business and all the associated devices IDC

5 The Need for an IT-Driven Data Governance Initiative Benefits of an IT-centric approach are twofold. By gaining access to all data across all devices, IT can properly enact data protection, ensuring data is centrally backed up, stored, and protected from loss. If an employee were to leave, the organization would not lose any data that employee may have and would be able to enact a remote wipe to remove data from the employee's devices. This approach also allows for greater corporate governance and adherence to compliance regulations. Access to all data across any device will allow for the protection and storage of data to meet corporate guidelines. In addition, the ability to collect, hold, and provide all data will be necessary to meet any ediscovery requests. The net effect of this approach will be to help increase employee productivity. By not having to circumvent IT, employees will be able to freely work on any device in any location, allowing them to be more flexible. To enact an overall IT data control policy, companies must address a number of considerations. The policy must offer greater flexibility in company-issued devices. Offering a narrow selection of devices or unpopular devices will result in employees opting to utilize their private mobile devices. If a personal device is used, and IT needs to remote wipe the data, it is necessary to focus on wiping only the company data on the device. The threat of having the entire device wiped will result in employees looking for a way to bypass IT or not using any corporate data on a personal device, potentially resulting in lower employee efficiency. To effectively implement these policies, IT will need to take advantage of new technology/services without standing up a new on-premise portion of the datacenter. New technology offers a wider range of services and solutions that can be used via IaaS, PaaS, or SaaS. These services reduce the stress on a company's datacenter and avoid the need for a company to piece together a solution. Considering Druva's insync Solution To address the increasing strain put on IT departments with mobile devices, Druva offers its insync solution. An endpoint backup technology, Druva insync addresses the need to collect and centralize data, leverages highly secure public cloud, brings real-time visibility into data for IT departments, and gives IT departments the ability to restore lost data on devices, set permissions on files, and manage access to data across geographic locations. Druva accomplishes this by offering global deduplication across all users and devices IT issued and BYOD. This global deduplication produces smaller, faster backups, which reduce bandwidth consumption and eliminate data redundancy across all users. Druva insync offers flexible backup solutions targeted at a mobile workforce. Persona Backup preserves user settings for easy migration to a new device or OS. In addition, insync is designed to efficiently use available bandwidth, allows IT to configure network settings for optimal service, and has an auto-resume feature to ensure data is transferred without the need to start over. To address file sharing, Druva offers insync Share, an IT-managed file sharing ability that allows users access to all of their data, from any device, with the ability to share internally as well as externally. The intent is to allow IT departments to manage who is accessing and sharing data as well as where and how data is accessed and shared. Data can be shared with external sources, while IT remains in control of who data is shared with. IT is then granted complete visibility into and management of data usage and sharing activities. Once IT has regained visibility into and control of the data through Druva's endpoint backup and data governance tools, companies have an increased ability to do more with the centralized storage of mobile data, such as agile response to ediscovery requests IDC 5

6 Druva's endpoint backup solution complements mobile device management (MDM) solutions, protecting the data stored on a device and enabling governance of stored data. Druva also complements leading ediscovery technology solutions that look for new data sources such as text and IM, content stored on apps, and social data on laptops and phones. Druva's solutions are designed to allow CIOs to develop an end-to-end data governance solution within their larger mobile strategy. Challenges Management and protection of companies' mobile data is a growing area of opportunity. IT professionals are actively looking for solutions to unauthorized use of third-party applications, shadow IT, and increasing creation/usage of data on mobile devices. With this new opportunity, new challenges will emerge that vendors and IT professionals must work hand in hand to solve. These challenges will include: Providing the same features/functions end users are used to: To have employees willingly switch from using personal accounts on third-party applications, IT departments need to offer an IT-approved solution that allows for the same features, functionality, and feel of popular thirdparty products currently being used. If IT offerings lack a key feature or functionality, employees will continue to use unauthorized applications and bypass IT's purview. To meet this challenge, vendors in this space must make sure they offer popular features/functions, as well as react swiftly to any innovative features that arise in the future, quickly adding that functionality to their product to avoid end-user migration back to third-party applications. Influx of competition: Mobile devices and BYOD have been at the forefront of the challenges faced by many IT departments. Vendors realize that shadow IT and mobile data management/protection are important issues. As a result, vendors from various markets and with different areas of focus are looking to provide mobile data solutions. IT professionals are now being inundated with various hardware, software, and service solutions that claim to be able to solve mobile/byod data management and protection issues. To distinguish itself from the pack, Druva must clearly market the ease of use of its solution, ability to manage/protect both mobile data and workstation data, and ability to improve a company's compliance and ediscovery status allowing IT to secure and protect all corporate data. Conclusion The use of personal devices for corporate work has become a standard and will remain so into the future. Protection and governance of data will become increasingly critical as time goes by and will only be complicated by where data resides, whether it is inside or outside a company firewall, on a corporate or personal device, or in a third-party application. IT must derive a course of action to handle existing data protection issues as well as establish best practices to tackle inevitable future innovations so as not to get caught flat-footed. By embracing new technology, both physical devices and various services, companies can become more agile and reduce their TCO over the long term. Druva offers a number of solutions that can help companies address these requirements. To the extent that Druva can address the challenges described in this paper, IDC believes the company is well positioned for success in its target market IDC

7 A B O U T T H I S P U B L I C A T I ON This publication was produced by IDC Custom Solutions. The opinion, analysis, and research results presented herein are drawn from more detailed research and analysis independently conducted and published by IDC, unless specific vendor sponsorship is noted. IDC Custom Solutions makes IDC content available in a wide range of formats for distribution by various companies. A license to distribute IDC content does not imply endorsement of or opinion about the licensee. C O P Y R I G H T A N D R E S T R I C T I O N S Any IDC information or reference to IDC that is to be used in advertising, press releases, or promotional materials requires prior written approval from IDC. For permission requests, contact the IDC Custom Solutions information line at or gms@idc.com. Translation and/or localization of this document require an additional license from IDC. For more information on IDC, visit For more information on IDC Custom Solutions, visit Global Headquarters: 5 Speen Street Framingham, MA USA P F IDC 7