Enterprise Strategy Group Getting to the bigger truth. By Bill Lundell, Senior Research Analyst and John McKnight, VP Research and Analysts

Transcription

1 Enterprise Strategy Group Getting to the bigger truth. By Bill Lundell, Senior Research Analyst and John McKnight, VP Research and Analysts March 2015

2 4 Cloud Computing: Not a Question of If, but Rather How Extensively 7 Password Management Pain Points 10 Cloud Power Users Lead the Way to Password Management Best Practices 17 The Bigger Truth All trademark names are property of their respective companies. Information contained in this publication has been obtained by sources The Enterprise Strategy Group (ESG) considers to be reliable but is not warranted by ESG. This publication may contain opinions of ESG, which are subject to change from time to time. This publication is copyrighted by The Enterprise Strategy Group, Inc. Any reproduction or redistribution of this publication, in whole or in part, whether in hard-copy format, electronically, or otherwise to persons not authorized to receive it, without the express consent of The Enterprise Strategy Group, Inc., is in violation of U.S. copyright law and will be subject to an action for civil damages and, if applicable, criminal prosecution. Should you have any questions, please contact ESG Client Relations at This ESG ebook was commissioned by LogMeIn and is distributed under license from ESG.

3 To gather data for this report, LogMeIn commissioned the Enterprise Strategy Group (ESG) to conduct a comprehensive online survey of both IT decision makers and corporate knowledge workers from private- and public-sector organizations in the United States, Canada, the United Kingdom, Ireland, Australia, and New Zealand between October 24, 2014 and November 11, To qualify for this survey, respondents were required to be either: IT or business professionals personally involved with their organization s evaluation and purchasing process for information technology (IT) products and services, as well as familiar with or responsible for the day-to-day management of their organization s IT environment. Corporate knowledge workers, which ESG defines as employees whose primary work activities include working with, creating, using, and distributing information, and who can perform these job tasks regardless of location. The goal of the survey was to get insight into cloud and mobile computing trends at organizations of all sizes including small (10 to 99 employees), midmarket (100 to 999), and enterprise (1,000 or more employees) from the perspective of those tasked with providing the solutions to support and enable these initiatives, as well as those that ultimately leverage the technology to do their jobs. One of the topics included password management and the effect that cloud computing has had on this task, which is ultimately the focus of this paper. All respondents were provided an incentive to complete the survey in the form of cash awards and/or cash equivalents. After filtering out unqualified respondents, removing duplicate responses, and screening the remaining completed responses (on a number of criteria) for data integrity, we were left with a final total sample of 331 IT and business professionals with insight into or responsibility for the purchase and management of IT products and services, as well as 188 corporate knowledge workers. COMPANY SIZE REGION 100% 80% 60% 40% 12%, 1,000 or more employees 52%, 100 to 999 employees 100% 80% 60% 40% Australia/New 19%, Australia/New Zealand UK/Ireland 20%, UK/Ireland 20% 36%, 10 to 99 employees 20% North 61%, America North America 0% 0% INDUSTRY Information 15%, Information Technology Technology Business 13%, Business Services Services (accounting, (accounting, consulting, consulting, legal, etc.) legal, etc.) 8%, Construction/Engineering Financial 7%, Financial (banking, (banking, securities, securities, insurance) insurance) Other 17%, Other Manufacturing 15%, Manufacturing 15%, Manufacturing Retail/Wholesale 11%, 11%, Retail/Wholesale Retail/Wholesale Education 8%, 8%, Education Education Health 6%, Health Care Care 3

4 The cloud computing deployment model is predicated upon companies ability to instantaneously deploy and, just as importantly, decommission applications and/or computing resources and pay only for what they actually consume, affording such key benefits as reduced IT infrastructure costs and faster resource provisioning. Whether this trend is the result of more disciplined IT spending habits borne out of the economic turbulence of 2008 and 2009, or merely the perceived increase in maturity of cloud computing, one thing is clear: Organizations using these services are enjoying key benefits such as reduced IT infrastructure costs and faster resource provisioning, and are looking for ways to further leverage the cloud. From an end-user (i.e., employee) perspective, the increasingly common mantra of anytime, anywhere, from any device is yet another driver of more widespread cloud adoption and usage since these services are inextricably linked with mobile initiatives due to the fact that mobility requirements demand cloud application usage and cloud application usage begets mobility. 4

5 When ESG asked 331 IT decision makers about the importance of using cloud-based business applications and IT services to their employees ability to perform their primary job functions productively and efficiently, more than one-third (34%) indicated that these services are critical. Not surprisingly, cloud power users are more likely to view cloud-based applications as critical for enabling productive and efficient employees. Specifically, more than half (52%) of those organizations that have offloaded at least five applications/workloads to the cloud consider these services critical compared with only 24% of those with only one cloud-based application. In terms of the proportion of total applications that run in the cloud, the majority of organizations report running no more than 30% of their total application footprint in the cloud, though over the next 36 months, more than half will exceed that threshold (see Figure 1). FIGURE 1 Approximately what percentage of your organization s business applications and IT services are cloud-based today? How do you see this changing over the next three years? (Percent of respondents, N=331) Percent of business applications and IT services that are cloud-based today Percent of business applications and IT services that will be cloud-based 36 months from now 25% 20% 15% 10% 5% 16% 8% 21% 21% 18% 13% 11% 15% 13% 20% 5% 10% 12% 17% 0% Less than 10% 10% to 20% 21% to 30% 31% to 40% 41% to 50% More than 50% Don t know 5

6 However, getting to the cloud has always involved turbulence in the form of security and data availability concerns. In fact, Figure 2 reveals that even among organizations that have undertaken the initial leap of faith and procured at least one cloud-based application, security remains the most widely held concern with more than one-third (38%) of these respondents reporting that security concerns are holding them back from more pervasive usage of these services. This is consistent with cloud computing research previously conducted by ESG. FIGURE 2 In general, which of the following factors if any would you say are preventing your organization from using cloud computing services more pervasively? (Percent of respondents, N=331, multiple responses accepted) Security concerns 38% Performance concerns Budget constraints Network bandwidth costs 24% 26% 26% Too much invested in current IT infrastructure and staff Difficult to ensure a consistent user experience Difficult to enforce company policies across different cloud-based apps and users Feels like IT staff would be giving up too much control Difficult to monitor and manage employee usage Nothing is preventing us from using cloud services more pervasively 18% 18% 17% 16% 15% 16% 6

7 While cloud computing is a relatively new challenge, password management has been one of the banes of IT s existence for quite some time. As proof of this burden, IT decision makers cite password management as one of their top user and application management challenges. This is not surprising given that these respondents report that the average number of password reset requests from a typical employee is nine over the course of a 12 month period, and more than half (55%) of these respondents also say that they believe password management is having a negative impact on employee productivity (see Figure 3). Corporate knowledge workers corroborate this suspicion, with nearly half (47%) indicating that all of the tasks related to password management (i.e., remembering, resetting, etc.) are a drain on their personal productivity. 7

8 FIGURE 3 Do you believe that the need to remember and manage (i.e., set, retrieve, change) multiple passwords for different applications has a negative impact on your employees productivity? (Percent of respondents) Yes 55%, Yes No 41%, No Don t 4%, Don t know know Yes 47%, Yes No 46%, No Don t 7%, Don t know know Perhaps providing additional insight into the struggles IT departments have when it comes to managing their employees passwords involves looking at the strategies or lack thereof for storing and sharing them. As seen in Figure 4, IT relies on rudimentary techniques for storing and sharing passwords, including compiling and maintaining spreadsheets and/or hard-copy lists, as well as relying on memory. FIGURE 4 How does IT currently store and share passwords for all employee applications? Percent of respondents, N=257, multiple responses accepted) Maintain a spreadsheet 47% Rely on memory Other form of electronic storage on PC or mobile device 32% 31% Write them down on a piece of paper 27% 8

9 The increasing use of cloud services only serves to exacerbate these issues, which is illustrated by the fact that organizations with five or more cloud-based applications are three times likelier to include password management among their top user and application management challenges relative to those with only one cloud-based application (see Figure 5). Furthermore, nearly twothirds (63%) of organizations with five or more cloud-based applications identify password management as a productivity drain compared with only 45% of those with only one cloud-based application. It s clear that these problems will only intensify as organizations become more cloudreliant and, as such, IT organizations must adopt password management models that can scale at a cloud rate. FIGURE 5 What are your organization s biggest challenges with respect to managing its users and applications? (Percent of respondents, multiple responses accepted) Password management (i.e., setting and resetting passwords, etc.) 10% 26% 37% 5 or more cloud apps 2 to 4 cloud apps 1 cloud app Respondents report that the average number of password reset requests from a typical employee is nine over the course of a 12 month period. 9

10 In addition to less than effective password management approaches, only 46% of respondents report that their organizations have formal IT policies and processes to help with password creation and rotation; 31% rely on built-in application prompts; and 22% leave password management up to individual employees (the latter is especially true among younger and smaller companies). However, when companies are more cloud-centric, they tend to have taken more steps toward formal IT policies and processes (see Figure 6). Given that these organizations are much more likely to already be experiencing password-related problems, it makes sense that they are at the forefront of realizing that IT must seize control of this situation with policies and process, especially as cloud usage increases. 10

11 FIGURE 6 Existing policies around password creation and rotation for employees, by number of cloud-based applications. (Percent of respondents) IT has formal policies and processes to prompt users with password creation and changes 45% 43% 51% Individual employees are on their own to establish and change passwords We rely on built-in application prompts to direct users to create and change passwords 20% 21% 25% 29% 34% 31% 5 or more cloud apps 2-4 cloud apps 1 cloud app **** of corporate knowledge workers maintain a small rotation of passwords repeatedly. 11

12 As is typically the case, however, having policies in place does not ensure employee compliance. This is no different when it comes to passwords, as shown by the fact that more than half (55%) of corporate knowledge workers maintain a small rotation of passwords repeatedly, in some cases relying on a single password for all of their business applications (see Figure 7). In addition to the fact that individuals are unreliable, relying on built-in application reminders that prompt employees to create and update passwords has its own shortcomings since password strength and complexity often vary from vendor to vendor. This demonstrates a need to complement password management policies and processes with purpose-built tools that can help to monitor and, when necessary, enforce compliance. FIGURE 7 What is your strategy for managing the passwords for all of the various business applications you use to perform your job? (Percent of respondents, N=188) One 15%, password One password for all for applications all applications Small 40%, number Small number of passwords of passwords used repeatedly used repeatedly Unique 36%, Unique password password for every for application every application Use 6%, password Use password manager manager technology technology Other 2%, Other 12

13 The fact that more than half (57%) of organizations report that at least one of their cloud-based applications contains sensitive, regulated, or company-confidential data may provide some insight as to why more concentrated cloud usage begets more concentrated password management focus. Along those lines, it follows that the vast majority of respondents say that IT insight into employees passwords for cloud-based applications is critical or important, and perhaps more telling is the fact that organizations with five or more cloud applications are more than twice as likely as those with one to deem this level of awareness as critical (see Figure 8). FIGURE 8 Importance of IT insight into and/or control of employee passwords for cloud-based applications, by number of cloud-based applications. (Percent of respondents) Critical Important Somewhat important Not important 5 or more cloud apps 45% 46% 8% 1% 2 to 4 cloud apps 24% 55% 18% 3% 1 cloud app 20% 43% 28% 9% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% 13

14 Accordingly, these more cloud-dependent organizations are also significantly more likely to be using a wide variety of password management tools and activities across the board (see Figure 9). Among organizations with at least five cloud-based applications, more than half use tools that enforce password changes after a certain amount of time (57%), implement rules about the length and complexity of passwords (53%), and enable centralized monitoring and auditing capabilities (51%). Other commonly relied upon activities include providing single sign-on for employees, as well as the ability to create and terminate employee accounts from a central access point. FIGURE 9 Password management activities organizations leverage for their cloud-based applications and/or services, by number of cloud-based applications. (Percent of respondents, multiple responses accepted) 5 or more cloud apps 2 to 4 cloud apps 1 cloud app Enforce some type of rule around mandatory password changes after a certain length of time 13% 34% 57% Enforce some type of rules around the length and characters used for passwords 23% 38% 53% Monitor and audit user accounts from a central tool and/or location 19% 36% 51% Providing single sign-on capabilities so that employees gain access to cloud-based applications without having to log into each one independently 19% 29% 49% Creating a user account for employees from a central tool and/or location 19% 36% 43% Terminate user accounts from a central tool and/or location 23% 19% 40% We do not have any insight into and/or control of our employees cloud-based application(s) passwords 2% 3% 10% 14

15 Identity access and management (IAM) is a framework for business processes that facilitates the management of electronic identities in order to ensure that access privileges are granted according to one interpretation of policy and all individuals and services are properly authenticated, authorized, and audited. Cloud application vendors are increasingly including IAM as a part of their offerings as the concept of cloud-based IAM services grows in popularity due to the potential for simplified employee access management capabilities at a global scale. Further reinforcing the idea that cloud computing power users serve as the bellwether for best practices when it comes to supporting these services, more than half of organizations with at least five cloud-based applications expressed significant interest in cloud-based IAM. The most commonly cited potential benefits and usage drivers include streamlined identity management tasks, better usage insight across all cloud-based applications, and easier provisioning (see Figure 10). use tools that enforce password changes after a certain amount of time. 15

16 FIGURE 10 Potential benefits of cloud-based IAM, by number of cloud applications in use (Percent of respondents) Streamlines identity management tasks i.e., policies and changes can be made at the user identity level and those changes will flow through all of users cloud application privileges 16% 29% 52% Better insight into usage trends across all cloud-based applications 18% 35% 36% Easily provision or revoke user access to cloudbased applications from a single management console as opposed to many 21% 32% 40% 5 or more cloud apps More consistent implementation of company policies across cloud-based applications 29% 24% 36% 2 to 4 cloud apps Enables single sign-on for users across multiple cloud-based applications 27% 32% 23% 1 cloud app More accurate accounting of active users and associated cloud application license costs 19% 29% 26% Delivered as a service (i.e., service provider is responsible for hosting and managing identity management software and infrastructure) 10% 28% 24% 15

17 Cloud computing is not the latest IT fad, but rather a sustainable technology deployment alternative that allows organizations to offload some or most of the management responsibilities associated with business applications and workloads as a way to cut costs, simplify IT processes, and increase scalability, among other potential benefits. ESG s research confirms not only that the usage of these services is pervasive, but also that organizations plan to increase the applications and workloads that they offload to the cloud. Yet in spite of the widespread acceptance of cloud computing, and regardless of an organization s position on the cloud computing adoption curve, security remains as the most common factor slowing or in some cases, outright preventing the consumption of these services. This issue will serve as a bigger impediment as organizations ponder the decision to move applications containing sensitive data to offsite, third-party resources. Among the security considerations contributing to this apprehension is undoubtedly password management, a problem that plagued IT long before cloud computing became mainstream. Not surprisingly, this task has been further complicated by the usage of cloud computing services as evidenced by the fact that organizations with more cloud-based applications are more likely to cite various password management challenges, though this has also prompted them to take steps to implement or improve the measures they take to support these processes. However, in order for IT staffs to keep pace with the adoption and usage of cloud computing services, they will require solutions that can scale accordingly. As such, the future of password management will likely have strong ties to cloud-resident identity and access management technologies, with cloud power users at the forefront of this movement. Enterprise Strategy Group is an integrated IT research, analysis, and strategy firm that is world renowned for providing actionable insight and intelligence to the global IT community. All Rights Reserved. contact@esg-global.com 17 P