Whitepaper. Simple and secure. Business requirements for Enterprise File Sync and Share solutions.

Transcription

1 Whitepaper Simple and secure Business requirements for Enterprise File Sync and Share solutions

2 Simplicity and security: business requirements for enterprise file sync and share solutions Enterprise file sync and share are important to any type of document- and file-oriented collaboration. This white paper explains why companies need secure enterprise file sync and share (EFSS) solutions, how users can work with them, and which capabilities an EFSS product should have. Last but not least, the white paper also looks at the extent to which Brainloop Dox, a new EFSS product, corresponds to user requirements. Today, enterprise file sync and share are important to any type of document- and file-oriented collaboration, both within the company and with external third parties. Office and knowledge workers almost always work with information. Although this is often available in digital format, it is unfortunately not always synchronized automatically to all user devices. Information workers have at least two of these sometimes even three or four, like a desktop, laptop, tablet, and smartphone. Analysts like Forrester believe that 29% (as of 2013) of all employees worldwide are information workers who use 3 or more different devices and need access to information at all times and in all locations. In addition, the number of mobile devices in use (smartphones, tablets, and phablets) is still increasing rapidly. According to IDC, the number of tablets sold between the 4th quarter of 2012 and the last three months of 2013 increased by 28% to 76.9 million units. With smartphones, the increase is even more marked between 2012 and 2013 sales increased by 38.4% to more than a billion units. Although this growth will level off in the next few years, the total number of mobile devices will continue to see a significant increase. This makes it even more important for workers to be able to synchronize and share their files and documents easily. To give just one example, the use of a single popular sync and share service increased by some 100 million users between November 2013 and March Similar growth rates are likely to apply to the use of these services in companies too. Up-to-date files accessible on all devices Automatic synchronization ensures that the latest version of a document is available on every device. If employees could save the 5 or 10 minutes a day they spend synchronizing documents manually with their mobile devices, their company would increase productivity for that reason alone. Automatic synchronization also ensures that the latest version of a specific document is always available on every device, providing a further considerable boost to productivity. It saves employees from needing to check whether it is the most up-to-date version and waste time tracking down the newest one if it is not. Whitepaper - File Sync and Share 2 10

3 The large demand for synchronizing, sharing and accessing documents through a mobile device is easy to explain. Employees need to be able to share these documents with internal colleagues and external business partners, suppliers and customers at any time. Without EFSS solutions, the documents would need to be sent by or FTP. Other solutions such as giving external people access to the company s networks would be much more complex to implement and have significant administration and security implications. Relatively simple principle This is what makes consumer-oriented services like Dropbox so attractive for business users despite all the security concerns. With little effort, they can send and receive files from anyone. The fact that this completely circumvents the IT department and probably flouts the company s compliance rules is of little concern to them. They do not need to set anything up or ask anyone s permission, and it is quick and easy to use. The figures speak for themselves. Last year, according to Forrester 1, 22% of information workers used cloud-based FSS services like Dropbox, SugarSync and others. And 70% of Dropbox users in the Forrester survey said they used the service for business as well as for private purposes. In principle, synchronization is nothing other than managed file storage on specific servers. The sync software ensures that the most current version of a file is available on all the user s devices. Depending on the configuration, up-to-date files can be automatically saved to a folder on each local device or accessed via a browser in a centralized folder. Users can also work on the files online or download them and work on them locally. The files are then re-synchronized so that the updated file is available on all devices. 1 Forrester report 2013 Mobile Workforce Adoption, Trends by Ted Schadler, February 4, 2013, reported in byod-is-just-getting-started-so-prepare-forrester/ 3 Devices Information workers use 3 or more different devices and need access to information at all times and in all locations. 29% Analysts like Forrester believe, that 29% of all employees worldwide are information workers. 70% of Drobox users say, that they use the service for business as well as for private purposes. 22% of information workers use cloud-based FSS services like Dropbox, SugarSync and others. Whitepaper - File Sync and Share 3 10

4 The solution needs to be able to control what each user can do with the document. Sharing documents by neither practical nor secure Employees need to share documents with colleagues, partners and suppliers and require relevant files to be available and synchronized on a range of different devices. At the same time organizations need to be able to control what each user can do with the document, including reading, copying, printing, editing, adding comments, and forwarding it to others. Within a company and behind the firewall, it is relatively easy to control access to documents and other files, whether they are stored on file servers, intranets, collaboration applications or document or enterprise content management systems. The latter, however, are not trivial they tend to be complex and very expensive backend solutions for the enterprise. To enable users mobile staff as well as partners, suppliers and customers to access documents, non-secure was and in some cases still is the only solution. This can produce several problems: Unencrypted attachments can easily be read by others Mails can go missing or end up in spam filters by mistake Sharing documents with several people quickly produces a cascade of s, after which nobody knows which version of a document or file is the most current People receiving an with an unencrypted attachment can do whatever they want with it size limitations make it impossible to share large files by Why consumer-oriented services are so popular If users install the software they can access their files from any device once they have registered for the service. Although this is problematic for companies, internet businesses, including Dropbox, Google Drive, SugarSync and hundreds of others, have already been providing a service to private users who are less concerned about security for many years. These consumer-oriented cloud services all work in a similar way with a simple registration process and no further user authentication. If the user agrees, the application is downloaded automatically and installs itself on his or her computer. Once the registration process is complete, the program installs a virtual drive that users can save files on, as with a normal drive. If users install the software on their laptop and the app on their tablet and smartphone, they can access their files from any of their devices once they have registered for the service they want. Users can save completely new files on the virtual drive as well as viewing, changing and saving existing data. Whitepaper - File Sync and Share 4 10

5 Users can provide a group of people access to the entire virtual drive or just to one to share information. Once users have provided another person with access to a document, they do not usually have any influence over what that person does with it. It can be saved locally, copied, printed, changed and forwarded. From the technical perspective, these solutions usually comprise the following components: Cloud server and storage space in the consumer version, the customer can use server functions needed to run the program but cannot change any settings Client software this is downloaded to the desktop and/or mobile devices and controls access to the documents. It is either platform-specific (Windows, Android, ios) or browserbased (HTML 5) Web client an HTML-5 in-browser application with the same functions as the desktop client. The providers of these services try with varying levels of success to ensure their solutions have a simple design to ensure any user can get to grips with it without much training. It is usually sufficient to watch a short image- or video-based tutorial in order to get started. Most of these consumer solutions are standalone products that are not integrated with other applications. Consumer services are taboo for companies Although these services are a boon to private users, companies should steer clear of them for security and compliance reasons. File sync and share services are often free of charge and are financed by advertising. They may require users to allow access to their calendar and contact information as well as to files and Wi-Fi connection details. During synchronization, many of these services do not encrypt data in transmission between the device and the cloud and do not even offer encryption of stored data as standard. Although these services are a boon to private users, companies should steer clear of them for security and compliance reasons. An important issue is that users do not usually know where their documents are stored or which country the data center(s) are located in. This implies that users cannot know which country s legislation applies to their provider and whether the national authorities in that country can demand access to the stored data (such as with the Patriot Act in the USA). A further problem is that companies and their IT departments have no way of knowing which documents a user is sharing and with whom. In regulated industries like telecommunications, healthcare and security services, this is a definite no-go area for compliance reasons alone. Whitepaper - File Sync and Share 5 10

6 The user does not usually know where documents are stored or which country the data center(s) are located in. Sync and share solutions that are suitable for companies are available as one of three main types: cloud, on-premise and hybrid. With the cloud type, the data and documents are stored in the provider s cloud and the provider also runs the corresponding server software that controls access to the files from the devices. With the on-premise variant, the sync/share and storage servers are located within the company s firewall and deliver data to users mobile devices from there. This type of service is used by companies with extremely stringent security requirements, such as those in the defense industry. With the hybrid type, the server is in the provider s cloud and controls access to data from users mobile devices. However, the files and documents themselves are stored within the company firewall. This variant ensures easy access by users mobile devices while avoiding the need to store copies of files in the cloud. Companies in regulated industries often use this type of service. The cloud variant is certainly the quickest to set up. Providers vary considerably in the encryption levels and security guarantees they offer. Companies thinking of using a cloudonly service should check the security certifications of the provider s datacenter and ask where it is located. They should also examine the provider s guarantees concerning the complete deletion of all data should the contract be terminated. Types of EFSS solutions to consider Sync and share solutions that are suitable for companies are available as one of three main types: cloud, on-premise and hybrid. With the cloud type, the data and documents are stored in the provider s cloud and the provider also runs the corresponding server software that controls access to the files from the devices. With the on-premise variant, the sync/share and storage servers are located within the company s firewall and deliver data to users mobile devices from there. This type of service is used by companies with extremely stringent security requirements, such as those in the defense industry. With the hybrid type, the server is in the provider s cloud and controls access to data from users mobile devices. However, the files and documents themselves are stored within the company firewall. This variant ensures easy access by users mobile devices while avoiding the need to store copies of files in the cloud. Companies in regulated industries often use this type of service. Whitepaper - File Sync and Share 6 10

7 The cloud option is certainly the quickest to set up. Providers vary considerably in the encryption levels and security guarantees they offer. Companies thinking of using a cloud-only service should check the security certifications of the provider s datacenter and ask where it is located. They should also examine the provider s guarantees concerning the complete deletion of all data should the contract be terminated. What professional EFSS services should offer Despite their efforts on ease of use, some products come up short when it comes to integration. If users are to avoid sending s with unencrypted attachments, the solution should be seamlessly integrated into users everyday business applications. Client software designed as a Windows client makes it much easier for users to work with the cloud storage. The same goes for integration with Outlook. An EFSS solution can be said to work seamlessly when users can invoke it easily from within their client. That ensures that nobody will be tempted to send unencrypted attachments by . Instead, they send an containing a link to encrypted content in a high-security datacenter. Some solutions provide even more security by encrypting the itself that informs recipients about a document to be shared with them. An EFSS solution works seamlessly when users can invoke it easily from within their client. Good EFSS solutions should also include the following features: Security One of the most important security features is encryption. The solution should encrypt information before it has even left the user s device not wait until it has reached the service provider s datacenter. This means encrypting it as soon as it is saved to the EFSS software s virtual drive or folder. In addition, the solution should provide adequate access control, such as two-factor authentication. It should also include a range of permission levels that govern what a user can do with a document (browser view only, open the document, modify the document etc.). There should be an administration console that tracks who has done what with which files; whether a user sent a file to someone else and if so, to whom, when and with which permissions. In short: companies should always have end-to-end information about its EFSS users. They also need administrator shielding a technical way to ensure that admins can access the application but never the data. The same goes for access by datacenter operators and service providers they should never be able to access company information. Another recommendation is for a remote wipe function. One of the most important security features is encryption. Whitepaper - File Sync and Share 7 10

8 The solution needs to ensure that users can no longer access a document once its viewing permissions have expired. The solution needs to ensure that users can no longer access a document once its viewing permissions have expired. If permissions expire because they were only available for a limited period or because the person sharing the document has canceled them, the solution must be able to remotely delete the file in users virtual drives during the next synchronization cycle or block access to it on the EFSS server. For users, it is crucial that the service provider s data center and operations are certified for security in accordance with ISO In addition, a company s local data protection laws will only be applicable if the provider s datacenter is located in the same country. That ensures that foreign secret services cannot access information stored in the datacenter at least not legally. Integration capability The EFSS solution should include standard APIs to facilitate integration with backend, content management, collaboration, ERP and Office applications. Integration options for and directory systems are also useful. Users should be able to define what each recipient is allowed to do with the document. Collaboration features Although an EFSS cannot replace a collaboration solution, it can provide a basis for teams to work on documents and other files together. For this reason, it should include a versioning capability. It should also enable users to easily select or create groups of people to share a document with. This includes allowing users to define what each recipient is allowed to do with the document, while adhering to company policies. For example, they could limit a recipient s permissions to read-only access, or give them the full range of rights. Simplicity, ease of use The EFSS solution must be easy to use while remaining very secure. If a company needs to train its entire staff to use an EFSS product, or if there is a complicated procedure to follow each time they want to use it, acceptance will remain low. At this point, users will turn to non-secure consumer solutions to the frustration of every security-sensitive manager. Platform independence EFSS solutions should operate independently of the devices they are used on. Providers should therefore make the solution available for HTML5 browser clients or HTML5 apps, or support the various platforms with native apps. Whitepaper - File Sync and Share 8 10

9 Simple, secure EFSS: Brainloop Dox Following a look at the market, the reasons why consumer FSS products are unsuitable for enterprise use, and the productindependent requirements of companies, we shall briefly describe the EFSS product Brainloop Dox. Brainloop Dox is a secure, cloudbased EFSS solution. It is operated by Brainloop in a high-security datacenter that is certified according to ISO (27001). It features an end-to-end security system that prevents the misuse and loss of business-critical company information. The solution meets the compliance requirements of companies across all industries. It is very easy to use and is seamlessly integrated in Microsoft Outlook as well as in the Windows client, where it provides a virtual drive on desktops. Mobile clients access the virtual drives or cloud-based folders available to every user via a HTML 5 browser. As soon as a user saves a file to the Brainloop Dox drive, it is encrypted immediately. The solution supports any file format. To facilitate secure and traceable collaboration, the user sends recipients an containing a link to the document. The recipients log in using two-factor authentication and can then access the document for a limited time only. If required, users can also encrypt the containing the link so that it is not legible until the user has completed the secure access procedure. Brainloop Dox enables users to: Manage files and folders locally and on the web (move, copy) Share files and folders from within the client or by using the web client Create a new version of a file simply by uploading it again Manage the links they have sent and revoke permissions if necessary. If access is revoked, the software deletes the synchronized file on the user s virtual drive or blocks access to the file in the cloud Manage the links they have received for quick access to files other people have sent them Add more security to the client using PINs Send documents and files with optional encryption of the message, details of the link s expiry date, and requirement for PIN entry prior to access Adjust security levels as required (PDF with a watermark, limit permission to opening the document, allow recipient to edit it etc.) The solution meets the compliance requirements of companies across all industries. Share files and folders easily with others. Whitepaper - File Sync and Share 9 10

10 Brainloop Dox comprises the following components: Dox Space storage space in the cloud per user license Dox Cockpit web access for administrators. This enables them to monitor who has done what with which files; whether a user sent a file to someone else and if so, to whom, when and with which permissions. Every access to data and all document changes are logged in a tamper-proof audit trail. With the Cockpit, administrators can manage the centralized cloud storage and allocate space to users. They can also make settings for all staff and manage users and licenses. Dox Web user access to the Dox Space via an HMTL5 browser Dox Client for Windows local drive synchronized with Dox Space and integrated with Microsoft Outlook. The solution requires the Windows 7 operating system and Microsoft Outlook 2007 or later as the mail client, as well as an HTML 5 enabled browser. Brainloop Dox is also available as an onpremise solution. With Dox, Brainloop provides a simple yet secure EFSS solution that meets the needs of the majority of information workers while fulfilling companies requirements for traceability and compliance. Brainloop also provides the Secure Dataroom solution for highly regulated industries and companies needing more sophisticated collaboration functions, as well as secure file synchronization and sharing. More information on Brainloop s products and services is available at Brainloop. simply secure. info@brainloop.com Copyright 2014 Brainloop WP Whitepaper - File Sync and Share 10 10