Achieving Greater TCO Benefits Using a Secure Workspace Solution: Comparing TCO for Three Telework Approaches

Transcription

1 WHITE PAPER N Using a Secure : Comparing TCO for An Osterman Research White Paper Published May 2012 SPONSORED BY sponsored by SPON sponsored by Osterman Research, Inc. P.O. Box 1058 Black Diamond, Washington USA Tel: Fax: info@ostermanresearch.com twitter.com/mosterman

2 EXECUTIVE SUMMARY An increasingly common trend in commercial organizations and government agencies of all sizes is telework enabling employees and contractors to work remotely on a part-time or full-time basis. These teleworking employees and contractors need: A reliable and secure work experience when away from the corporate office and when working on their personal or home computers. The environment needs to mimic the in-office experience to the greatest extent possible in order to enhance remote workers productivity. The environment must minimize or eliminate the potential for data leaks or other inadvertent loss of data to maximize the security of the sensitive and confidential information with which employees work. Finally, the solution must be as inexpensive as possible for IT to configure, deploy and manage. KEY TAKEAWAYS Our research and calculations found that a Secure a USB device that includes a copy of the Windows operating system and a variety of customer-provisioned applications can satisfy three key requirements: 1. Use of any computing platform The Secure can duplicate the in-office experience by booting an employee s laptop or home computer from the secure USB drive, using a Windows desktop and the applications that have been provided by the organization. This allows the organization to turn an employee s unmanaged PC into a trusted workstation with full security, and with no impact to the host computer s hard drive or applications. There is nothing to install on the employee s machine. 2. High security It can prevent data leaks by preventing data from being copied to the host computer s hard drive it leaves no data footprint on the host computer. Moreover, through its use of hardware encryption, the Secure can help ensure that portable data is secured and it can prevent a data loss if the USB device is lost. 3. Low TCO The Secure offers a much lower total cost of ownership compared to Virtual Desktop Interface (VDI) solutions and company-supplied laptops. In addition, it also offers other advantages like portability, support for multi-factor authentication, built-in hardware encryption, the minimal learning curve in using the technology (no training required), and its physical durability. A Secure deployed to 75 users for six months is 14% less expensive than a VDI solution and 50% less than providing laptops to these users. For a three-year project, a Secure is 26% less than VDI and 39% less than laptops. ABOUT THIS WHITE PAPER This white paper provides a brief overview of the Secure approach to end user computing. It also provides detailed cost comparisons between VDI, conventional laptop and the Secure under different scenarios. The white paper also provides a brief overview of the Secure offered by Imation, the sponsor of this white paper Osterman Research, Inc. 1

3 ENABLING A ROBUST, OUT-OF-OFFICE COMPUTING EXPERIENCE THE FUNDAMENTAL PROBLEM Remote work is becoming increasingly important for organizations that are attempting to drive down their costs and to become more agile by enabling employees to work from any location at home, at customers sites, in remote offices, etc. Moreover, the US and other governments have become major proponents of the telework concept as a means of reducing their costs and to support various green initiatives. However, the growth of telework has been slowed by a number of factors, not least of which is the significant expense of enabling employees and others to work remotely (despite the fact that telework has been demonstrated to reduce employeerelated costs). For example, to provide a remote worker with a laptop and all of the application software he or she might require to work effectively can be very expensive when considering the cost of hardware, software, maintenance, etc. Providing users with a set of cloud-based applications or a virtual desktop environment that they can access using their own computers can be less expensive, but relies on an always-available Internet connection a resource that may not always be available, such as when a user is on an airplane or when on vacation. Moreover, these solutions suffer from some serious drawbacks, such as the potential for data breaches arising from the loss of an unencrypted physical device, the possibility that sensitive corporate data will be left behind on computers that are not owned or controlled by the employer, and employees inability to fully replicate the same computing experience as when they are in the office (e.g., using Webcams for remote meetings or making use of graphics horsepower on their PC). QUESTIONS TO CONSIDER WHEN EVALUATING YOUR OPTIONS Clearly, organizations need to address a variety of issues when evaluating options for enabling telework. Here are several important points to consider, and questions to ask, when evaluating options for enabling telework for remote employees, contractors and others: Deployability o Can custom OS images be created easily and deployed easily and efficiently? o Do third parties need to be involved in the provision of telework platforms? Manageability o Can security policies be configured on the platforms and issued to specific users? The growth of telework has been slowed by a number of factors, not least of which is the significant expense of enabling employees and others to work remotely (despite the fact that telework has been demonstrated to reduce employee-related costs). Security o Is the OS image secure from malicious users? o Are there options to protect the platform with more than a simple password? o Does the platform meet all of the security validations that are required? Compliance o Are there Data-at-Rest requirements and, if so, does the platform allow the device itself to be unlocked with a user s Common Access Card (CAC)? Usability o Are all of the features of the remote platform available to remote workers, such as videoconferencing, audio capabilities, or other features that are important to users in the normal course of their work? 2012 Osterman Research, Inc. 2

4 CONSIDER NOT GIVING KNOWLEDGE WORKERS A LAPTOP To efficiently and cost effectively enable telework, three things are necessary: A highly secure environment that will mitigate the potential for data breaches. A user experience that will emulate what IT provides when the employee is in the office. A very simple deployment that will allow the user to employ virtually any desktop or laptop, whether owned by the organization or by the employee. In short, while cloud-based, virtual desktop and laptop approaches are useful at enabling remote work, they also have significant drawbacks and exposure that organizations need to be aware of when considering cloud or VDI solutions versus secure portable workspaces. THE ADVANTAGES OF THE SECURE WORKSPACE SOLUTION Decision makers should seriously consider the alternative of providing users with a Secure a USB-based device that contains a complete Windows operating system and all of the applications that a user will need to work from any available PC. The advantages of such an approach over its alternatives are several: It has a lower Total Cost of Ownership (TCO), as demonstrated later in this white paper, because of its lower initial cost and lower lifecycle/refresh costs. It offers greater employee flexibility because it can plug into any PC, it takes full advantage of all of the features on that PC, and it is highly secure. It reduces corporate risk because the USB device is hardware encrypted, the drive s contents are strongly protected, and the USB devices include security to mitigate the risk of liabilities that can result from breaches of sensitive or confidential information. For more information about the Secure concept, please see In Search of a Better Way to Enable Telework that was published by Osterman Research in January THE TCO ADVANTAGES OF A SECURE WORKSPACE SOLUTION BACKGROUND AND METHODOLOGY This section provides TCO comparisons for three different approaches to telework for a group of temporary employees who would need to be provisioned with a telework capability. The three approaches we compared are: While cloudbased, virtual desktop and laptop approaches are useful at enabling remote work, they also have significant drawbacks and exposure that organizations need to be aware of when considering cloud or VDI solutions versus secure portable workspaces. Virtual Desktop Interface (VDI) Provision of Windows laptops Provision of a Secure To generate the data used in this white paper, we used the following approaches: To calculate the costs of the VDI approach, we used a calculator available on the VMware Web site at To calculate the costs of the laptop approach, we conducted a primary research survey with IT-focused members of the Osterman Research Survey Panel to determine their anticipated costs of provisioning and supporting the needed laptops Osterman Research, Inc. 3

5 To calculate the costs of the Secure approach, we used the list price of Imation s device along with assumptions about the amount of IT labor required to configure, deploy and manage the devices. THE DEPLOYMENT SCENARIO For purposes of this analysis, we created a scenario in which 75 temporary employees need a telework capability for a period of six months. Fully burdened costs used in this analysis are as follows: Professional services for configuration: US$250 per hour Standard IT labor for ongoing maintenance: US$38.46 per hour (US$80,000 annually) VIRTUAL DESKTOP INTERFACE For determining the cost of the VDI approach, we assumed that the system required to host the virtual desktops would be a VMware environment on a four-cpu, fourcore server, and that a total of 0.6 terabytes of storage space would be required. Using the VMware calculator noted above, we determined that the cost of the VDI infrastructure required to support these temporary workers would be as follows: Server: US$32,355 Storage: US$18,125 Networking switch: US$4,000 VMware software license and support: US$7, IT labor hours required for deployment: US$8, IT labor hours required for administration: US$9,880 Using these estimates, the total cost of the VDI approach would be $80,610, or $1,075 for each of the 75 employees. It is important to note that most of the cost of the VDI approach consists of the servers, storage and licensing that will have a much longer usable life than the six months of this project, but are a necessary investment for this approach nonetheless. LAPTOPS Our approach for determining the costs of this approach focused on primary research surveys with 53 members of the Osterman Research survey panel, as well as secondary research on the Dell Web site as noted above. The organizations surveyed have a median of 725 employees. In an online survey, we asked respondents how much they would budget for hardware, software and IT labor to deploy a laptop to temporary employees for a six-month project. Using the median responses and the secondary data from the Dell Web site, we determined that the total cost would be US$139,165, broken out as follows: To calculate the costs of the Secure approach, we used the list price of Imation s device along with assumptions about the amount of IT labor required to configure, deploy and manage the devices. The cost of each laptop computer is US$1,704 (Dell Latitude E6420, Intel Core i5, Windows 7, 8Gb RAM, 750Gb hard disk) specified on March 21, 2012 from the Dell Web site: US$127,800 Configuration and IT labor: US$2,885, or 75 IT labor hours over the six months of the project Disk encryption software: US$4,874 (e.g., SecureStar DriveCrypt) IT labor for updates, maintenance, etc.: $3,606 (1.25 hours per unit at $38.46 per hour) This translates to a per-employee cost of US$1, Osterman Research, Inc. 4

6 SECURE WORKSPACE SOLUTION For this analysis, we used list prices for the Secure components. We further assumed that the IT labor required to configure, provision and deploy the device would require 1.0 IT labor hours per batch of 36 USB devices (or fraction thereof), and that 1.25 IT labor hours of ongoing management effort over six months would be required to manage Secure devices as in the laptop scenario. We then added in the additional cost to create a golden image that would be deployed to each Secure device. Using these assumptions, the total cost of providing a Secure would be $69,631, or US$928 per employee/device. It is important to note that neither the VDI or Secure cost calculations take into account the client computing platform that would be used by the temporary employees. However, we are assuming that these employees would use their home computer or some other platform that is already available, resulting in no additional cost to the employer. COMPARING THE COSTS Our analysis demonstrated that the cost of the Secure for 75 temporary employees provisioned for a six-month period is 14% to 50% lower than for the VDI or conventional laptop, respectively, as shown in the following figure. Cost to Provision 75 Temporary Employees for Six Months Cost per Employee However, because such a large proportion of these costs are for initial infrastructure investments that will last much longer than the six-month life of a project, we also wanted to compare the three-year cost of ownership for each approach, as well. As shown in the following figure, the cost differential is also significant for the Secure approach in a longer project life scenario 26% less than for VDI and 39% less than for conventional laptops. Our analysis demonstrated that the cost of the Secure for 75 temporary employees provisioned for a six-month period is 14% to 50% lower than for the VDI or conventional laptop. The cost differential is also significant for the Secure approach in a longer project life scenario 26% less than for VDI and 39% less than for conventional laptops Osterman Research, Inc. 5

7 Cost to Provision 75 Temporary Employees for Three Years Cost per Employee per Year BACKEND CONFIGURATION AND MANAGEMENT CAPABILITIES Another important advantage of the Secure is that it permits the configuration of hundreds or thousands of Secure images and the creation of devices quickly and easily completely on-premise and without the involvement of third parties, permitting a higher level of security for sensitive content stored on the devices. Moreover, remote devices can be updated to accommodate policy changes, new password requirements and the like without having to re-image devices that have already been deployed. The creation of a new Secure device configuration is generally easier and can be accomplished more quickly than re-imaging laptops that are distributed to remote workers, providing a more scalable approach than the provision of laptops. CONSIDERING THE INTANGIBLES While the cost advantage for the Secure is substantial, it is also important to consider cost issues that are more difficult to quantify that tilt the scales even more in favor of this approach. These costs include leaving confidential or sensitive data on a host machine that might result in a data breach i, damage to a laptop, portability of the computing device, or the physical loss of a laptop. These costs can be significant, particularly if a data breach notification statute would apply, which can result in huge costs for remediation. Moreover, because the Secure is more rugged and waterproof than a laptop, they represent even more of a TCO advantage for this approach. An important advantage of the Secure is that it permits the configuration of hundreds or thousands of images and the creation of devices quickly and easily completely onpremise and without the involvement of third parties. The issue of data breaches is one that should not be taken lightly. Given that the Ponemon Institute has calculated the cost of a data breach at $194 per record ii, a breach of even a small number of records from a single user could have very expensive consequences, including: A requirement to notify affected information owners. Remediation costs, such as provision of credit report services to victims. Loss of corporate reputation. Loss of future business Osterman Research, Inc. 6

8 Using Ponemon s calculations, losing just 500 records in a single data breach could cost an organization $97,000 data breaches of many thousands of records can cost millions of dollars. SUMMARY A Secure offers a number of advantages that are summarized on the table below. Compared to provision of laptops, a Secure saves an organization the cost of hardware, parts and repairs; and the need to depreciate this hardware. Relative to VDI solutions, Stealth Zone TM provides savings in a number of areas, including the cost of the VDI software, the cost of the Microsoft Client Access License (CAL), the cost of the backend servers and their ongoing maintenance, and the cost of increased bandwidth. Moreover, Stealth Zone TM enables the productivity advantage of a user being able to employ any available computer with the assurance that sensitive data will not be left behind. The bottom line is that a Secure provides a much lower TCO than competing solutions for short-term projects, as well as for much longer-term projects; and for both small and large numbers of temporary employees. Comparison of Stealth Zone TM, Traditional Laptop/PC and VDI s Feature Central Management Software (manageability) Deployability Secure Configure security policies on the devices, and issue them to specific users; policy groups mapped to Active Directory (AD), remote kill, etc. - (AE 4.1); helps with initial provisioning of devices and password management. Other features available when using the device for storage include policy groups mapped to AD, remote kill available when the device is used for storage. Create your own custom OS images and easily copy the image onto the hundreds or thousands of devices you require Traditional Laptop/PC N/A Create custom image on laptop and distribute to employees, a potentially time-consuming process. If this is performed via the corporate network, this can result in significant bandwidth requirements. VDI s Proprietary Centralized desktop content mgmt.; stores each instance of a user's corporate computing environment on a server in a datacenter A Secure provides a much lower TCO than competing solutions for short-term projects, as well as for much longer-term projects; and for both small and large numbers of temporary employees Osterman Research, Inc. 7

9 Comparison of Stealth Zone TM, Traditional Laptop/PC and VDI s (continued) Feature Security Authentication Usability Online/ Offline Access Portability Compliance Performance Productivity Unified Management Requirements Secure AES 256 full disk encryption (apps, OS, data) Centrallymanaged policies, NIST SP800-56A channel, compatible w/leading anti-virus software, Isolation from host system Strong password; biometrics (all HW based); PKI authentication through Windows Full memory, CPU usage (no virtualization); Autoadapt with onboard drivers; no network access required; full Windows workspace, capacity GB + 250GB - 1 TB EHDD (local storage) Operational in online and offline modes Boots on 95% of systems (testing included Imation partner Microsoft s systems labs); automatic adaptation' works off-line FIPS Level 3, Certificate #1269 Full power of native Windows OS for a robust user experience User can use any machine anywhere; OS update like any other machine Manage secure storage, digital identities, and portable computing from one form factor w/cross-over storage capability Customer must have a Microsoft Software Assurance agreement; boot from USB Traditional Laptop/PC Full disk encryption optional along w/ anti-virus software; more susceptible to malware Supports most authentication options N/A Operational in online and offline modes Cumbersome to carry SecureStar w/fips certification Full power of native Windows OS for a robust user experience User must use specific machine deployed to them N/A N/A VDI s Typical SSL over the internet. Resources are located in data center so nothing locally to exploit Can be username/password. Also can implement one-time Passwords and PKI with external integrations No per-user hardware, need network access, feature reduced and slow user experience Operational in online and offline modes Compatible most systems Performance can vary based on the network demand and bandwidth availability. Can be limitations in graphic and sound processing. Requires a thin client on a local system. Virtual back-end infrastructure 2012 Osterman Research, Inc. 8

10 Comparison of Stealth Zone TM, Traditional Laptop/PC and VDI s (concluded) Feature Operating System Compatibility OS Upgrades Cost to Deploy to 75 Users for Six Months Secure Windows 7, XP, 2000, Windows 8 (when used for secure storage); or Windows 7, 8 (when used as a bootable Secure ) Updates to the OS are the responsibility of the administrator that performs all OS updates; all remote devices can be updated quickly and easily Traditional Laptop/PC Any OS Updates are typically more difficult and time-consuming VDI s Any OS Updates are relatively easy $928 per user $1,856 per user $1,075 per user ABOUT IMATION S SECURE WORKSPACE SOLUTION Imation provides enterprise and government clients with products and solutions that enable employees to securely compute! protecting their digital identities and data! wherever they travel in the world. By combining the power of strong user authentication, digital identity and data encryption, Imation provide a very high level of protection available against theft or loss of confidential information. Imation s promise to its clients is to deliver the most innovative and secure solutions for mobile computing that also offer superior functionality and manageability. The full range of high security USB flash and hard drive devices are designed to meet the highest security and privacy standards of even the most demanding clients. Easy to manage and transparent to the end user, Imation s solutions enable organizations to satisfy multiple security needs with a single device, facilitating greater mobility without compromising security. The Secure platform (formerly MXI Security s Stealth Zone TM solution) for mobile desktops provides a secure computing environment on a portable USB device. Embedded with Microsoft Windows OS and any applications the user requires, Secure -enabled USB devices allow the user to boot directly from the device and isolate computing on the secure environment of the device Osterman Research, Inc. 9

11 2012 Osterman Research, Inc. All rights reserved. No part of this document may be reproduced in any form by any means, nor may it be distributed without the permission of Osterman Research, Inc., nor may it be resold or distributed by any entity other than Osterman Research, Inc., without prior written authorization of Osterman Research, Inc. Osterman Research, Inc. does not provide legal advice. Nothing in this document constitutes legal advice, nor shall this document or any software product or other offering referenced herein serve as a substitute for the reader s compliance with any laws (including but not limited to any act, statue, regulation, rule, directive, administrative order, executive order, etc. (collectively, Laws )) referenced in this document. If necessary, the reader should consult with competent legal counsel regarding any Laws referenced herein. Osterman Research, Inc. makes no representation or warranty regarding the completeness or accuracy of the information contained in this document. THIS DOCUMENT IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND. ALL EXPRESS OR IMPLIED REPRESENTATIONS, CONDITIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE DETERMINED TO BE ILLEGAL. i ii Osterman Research, Inc. 10