CIBECS / IDG Connect DATA LOSS SURVEY. The latest statistics and trends around user data protection for business.

Transcription

1 CIBECS / IDG Connect 2014 DATA LOSS SURVEY The latest statistics and trends around user data protection for business. REPORT

2 2 Table of ontents EXECUTIVE SUMMARY WHO PARTICIPATED IN THE SURVEY? INCREASING MOBILITY & THE GROWTH OF BYOD 01 Putting the Endpoint First 02 BYOD: Bring Your Own Device BUSINESS DATA IN THE CLOUD 01 Trends in Virtualisation DATA MIGRATION BUSINESS DATA LOSS & HOW COMPANIES ARE PROTECTING THEIR DATA 01 Who is Responsible for Ensuring Data is Protected? RATE YOUR ENDPOINT DATA PROTECTION

3 3 The Changing Landscape of Business Data Protection Executive Summary Data protection for business saw a significant amount of change in 2013; increased adoption of cloud backup, demand for hybrid solutions, the huge impact of IT consumerization and growing amounts of data and user generated content has meant business data protection is not only more challenging for IT, it has become an increasingly strategic requirement with more severe consequences if not effectively addressed. } While cloud & hybrid models seemingly offer businesses more flexibility, the costs and complications associated with moving all your user data into the cloud mean that this model is most appealing to SMB s with low-risk data profiles. Using cloud as part of your Disaster Recovery strategy, with on-premise, centrally managed endpoint backup to a central server and incorporating server backup to the cloud, provides companies with the most secure, cost-effective and operationally reliable business data protection. As we move away from centralized IT, businesses have reduced control over their data and how this data is shared, accessed and protected. Defining points of exposure and level of risk is a challenging task. How do businesses protect critical data in a BYOD world? Our survey uncovered the reality of BYOD which is that user s most often create data on their primary device, and then use their other devices to access and share this content. This means that protecting your primary endpoint device data is paramount for business IT. It s vital that the original files are automatically and securely backed up and easy to recover. The influence of business units on IT is greater than ever before, and growing. Users have become drivers for adoption of new technologies, and want fast and easy access to their business files across multiple devices. IT Departments need to source controlled and agile solutions that cater to the fastpaced changes and evolving security risks facing their network. As users play a more significant role in IT decisionmaking and driving demand for effective & secure endpoint data management, sharing and protection, it s also easier to quantify the impact of data loss on your organization to decision makers and board members. Protecting data correctly and effectively is a paramount business continuity imperative. Not only do organizations with ineffective data protection strategies face the immediate costs and productivity impact of data loss, they leave themselves vulnerable to data theft, unauthorized access to confidential files and are liable for legal penalties and consequences due to failed corporate governance compliance.

4 DATA LOSS SURVEY Your data is the lifeblood of your organization. The was run across over 100 companies globally, and uncovers the developments and challenges around business data management and endpoint data protection. The survey is hosted annually by Cibecs, industry leaders in endpoint data protection, who have partnered with IDG Connect in releasing the findings. We believe every business should be aware of the value of their data and the evolving circumstances every business faces when it comes to data protection and management. Says Ilze Dewing, Finance and Business Development Director at Cibecs. The survey and its outcomes is intended to provide the IT industry with an informed benchmark of what every business should take into account regarding the significance of their business data and how they choose to protect it. {This White Paper analyses the current state of business data protection and looks at the benchmark practices around how business IT protects and manages endpoint user data.}

5 5 01 Who Participated in the Survey? The Cibecs participants mostly consist of IT management and IT staff, with over 37% working in IT management roles. Over half of respondents are in a managerial position. The participants of the are mostly employed by companies with over 500 employees, 55% of respondents work for enterprise organizations of over 500 users. In total, over 100 organizations were represented.

6 6 01 WHAT IS YOUR ROLE WITHIN YOUR ORGANIZATION? HR MANAGEMENT 0% 37.6% IT MANAGEMENT 26.7% EXECUTIVE MANAGEMENT 29.7% IT STAFF OTHER FINANCE 4% 2% HOW MANY PEOPLE DOES YOUR COMPANY EMPLOY? Over 10, to 10, to to 500 Less than % 15.8% 19.8% 26.7% 28.7%

7 7 02 Increasing Mobility & the Growth of BYOD Every year the number of respondents using laptops as their primary work device has seen significant growth. This year, 80% of those surveyed stated that they use a laptop as their primary work device. Increasing user mobility: Number of participants using laptops vs. desktops as their primary work device 100% 90% 80% LAPTOPS 70% 60% 50% 40% 20% DESKTOPS A growing number of mobile users means increased vulnerability to data loss. Companies have less centralized control over data protection, and threats to data security increase significantly. Increased mobile workers can also mean increased data costs and more complicated endpoint data protection requirements. With the growth in use of laptops as primary devices, we have also seen an increase in the number of users who use tablets in the workplace. However, the majority of users employ their tablets to consume data reading s, presenting data or for web browsing. 6% of respondents use a tablet or smartphone to create and edit content, with the vast majority at 62% only consuming information on these devices. 32% of our survey participants stated that they do both. None of our respondents are using a tablet as their primary work device. The discrepancy between users creating vs. consuming business data on tablets and smartphones, and what this means for data protection requirements is significant. These business files are generally created on the primary work device, and then accessed on tablets or smartphones. This makes automatic and centrally controlled data backup on the primary endpoint device the most vital imperative for IT.

8 8 02 Putting the Endpoint first With growing user and data mobility we have seen an IT mindset change from server data protection to an outside, inwards approach looking at endpoint devices as the start of an organizations data protection strategy. In their report on endpoint user data backup (ID #: G ), Gartner highlights the issue of endpoint user data security as one of the major problems faced by IT today. This research shows that 60-80% of business data resides on user desktops and notebooks. While many companies employ policies expecting users to perform manual backups of their files to a central server, this has been proven both ineffective and costly. Organizations that fail to effectively protect the business data on user laptops have an exceptionally high risk of data loss, data theft, data corruption and unauthorized access- especially if policies are not centrally controlled and data backups are not automated. User data backup that ensures mobile users are automatically protected, and that data can be quickly & easily recovered if lost is paramount to an effective business data protection strategy. What approximate percentage of employees in your organisation use the following devices: What percentage of employees in your organization use a desktop PC? What percentage of employees in your organization use a laptop? What percentage of employees in your organization use a tablet? What percentage of employees in your organization use an Apple Computer? 72% 49% 23% 28% 26% 22% 19% 19% 24% 13% 14% 13% 0-10% 10-25% 25-50% 50-75% % 0-10% 10-25% 25-50% 50-75% % 24% 16% 7% 4% 0-10% 10-25% 25-50% 50-75% % 12% 7% 3% 7% 0-10% 10-25% 25-50% 50-75% %

9 9 02 BYOD: Bring Your Own Device Bring-Your-Own-Device has become a commonplace business IT challenge as companies need to cater for a large number of users, including C-level execs, who want to access and other company data on the device of their choice. BYOD has had an obvious impact on the responsibilities of IT. The unstoppable consumerization of IT, and allowing the use of personal devices to access company resources has resulted in the necessity for improved data control and security. It also creates the necessity for providing controlled, secure & trackable solutions to user needs. If companies don t provide a centralized alternative, they risk leakage of corporate data onto unsecured networks. BYOD hardware generates and stores increasingly large volumes of data, making it easy for users to share, store and access business files. This increases risk of access to confidential data. However, with the majority of respondents using these devices to share and access, instead of to create business files, the primary work device should be the focus for effective endpoint backup and protection. Nearly 50% of our survey participants say their company allows for Bring-Your-Own-Device, with an additional 13% saying they are planning to allow BYOD. Given that mobile devices are more prone to being lost and left in public places, BYOD is a significant challenge and vital consideration for business IT. DOES YOUR COMPANY ALLOW BYOD? DO YOU USE YOUR TABLET OR SMARTPHONE TO CONSUME OR CREATE CONTENT 50% YES 37% NO 13% We re planning to 70% 60% 50% 40% 30% 20% 10% 6% 60.2% 32.5% 1.2% I create and edit documents I consume information such as documents, s and articles I do both Other

10 10 03 Business Data in the Cloud Cloud backup is an increasingly popular data protection solution for business. Often businesses move their non-critical functions or data into the cloud first to test the environment and their appetite for cloud. They might then begin to migrate more business critical data. Storing data in the cloud still comes with security concerns for participants, with 51% stating that their biggest concern regarding storing data in the cloud is unauthorized access to user files. 24% of participants stated that their biggest concern around cloud data backup is increased bandwidth costs. Only 12% of respondents report they have no concerns regarding cloud backup. One of the biggest and growing data backup trends is the requirement for the integration of on-premise backup to a central server, with a cloud-based Disaster Recovery solution. This prevents inflated costs & operational complications associated with data recovery from the cloud, and ensures that recovering user data is fast, secure & easy for IT. This hybrid model ensures company data in the cloud and information on the onsite physical appliance are constantly replicated and synched so companies can rapidly recover onsite or from the cloud whenever the need arises. Moving business data into the cloud however presents businesses with associated bandwidth requirements and the related costs. 24% of survey respondents listed this is their biggest concern regarding storing their data in the cloud. What is your greatest concern regarding data in the cloud? 51 % Data security and unauthorized access to user files While many companies are adopting pure cloud storage and cloud backup to reduce costs and scale quickly, they often fail to consider how this model will impact recovery performance. One of the biggest underlying problems associated with pure cloud storage and cloud backup ( pure meaning the sole use of the cloud without any on-premise mechanisms) is the performance and latency. With pure cloud storage and cloud backup, it could take weeks or months for a company to access their data if a disaster strikes. This means user downtime and massive opportunity costs. Local backups of critical customer data, servers and systems are performed much faster than backups to the cloud, as are restore times. By pairing an on-premise backup appliance with a cloud-based disaster recovery solution, companies will always have the opportunity to see and manage a copy of their critical assets % 24 % 12.5 % 1% The associated difficulties around users storing business data in personal cloud services such as Dropbox Bandwidth consumption and increased bandwidth costs We have no concerns Other

11 11 03 Trends in Virtualization Virtualization showed slow adoption trends in our 2014 survey, with most companies stating they don t have any employees on virtual desktops. Increased mobile users has made uptake more complicated as there is an increasing requirement for solutions that cater to a mobile workforce. The majority of our respondents don t have any employees on a Virtual Desktop, with over 61% stating that none of the employees in their company use a VD, and less than 20% stating that more than 25% of their employees use a Virtual Desktop. Only 15% of respondents would consider virtualization for all of their users. Which of your users would you consider for Virtualization? Are you currently using Desktop Virtualization? If so, what percentage of your employees are on a VD? 61.5% None Only desktop users Everyone excluding roaming users and executives All of our users Other 35.4% 30.2% 15.6% 15.6% 3.1% None Of Our Employees Use A Virtual Desktop NONE 22.9% 10% - 25% 6.3% 4.2% 3.1% 1% 1% 25% - 35% 35% - 50% 50% - 65% 65% - 80% 80+%

12 12 04 Data Migration Employing an automated and centrally managed endpoint data protection solution provides businesses with simplified, and faster data migration. With centrally set backup policies, allowing IT to easily select what data to automatically backup to a central server, migrating users to a new machine or operating system is vastly simpler and less resource intensive. Effective data backup solutions allow IT to simply restore user files to their original location on a new machine or OS, this removes the risk of lost files and greatly reduces migration time. The impact on user productivity and user downtime was the most significant concern around data migration. Data loss was the second most prevalent concern for migration projects. WHICH OF THE FOLLOWING IS YOUR BIGGEST CONCERN REGARDING DATA MIGRATION? 27.4% User data loss 62.1% Impact on user productivity & user downtime 7.4% Inflated bandwidth and storage costs caused by the migration & backup of unessential user data 3.2% Other

13 13 04 SIMPLIFIED AND SECURE USER DATA MIGRATION WITH CIBECS } Reduce Data Migration Risks IT can easily locate and backup critical data stored in non-standard locations on laptops and desktops, reducing the risk of not migrating all business critical data Data can be restored on new hardware in the original location- saving time and avoiding increased IT support requests and interrupted productivity Overcome incompatibilities between operating systems when migrating shortcuts such as My Documents and the user s Desktop PST backup optimization ensures that Microsoft Outlook archived stored on user computers is easily migrated PREVENT USER DOWNTIME DURING DATA MIGRATION PROJECTS Business data on laptops & desktops is automatically backed up and available for recovery, simplifying the refresh process Simplified data recovery to new computers reduces time required by technical resources MINIMIZE IMPACT ON INFRASTRUCTURE DURING MIGRATION Central control over backup policies prevents unnecessary bandwidth and storage wastage caused by the migration and backup of unessential user data Data is compressed, preventing inflated operational costs and lowering impact on the network by reducing bandwidth usage CORPORATE GOVERNANCE AND REPORTING User data is encrypted, aiding with corporate governance compliance and ensuring confidentiality of business data during migration Centralized reporting provides an audit trail of the migration process

14 14 Data Loss & How Companies are 05Business Protecting their Data Half of all participants state that someone in their company has lost data in the last 12 months without being able to recover it. This percentage has not improved from the previous year, illustrating that companies are still failing to effectively protect their endpoint data. 50% of participants have user-managed data protection, instructing user s to either backup manually to a file server or to an external hard drive. IT departments know, users don t follow policies. They forget, don t know how or just don t bother. Data protection needs to be centrally managed and automated to be effective and secure. Only 17% of respondents claim to have an automated backup solution for desktops and notebooks in place. Of the consequences to business data loss, user downtime is the most concerning consequence to participants. 25% state that company reputational damage is their biggest concern, with 14% fearing financial catastrophe as a result of unprotected business data. Data loss results in user downtime as IT struggles to recover the lost files. Often, these files can t be recovered and users have to recreate these documents. What is the most concerning consequence to data loss in your company? What is your company s current end user data protection policy? 4.5% Severe Legal Penalties 4.5% 6.7% 9% 41.6% 6.7% Disciplinary action and possibly dismissal 13.5% Financial catastrophe 24.7% Reputational damage 21.3% 16.9% 31.5% User downtime and the associated opportunity costs Company policy instructing users to copy files to a file server Company policy instructing users to backup to an external hard drive An automated backup solution for desktops and notebooks User folders are redirected to a server A cloud backup solution None 0% Jail time 18% All of the above 1.1% Other

15 15 05 Who is responsible for ensuring data is protected? Over 70% of respondents state that in their business it is the responsibility of the Head of IT to ensure data is effectively protected. Effective data protection should be a management concern due to the severe consequences and knock on operational impact of lost business files. The operational benefits of employing endpoint data backup software mean tangible ROI - reduced bandwidth and storage costs, improved IT service delivery, simplified data migration projects and There are further compliance requirements around business data protection, 18% of participants stated that one of the most important considerations when selecting a data protection solution is finding a solution that assists with Corporate Governance Compliance. Organizations need to understand what legislation is relevant to them and the industry within which they operate, and then get expert advice to ensure compliance. It is critical for organizations to take a bold step away from generalized and vague approaches to Governance, Risk and Compliance. Financial Penalties, Legal Action and Incarceration. User laptops may contain data that isn t perceived as a risk to the company if lost. What we do not realize is that data such as addresses, phone numbers, personal information, company strategy, staff details and any legal documentation is exceptionally valuable and can create huge reputational damage if lost. Businesses are going to very soon face serious penalties if they don t carefully consider the risks of ineffective data security these penalties include fines or even jail time, particularly if the company is found guilty of gross negligence through knowingly employing an ineffective data protection strategy.

16 16 05 LEGISLATION HOLDS THE BOARD RESPONSIBLE FOR DATA SECURITY } Legislation around the world from the US, UK, EMEA and other regions is being aligned to guarantee the protection of critical information and hold company board members responsible for doing so. Notable legislation includes SOX and HIPAA in the USA and the incoming Protection of Personal Information Bill (PPI) in South Africa. Who is responsible for data protection in your organization? What do you consider to be the most important consideration when selecting a data protection solution? 74.2% Head of IT (CIO, IT Manager or Head of IT) 3.4% 5.6% 10.1% 18.0% 62.9% 7.9% CEO Board members 6.7% Desktop Manager 6.7% I m not sure Head of Risk 2.2% 2.2% Simplified data migration Reduced bandwidth and storage requirements Operational Cost Savings Corporate Governance Compliance Complete business data loss protection

17 17 05 WITH CIBECS COMPLIANCE IS SIMPLIFIED} Cibecs is a built from the ground up enterprise data protection solution focused on providing tangible solutions to business data challenges. With Cibecs, Corporate Governance Compliance and Data Protection Compliance, is simple. Centrally managed, automated & secure endpoint data protection. Cibecs is a certified cryptography provider no unauthorized access to confidential files. Comprehensive reporting provides easy monitoring of your Data Protection Rating. Fast & secure data recovery. Ability to track data changes & easy data discovery. All business data is protected as defined in your backup policy and is completely secure.

18 18 2 Your Endpoint Data Protection 06Rate 5 Data Security Questions 1ARE OUR DATA BACKUPS AUTOMATED? It s vital that user data backups are automated and 3 happen without the requirement for user intervention. A centrally managed software solution allows you to decide what data is backed up, and ensures that backups happen automatically in the background. This not only prevents data loss, it gives you increased control over your infrastructure and prevents wasted storage and bandwidth. DO WE HAVE GRANULAR CONTROL OVER BACKUP POLICIES, AND CAN WE CUSTOMIZE DIFFERENT POLICIES FOR DIFFERENT USER GROUPS? Granular policy setting allows IT to select specific file types per department for backup. This means increased control over infrastructure, and improved data security. Different departments will have different requirements when it comes to selecting data for backups. As an example, your Marketing team will need photographs and other media files to be backed up to your server, where as your Finance department may not. Granular control over backup policies also means faster and easier migration, as all data can be restored to the original location on the machine. Users typically store files in different locations on their computer making locating those files for backup and recovery a lengthy and sometimes impossible process if done manually. Instead, with an automated and centrally managed solution, file types or locations such as Desktop can be centrally selected for backup. This vastly simplifies recovery & migration projects saving on operational costs and decreasing down time. 4 5 ARE WE REDUCING BANDWIDTH & STORAGE WASTAGE AND COSTS, AND OPTIMISING OUR INFRASTRUCTURE? Automated data backup products like Cibecs ensure that your data backups and storage of that data are optimized. Data is compressed before backup, and only the block-level changes of files are backed up on a daily basis. This means better performance, effective use of company infrastructure and reduced impact on your network. Effective management of data backups with central control over policies saves on infrastructure costs and ensures effective use of bandwidth and storage. CAN WE REPORT CENTRALLY ON ALL BACKUPS AND RESTORES, AND DO WE HAVE THE ABILITY TO QUICKLY ASSESS OUR OVERALL DATA PROTECTION RATING? The ability to create comprehensive reporting on data access, data changes and data restores is a vital business requirement. These reports assist with Corporate Governance Compliance and help create tangible reports on the efficacy of your data backup solution. An overall Protection Rating gives IT an easy to action single metric with which they can assess their current protection level across the entire organization. HAVE WE SELECTED A SOLUTION THAT ALLOWS US MULTIPLE OPERATIONAL BENEFITS SUCH AS FASTER AND EASIER DATA MIGRATION? Selecting a holistic data protection solution with multiple features that support optimized infrastructure and operational efficiency has huge benefits, not only for IT but for Executives looking to drive down costs and ensure Compliance. For more information on Cibecs endpoint data protection visit Visit for more information