White. Paper. Evaluating Sync and Share Solutions. Balancing Security, Control, and Productivity. September, 2014

Transcription

1 White Paper Evaluating Sync and Share Solutions Balancing Security, Control, and Productivity By Terri McClure, Senior Analyst September, 2014 This ESG White Paper was commissioned by Code42 and is distributed under license from ESG.

2 White Paper: Evaluating Sync and Share Solutions 2 Contents Consumerization and the Challenges of Online File Sharing... 3 Navigating Shifting Sands in Consumerized IT... 3 User-first Evaluation of OFS... 4 Building a User-first evaluation process... 4 Getting to a User-first Perspective... 6 Analyzing OFS Options... 6 Evaluating OFS Clients... 6 Evaluating Security Requirements... 7 The Bigger Truth... 7 All trademark names are property of their respective companies. Information contained in this publication has been obtained by sources The Enterprise Strategy Group (ESG) considers to be reliable but is not warranted by ESG. This publication may contain opinions of ESG, which are subject to change from time to time. This publication is copyrighted by The Enterprise Strategy Group, Inc. Any reproduction or redistribution of this publication, in whole or in part, whether in hard-copy format, electronically, or otherwise to persons not authorized to receive it, without the express consent of The Enterprise Strategy Group, Inc., is in violation of U.S. copyright law and will be subject to an action for civil damages and, if applicable, criminal prosecution. Should you have any questions, please contact ESG Client Relations at

3 White Paper: Evaluating Sync and Share Solutions 3 Consumerization and the Challenges of Online File Sharing The applications and services used for online file sharing and collaboration (OFS) have been strongly shaped by consumerization and the widespread adoption of consumer services such as Dropbox. Now, business organizations need to carefully push back recognizing that solutions must meet corporate needs for compliance and security, while acknowledging that employee adoption is the key to success. Some IT industry professionals refer to the file sync and share market when describing applications and services for file sharing. ESG calls this market online file sharing and collaboration, or OFS. Many of the most successful OFS vendors started by selling to the consumer market, but OFS is now one of corporate IT s fastest-growing sectors, too. The same functionality that appeals to consumers an ability to enable information sharing among people and across device types is driving that rapid, continued growth within the enterprise. However, OFS solutions vary widely in terms of their ability to deliver value in a way that meets corporate needs. For example, an OFS consumer solution selected by an employee can threaten corporate data-governance goals and pose a challenge to IT s responsibility for protecting an organization s digital assets. OFS needs to be understood in the context of consumerization a factor that is driving technology changes in the enterprise. There was a time barely a generation ago when the enterprise commanded the most cutting-edge technologies. Employees might be allowed to sign out a laptop or be equipped with a pager, and a chosen few might have even been provided with a cellphone. Now, bleeding-edge technologies are more likely to reach workers via their neighborhood BestBuy or Fry s Electronics than via enterprise IT. Workers are bringing consumer technologies to the office and it s changing how everyone works and interacts. It s also spurring the development of consumer mobile apps, which shape people s habits and expectations even further. As consumers, we now have technology and Internet connectivity at our fingertips wherever we are, and we want to have it available in a similar fashion for work because it can help us be more productive any time, any place. With this reality in mind, OFS has gained momentum thanks in large part to its appeal to individuals rather than to decisions made by enterprise IT. Now, the enterprise must catch up. Navigating Shifting Sands in Consumerized IT OFS is in the wild and has been widely adopted by end-users within the enterprise. With or without the permission of employers, employees are bringing the technologies they prefer to the business environment. This force of consumerization raises issues of security that put pressure on some IT departments. For IT organizations, consumerization, the Internet, BYOD, and BYOA (bring your own applications) have meant a loss of control over the acquisition process for technology. It may not be that users are actively seeking to go around IT, but now they have that option. And if they find a way to do their job more easily using resources other than those provided by IT, they will. The performance of consumer applications (which are usually unfettered by elaborate security constraints seen in business applications), together with their typically low cost, has given people the ability to evaluate apps and choose the ones that work best. That means if a corporate solution log-in process takes too long or if user collaborators are required to utilize an FTP site if files exceed a size limit, they know where and how to find an easier way. Thus, in place of the command and control structure of the past, a new model is evolving that acknowledges endusers and their expectations. Similarly, more decisions about technology are being decentralized and are slipping into the control of divisions, departments, groups, and individuals. ESG research indicates that these non-it buyers are growing in importance. Annually, ESG surveys IT professionals about their organizations spending plans. In recent years, ESG expanded its

4 White Paper: Evaluating Sync and Share Solutions 4 annual survey to non-it department technology users, namely knowledge workers within marketing departments. In that sample demographic, 50% of respondents say they have influenced IT spending, 42% report being one among several decision makers in a buying decision, and 20% report they are the sole and final decision makers (see Figure 1). 1 What that means is non-it buyers sometimes don t even involve IT in technology decisions. Given that IT has been the traditional guardian of data governance and control, this shift has implications for the future: from now on, the growing role of the non-it buyer will be something to consider when assessing how to buy and manage business technology. Figure 1. The Growing Role of the Non-IT Buyer User-first Evaluation of OFS Source: Enterprise Strategy Group, The consumerization trend has a particular impact on OFS it is one of the markets where the shift in control is pronounced. Making a decision about what type of OFS platform to deploy in the enterprise is a delicate balancing act IT decision makers face. If you are one of those decision makers, you should carefully evaluate your security, compliance, and control requirements and the solution s ability to meet them ideally by working in partnership with the mobility and IT security teams. Building a User-first evaluation process With the baseline security and control requirements in mind, and in light of the bring-your-own-device (BYOD) and bring-your-own-app (BYOA) culture, it is more important than ever to establish a user-first evaluation process to meet the needs and preferences of non-it buyers and knowledge workers. Although many organizations have tried to discourage or prevent the use of personal consumer OFS accounts, ESG research shows that 70% of IT organizations know or suspect that users are adopting consumer OFS regardless of attempted control mechanisms. 2 In fact, of those companies with formal policies prohibiting personal file sharing accounts for business, 57% know or suspect that usage is happening anyway. And the picture is worse for those that merely discourage usage: a whopping 86% of companies know or suspect rogue usage (see Figure 2)! 3 1 Source: ESG Research Report, 2014 IT Spending Intentions Survey, February Source: ESG Research Brief, Spotting and Stopping Rogue Online File Sharing, December Ibid.

5 White Paper: Evaluating Sync and Share Solutions 5 Figure 2. Rogue Online File Sharing Source: Enterprise Strategy Group, Since it is so easy for users to go around IT and use solutions they like, the key to reining in this practice is to take a user-first approach, to ensure users are happy with IT s technology choices. Engaging users in the process is helpful for many reasons: Increases viral adoption. When users participate in evaluating and choosing a solution, they feel ownership in its success. They are more likely to act as internal champions and promote the product to peers and friends throughout the organization, helping to create a viral effect. Increases productivity. OFS solutions increase productivity by removing the friction associated with accessing, managing, and sharing documents as well as collaborative activities that involve files such as joint projects or supporting content workflows. Reduces training costs. Since ease of use is central to a user-centric approach in evaluating and choosing solutions, hard costs to provide training and soft costs associated with lost productivity during training are reduced. Speeds time to value. Each of these benefits is interrelated. By making usability a core criteria, the value of the technical investment can be realized in a relatively short time through faster adoption, resulting in increased security and control, happy users, and a process for easier, more streamlined collaboration. Reduces the risk that users will continue to employ personal solutions. This is the best benefit of all. It is important to remember the risk associated with the use of personal accounts for business data. Not only is the data outside of the control of enterprise IT, but also IT has no insight into what data might be stored within these personal accounts. And, if or when the employee who owns the account leaves the company, the data goes with her. That is a risk an organization should be unwilling to take. Remember that even if you deploy a corporate OFS solution, if users are still choosing to use consumer-grade solutions for their business data, you aren t really protecting much. In short, just deploying a solution isn t enough; it must attract and retain users. Conversely, over-engineering to meet end-user requirements can be detrimental. ESG sees evidence that when IT digs too deeply into user requirements and tries to create a perfect fit on its own, it diminishes the going-viral potential. It may be that each department and user is too different to make airtight conclusions about an ideal solution. Instead, IT needs to create excitement around improving the end-user experience which in turn can drive viral adoption.

6 White Paper: Evaluating Sync and Share Solutions 6 Don t underestimate the results when you empower people to work where and how they wish. Providing tools to support productivity has a tremendous capacity to enhance it. Getting to a User-first Perspective Getting to user-first territory takes planning. Individuals believe that their job functions are unique, so it is very important to have broad representation. Seek out people within divisions who are respected. Consider which lineof-business employees should evaluate potential solutions; they are your big influencers and will help you get the product adopted. Analyzing OFS Options OFS offerings differ in basic areas such as the deployment models they support (public, private, or hybrid), the amount of storage they allow (in public and hybrid deployments), the number of users they support, and the ability to access data on mobile devices. Some solutions are quite flexible in how the user environment can be configured and administered to allow different sharing experiences for different organizations within a company (though these environments can be complex to set up), while others lack range of functionality. Keeping a user-first perspective in mind such as evaluating the trade-off between desired functionality and the impact it may have on the user experience here are some basic client and IT-admin considerations when evaluating OFS options. Evaluating OFS Clients 1. The end-user experience is what makes or breaks ultimate product adoption; place equal or more weight on the end-user experience than on the IT management experience. After all, if users continue to use their personal solutions, the company will fail to secure corporate data. 2. Endpoint capabilities and functionality are also important. In BYOD environments, where device use is unpredictable, it s important to understand what can and cannot be done on devices. Some OFS solutions allow mobile access to files within corporate file shares but don t allow sharing from mobile devices. Understanding employee behavior and requirements will help you understand just how important mobile file sharing requirements are to your environment. 3. In highly collaborative environments, users will want the ability to lock files for editing, see who has worked on files (with changes tracked), and comment on files. Presence services that show what collaborators are online and allow for instant communication with those collaborators are also becoming a requirement and more vendors are looking at how to incorporate presence services into their offerings. 4. Communication is core to collaboration, so any features that streamline communication can help speed collaborative projects and shorten time to completion. Your users know how they need to communicate and share information and OFS opens new methods for teamwork. 5. Basing user needs on how data has been classically shared and managed is a mistake. Know what users need now. For example, consider whether you have employees (such as field sales reps) who need to modify documents on mobile devices, or if you just want to ensure users can access the latest documents for marketing and communications purposes. Their specific sharing and editing needs dictate a solution that allows mobile editing. Of course, you can always use third-party applications for mobile editing, but that could compromise the user experience (and thus adoption).

7 White Paper: Evaluating Sync and Share Solutions 7 Evaluating Security Requirements There are a number of security factors to consider when selecting an OFS solution. Some have no impact on user experience such as performing due diligence on service providers, or tracking and reporting user file-sharing activities. Know the Cloud You Seek for OFS When selecting a cloud service, evaluate data center and network security practices as well as secure application development practices. Access to audit logs is a high-priority security requirement. Vendors can help customers track and report on users, data, and activity in a number of ways. At a minimum, vendors should offer a combination of data to help administrators track abnormal or malicious behaviors and patterns such as which users access content, who users are sharing with, where they are accessing data from, and how much they are downloading. Know the OFS Security Capabilities At the product level, the following IT security basics should help IT organizations start down the right track when it comes to evaluating solutions. 1) Since many organizations, especially large enterprises have existing security tools, processes, and policies, it is important to consider how well OFS solutions integrate with the current authentication environment (if at all). A shortlist of required features in this category includes active directory (AD) integration; that is, an OFS solution able to integrate with existing directory structures and leverage those permissions, rather than recreate them. It s also important to understand a vendor s encryption capabilities, especially in cases involving confidential data, since these offerings allow data to reside in many locations. 2) Encryption key management is something else that should be considered; successful key management plays a critical role in keeping OFS data secure. Most public and hybrid online file sharing and collaboration vendors hold customer encryption keys to enable sharing between users within and between domains. These services usually store the keys in different locations than the data, adding a layer of security, but the keys are maintained outside of a customer s standard security policies and practices. In choosing the right key management processes for their company, IT organizations should think about the types of company data they want to store in an OFS solution. For information that requires high security (IP, regulated data, etc.), customers may want to consider a solution that allows them to manage their own keys to ensure that any data stored in the cloud and potentially accessed by a hacker (or a rogue employee in the cloud data center) is nothing more than useless bits and bytes. But beware of deploying a solution to meet strict data access and security rules for data that may not need it users know and will go rogue to simplify access and make their lives easier! Other features to consider include remote wipe of data, having the ability to limit what or how much data can be stored on mobile devices, and granular management of file sharing policies. The Bigger Truth Consumerization has had a huge impact on file sharing within companies, often resulting in the loss of enterprise IT s control over where corporate data resides. It s time for IT to take back that control, giving corporate users a file sharing solution that meets today s requirements for mobile access, while maintaining security and control over corporate assets. With the right solution, you can make a difference in the way your employees work and prevent them from applying their own online file sharing fixes. Taking a user-first approach significantly improves the solution s chances of adoption and success. How can you gauge a solution s success? While a vendor may boast that it has just deployed 50,000 seats of its OFS solution for a customer, the number of seats is not the important indicator. How employees are using the solution is what counts. Real indicators of success are more likely to include an increase in the number of files stored and shared, a reduction in attachments, or employees deploying the solution on multiple devices. This means users like and are using the corporate solution, not going around IT to use personal solutions.

8 White Paper: Evaluating Sync and Share Solutions 8 Look at those usage indicators to know whether you are making an impact, and make sure your vendor can provide good information to you. If you succeed in deploying the right OFS solution, you ll be on your way to putting control back where it belongs: with IT. 20 Asylum Street Milford, MA Tel: Fax: