WHITE PAPER SPON. The Cost and ROI Advantages of IronKey Workspace W300 for Windows to Go. Published May 2013 SPONSORED BY

Transcription

1 WHITE PAPER N of IronKey Workspace W300 An Osterman Research White Paper Published May 2013 SPONSORED BY SPON sponsored by Osterman Research, Inc. P.O. Box 1058 Black Diamond, Washington USA Tel: Fax: info@ostermanresearch.com twitter.com/mosterman

2 EXECUTIVE SUMMARY As organizations become more cost-conscious, and as computing platforms featuring multi-core processors and other robust capabilities become increasingly common, remote work is increasingly attractive to, and viable for, employers, and preferred by a large percentage of employees. However execution can be challenging and, in order to enable remote work, four elements are essential: The remote computing environment needs to reflect the in-office experience to the greatest extent possible in order to maintain remote workers productivity. The remote computing environment must provide a reliable and secure work experience when employees are away from the corporate office and when working on home computers, computers at a client facility, etc. The remote computing environment must minimize or eliminate the potential for data leaks or other inadvertent loss of data to maximize the security of the sensitive and confidential information with which employees work. Of course, the solution must be as inexpensive as possible for IT to configure, deploy and manage, while still meeting the aforementioned criteria. KEY TAKEAWAYS Our research and calculations found that a Windows-enabled flash drive a device that includes a copy of the Windows operating system and the necessary customer-provisioned applications can meet three important requirements: 1. The use of any available computing platform A Windows-enabled flash drive can mimic the in-office experience by booting an employee s laptop or home computer from the secure drive, resulting in a Windows desktop and applications experience equivalent to what has been provided by the organization, including use of printers and networks connections. In fact, the Windows-to-Go capability provided by Microsoft in Windows 8 enables a fully functional copy of Windows 8 to be booted on any PC certified to run Windows 7 or 8 or, unofficially, a Mac. The ability to boot from most available computing platforms allows an organization to turn an employee s unmanaged computer into a trusted workstation with a complete security suite but with no impact to, or risk of infection from, the host computer s hard drive or applications. A Windowsenabled flash drive can mimic the inoffice experience by booting an employee s laptop or home computer from the secure drive. 2. Robust security A Windows-enabled flash drive can prevent data leaks because it leaves no data behind on the host computer. Moreover, installing Windows on a secure device can help ensure that portable data is secured, preventing a data loss if the device falls into the hands of an unauthorized party. 3. Low cost of ownership A Windows-enabled flash drive offers a much lower total cost of ownership compared to Virtual Desktop Interface (VDI) solutions and company-supplied laptops that are often used to enable remote work. Moreover, this approach offers other advantages such as portability, support for multi-factor authentication, built-in hardware encryption, a short learning curve in using the technology, and physical durability. ABOUT THIS WHITE PAPER This white paper provides a brief overview of the Windows-enabled flash drive approach to enabling remote work. It also provides detailed cost comparisons between VDI, conventional laptop and Windows-enabled flash drives under different scenarios. The white paper also provides a brief overview of the Windowsenabled flash drive solution offered by Imation Mobile Security IronKey 2013 Osterman Research, Inc. 1

3 Workspace W300 that enables Windows 8 on a Microsoft Windows 7 or 8 certified PC, along with IT-managed applications and corporate data to be deployed on an encrypted and durable device i. THE NEED TO ENABLE REMOTE WORKERS THE GROWTH OF REMOTE WORK Information workers i.e., those individuals who work with a computer and create information as their primary work effort are increasingly working from home or other remote locations instead of or in addition to a traditional office. For example: The 2012 American Time Use Survey found that 21% of employees performed at least some of their work from home on days that they worked ii. A 2011 analysis on telework found that "forty-five percent of the US workforce holds a job that is compatible with at least part-time telework." iii More than 15% of the workforce in the European Union are described as mobile workers, defined as those employees who work more than 10 working hours each week away from their primary workplace or home iv. Between 2005 and 2011, the number of teleworkers in the United States increased from 1.82 million individuals to 3.15 million. In particular, growth in the number of federal government teleworkers grew by more than five times during this period v. The growth of telework has been enabled by two important trends: A large proportion of employees have access to powerful Windows- and Macbased computers outside of work, computing platforms that often are more capable than the IT-supplied desktops and laptops available to them at work. This, coupled with a wide variety of cloud-based technologies and high-speed broadband access at home and in other locations, enables employees to work from remote locations with relative ease. The challenging economy of the past few years has motivated employers to find ways of cutting costs. Because telework enables a large proportion of employees to work remotely at any given time, many employers can get by with less office space, resulting in potentially significant cost reductions for real estate, taxes, power requirements and other facilities-related expenses. Because telework enables a large proportion of employees to work remotely at any given time, many employers can get by with less office space, resulting in potentially significant cost reductions. THE CHALLENGE OF REMOTE WORK While remote work often enables employees to be more productive and enables employers to reduce their labor costs, telework creates problems of its own. Not least of these problems is the need for remote workers to perform the duties of their job as efficiently and flexibly as when they are in an office. Moreover, traditional technologies, such as giving employees a laptop or using a virtual desktop interface (VDI), can be quite expensive because of their requirement for involvement by IT and because the core technologies required to support these approaches can be inherently expensive and, in some cases, not sufficiently secure. WHY NOT USE MORE TRADITIONAL TECHNOLOGIES? The more traditional technologies noted above laptops and VDI offer a viable means for employees to work remotely on a part-time or permanent basis. However, these approaches have some inherent disadvantages: As discussed later in this white paper, these technologies are relatively expensive. For example, the cost of providing enterprise-grade laptops to 125 remote employees for just a six-month project would be in excess of $230,000, 2013 Osterman Research, Inc. 2

4 while providing a virtual desktop for the same number of employees would cost nearly $80,000. Laptops are inherently insecure because they are easily lost or stolen, resulting in the loss of sensitive or confidential information. While laptops can be encrypted, this adds another cost, not to mention the IT labor required to manage the deployment and management of the encryption software. VDI is a robust technology, but requires an always-on Internet connection in most cases (some solutions offer offline capabilities, but at added expense) and a slow and stunted user experience. THE ADVANTAGES OF A WINDOWS-ENABLED FLASH DRIVE Faced with the growing need to enable telework and to do so as efficiently and inexpensively as possible, IT decision makers should consider the use of a Windowsenabled flash drive approach (one implementation of which is the Windows to Go vi feature in Windows 8) as a replacement for a traditional laptop or VDI deployment. A Windows-enabled flash drive that contains a copy of the Windows operating system, the applications that the user needs to do his or her work, and storage for data is conceptually and practically very simple: the user simply inserts the device into the port of a compatible Windows computer and reboots the system, allowing the user to boot directly from the device itself and not the host operating system or local hard drive. While the monitor, keyboard and CPU of the host computer are used, the hard disk on the host computer is bypassed in favor of the operating system, applications and storage space on the device. WHY THE WINDOWS-TO-GO APPROACH? Why should any organization consider the use of Windows-to-Go or any Windowsenabled flash drive approach to enable remote workers? There are several reasons: Lower cost As shown later in this white paper, the Windows-enabled flash drive approach to enabling remote workers is substantially less expensive than providing laptops or enabling VDI. This advantage is reflected in not only lower initial cost, but also lower lifecycle costs, even for long-term telework projects. Greater employee flexibility The Windows-enabled flash drive also allows greater employee flexibility by allowing them to use any available Windows PC their home computer, any PC at their primary workplace, a PC at a customer location, etc. Because the Windows-enabled flash drive can take advantage of all of the hardware features and software applications of the host PC without any compromise of corporate security policies, users do not need access to a specific laptop or even an Internet connection to remain productive. Faced with the growing need to enable telework and to do so as efficiently and inexpensively as possible, IT decision makers should consider the use of a Windowsenabled flash drive approach. Lower corporate risk The Windows-enabled flash drive is inherently more secure than most laptops, since the flash drive is almost impossible to access if lost or misplaced. Moreover, it is much more impervious than a laptop to access by hackers and there is no back door to the drive contents. This can help eliminate statutory liabilities associated with the breach of customer data, the consequences of which can be extraordinarily expensive. DO-IT-YOURSELF DRIVES VS. A MICROSOFT-CERTIFIED DRIVE As noted above, one of the more interesting features of Windows 8 is Windows-to- Go, the ability to create a fully functional copy of Windows 8 on a flash drive. While in theory this can be implemented on garden-variety flash drives, Microsoft 2013 Osterman Research, Inc. 3

5 recommends using, and only supports, Microsoft Certified Drives for Windows-to-Go. These drives are designed to meet the high performance, reliability and compatibility standards required for Windows To Go requirements that few drives are designed to satisfy. It is also important to note that Windows-to-Go the Windows 8-enabled version of the Windows-enabled flash drive approach runs only Windows 8, although Windows 7 is the most widely used operating system worldwide vii. Fortunately, Windows To Go can successfully coexist in a Windows 7 environment. Additionally, Imation provides IronKey Workspace MWES Edition highly secure Windows 7-enabled flash drives that enable users to work with specifically with the Windows 7 interface with which most are familiar. This is important, permitting users to employ a Windows-enabled flash drive with the operating system they currently use will enable users to reap the advantages of the flash drive approach to computing without having to learn a new interface. COST AND ROI ADVANTAGES This section provides Total Cost of Ownership (TCO) comparisons for three different approaches for enabling a group of temporary employees who would need to be provisioned with a telework capability. The three approaches we compared are: Virtual Desktop Interface (VDI) Provision of Windows laptops Provision of a 32Gb Windows-enabled flash drive (Imation IronKey Workspace W300) To generate the analysis used in this white paper, we used the following approaches: To calculate the costs of the VDI approach, we used a calculator available on the VMware Web site at To calculate the costs of the laptop approach, we used Osterman Research survey data that had been conducted with IT-focused members of the Osterman Research Survey Panel. The goal of this research was to determine the anticipated costs of provisioning and supporting the needed laptops. To calculate the costs of the IronKey Workspace W300 approach, we used the list price of Imation s IronKey device along with assumptions about the amount of IT labor required to configure, deploy and manage the devices. For purposes of this analysis, we created two scenarios in which 125 temporary employees need a telework capability for a period of a) six months and b) three years. It is also important to note that Windows-to- Go the Windows 8- enabled version of the Windowsenabled flash drive approach runs only Windows 8, although Windows To Go can successfully coexist in a Windows 7 environment. VIRTUAL DESKTOP INTERFACE For determining the cost of the VDI approach, we assumed that the system required to host the virtual desktops would be a VMware environment on a four-cpu, fourcore server, and that a total of 0.6 terabytes of storage space would be required. Using the VMware calculator noted above, we determined that the cost of the VDI infrastructure required to support these temporary workers would be as follows: Server: US$32,355 Storage: US$18,125 Networking switch: US$4,000 VMware software license and support: US$7, IT labor hours required for deployment: US$1, IT labor hours required for administration: US$16, Osterman Research, Inc. 4

6 Using these estimates, the total cost of the VDI approach would be $79,792 for a sixmonth deployment ($638 per user), or $162,953 for three years ($1,304). The threeyear costs include the following: $79,792 for the first six-months plus another six months of client administration ($16,466) to complete the first year of the deployment for a total of $96,258 in Year 1. $32,933 for client administration, $338 for incremental storage additions and $77 for additional deployment labor in Year 2. $32,933 for client administration, $338 for incremental storage additions and $77 for additional deployment labor in Year 3. Total expenditure is $162,954 for three years. It is important to note that most of the cost of the VDI approach consists of the servers, storage and licensing that will have a much longer usable life than just a sixmonth project, but are a necessary investment for this approach nonetheless. LAPTOPS Our approach for determining the costs of this approach focused on primary research surveys with members of the Osterman Research survey panel, as well as secondary research on prices from the Dell Web site. In an online survey, we asked respondents how much they would budget for hardware, software and IT labor to deploy a laptop to temporary employees for a six-month project. Using the median responses and the secondary data from the Dell Web site, we determined that the total cost would be US$231,942, broken out as follows: The cost of each laptop computer is US$1,704 (Dell Latitude E6420, Intel Core i5, Windows 7, 8Gb RAM, 750Gb hard disk) specified from the Dell Web site: US$213,000 Configuration and IT labor: US$4,808 Disk encryption software: US$8,124 (e.g., SecureStar DriveCrypt) IT labor for updates, maintenance, etc.: $6,010 This translates to a cost of $231,942 ($1,856 per user) for the six-month deployment and $266,487 ($2,132 per user) for a three-year deployment: $231,942 for the first six-months plus $6,009 in additional IT administration costs and an additional $4,498 in additional licensing costs for the disk encryption software (three-year vs. one-year license) in Year 1. $12,019 for IT administration in Year 2. $12,019 for IT administration in Year 3. Total expenditure is $266,487 for three years. IRONKEY WORKSPACE For the Windows-enabled flash drive approach, we assumed use of a 32Gb IronKey Workspace W300 offered by Imation. We assumed the following costs associated with this approach: Flash drives: 125 W300 units at $129 per unit: $16,125 Labor to create the golden image: $500 Labor for device configuration: $ Osterman Research, Inc. 5

7 Labor for updates, maintenance, etc.: $6,010 Based on these costs, the total cost of the Windows-enabled flash drive approach would be $22,789 for a six-month deployment ($182 per user), or $52,836 for a three-year deployment ($423 per user) viii : $22,789 for the first six-months plus $6,009 in additional IT administration costs in Year 1. $12,019 for IT administration in Year 2. $12,019 for IT administration in Year 3. Total expenditure is $52,836 for three years. This data is presented in the following figures. Per-Employee Cost to Provision 125 Temporary Employees for Six Months 2013 Osterman Research, Inc. 6

8 Per-Employee Cost to Provision 125 Temporary Employees for Three Years THE INTANGIBLES ALSO NEED TO BE CONSIDERED While the cost advantage the Windows-enabled flash drive approach is substantial, it is also important to consider other costs that are more difficult to quantify that tilt the scales even more in favor of this approach. These costs include: Damage to a laptop that could cause a user to be without a computing platform until the damaged unit is repaired or replaced. The need to support multiple computing platforms (remember that the flash drive may be used on virtually any machine, including a Mac). The risk of leaving confidential or sensitive data on a host machine, or the loss of a laptop, that might result in a data breach ix. While the cost advantage the Windowsenabled flash drive approach is substantial, it is also important to consider other costs that are more difficult to quantify that tilt the scales even more in favor of this approach. The costs related to the last point can be significant, particularly if a data breach notification statute would be triggered, which can result in enormous costs for remediation. Moreover, because the Windows-enabled flash drive is more rugged and waterproof than a laptop, these devices represent even more of a TCO advantage for this approach. The issue of data breaches is one that should not be taken lightly. Given that the Ponemon Institute has calculated the cost of a data breach at $194 per record x, a breach of even a small number of records from a single user could have very expensive consequences, including: A requirement to notify affected information owners. Remediation costs, such as provision of credit report services to victims. Loss of corporate reputation. Loss of future business Osterman Research, Inc. 7

9 Using Ponemon s calculations, losing just 500 records in a single data breach could cost an organization $97,000 data breaches of many thousands of records can cost millions of dollars. The significant reduction of this risk when using a Windowsenabled flash drive should not be underestimated. ABOUT IMATION MOBILE SECURITY IronKey solutions meet the challenge of protecting today s mobile workforce, featuring secure solutions for data transport and mobile workspaces. The IronKey line includes the world s leading hardware encrypted drives, PC on a Stick workspaces for Windows To Go, and cloud-based or on-premise centralized secure device management solutions. IronKey is the mobile security portfolio of Imation Corp. Additional information can be found at Osterman Research, Inc. All rights reserved. No part of this document may be reproduced in any form by any means, nor may it be distributed without the permission of Osterman Research, Inc., nor may it be resold or distributed by any entity other than Osterman Research, Inc., without prior written authorization of Osterman Research, Inc. Osterman Research, Inc. does not provide legal advice. Nothing in this document constitutes legal advice, nor shall this document or any software product or other offering referenced herein serve as a substitute for the reader s compliance with any laws (including but not limited to any act, statue, regulation, rule, directive, administrative order, executive order, etc. (collectively, Laws )) referenced in this document. If necessary, the reader should consult with competent legal counsel regarding any Laws referenced herein. Osterman Research, Inc. makes no representation or warranty regarding the completeness or accuracy of the information contained in this document. The almost complete elimination of [the risk of a data breach] when using a Windowsenabled flash drive should not be underestimated. THIS DOCUMENT IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND. ALL EXPRESS OR IMPLIED REPRESENTATIONS, CONDITIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE DETERMINED TO BE ILLEGAL. Imation, the Imation logo, IronKey and the IronKey logo are trademarks of Imation Corp. and its subsidiaries. All other trademarks are property of their respective owners. i ii iii iv v vi vii viii ix x The W300 is software encrypted; the W500 and W700 will be hardware encrypted This requires the use of Windows 8 Enterprise Edition and a Software Assurance (SA) Agreement. SA customers, however, are already licensed for Windows 8, representing no incremental cost Osterman Research, Inc. 8