Lab Validation Report Content Raven Secure Content Distribution By Ginny Roth and Brian Garrett February 2012
Lab Validation: Content Raven Secure Content Distribution 2 Contents Introduction... 3 Background... 3 Content Raven Secure Content Distribution... 4 ESG Lab Validation... 5 Agentless Simplicity and Versatility... 5 Actionable Analytics... 9 Trust and Reliability... 11 Going Green... 14 ESG Lab Validation Highlights... 16 Issues to Consider... 16 The Bigger Truth... 17 Appendix... 18 ESG Lab Reports The goal of ESG Lab reports is to educate IT professionals about data center technology products for companies of all types and sizes. ESG Lab reports are not meant to replace the evaluation process that should be conducted before making purchasing decisions, but rather to provide insight into these emerging technologies. Our objective is to go over some of the more valuable feature/functions of products, show how they can be used to solve real customer problems and identify any areas needing improvement. ESG Lab's expert third-party perspective is based on our own hands-on testing as well as on interviews with customers who use these products in production environments. This ESG Lab report was sponsored by Content Raven. All trademark names are property of their respective companies. Information contained in this publication has been obtained by sources The Enterprise Strategy Group (ESG) considers to be reliable but is not warranted by ESG. This publication may contain opinions of ESG, which are subject to change from time to time. This publication is copyrighted by The Enterprise Strategy Group, Inc. Any reproduction or redistribution of this publication, in whole or in part, whether in hard-copy format, electronically, or otherwise to persons not authorized to receive it, without the express consent of the Enterprise Strategy Group, Inc., is in violation of U.S. Copyright law and will be subject to an action for civil damages and, if applicable, criminal prosecution. Should you have any questions, please contact ESG Client Relations at 508.482.0188.
Introduction Lab Validation: Content Raven Secure Content Distribution 3 ESG Lab conducted hands on testing of Content Raven s Secure Content Delivery solution to determine how content is delivered as a service securely and simply, and how the service can reduce costs by replacing physical materials and delivery. Background In any economy, but especially in today s, cost reduction is always a top business initiative that drives IT spending decisions (see Figure 1). 1 A cloud-based approach to delivering IT services can facilitate such a cost reduction, and additionally improve business processes, but the cloud raises its own business concerns around security and risk management. Companies need solutions that can address these multiple business initiatives. As companies look at the reduced costs and improved processes that come with sharing their data with customers, business partners, and internal employees via cloud solutions, the challenge in protecting that data becomes paramount. Not only is it important to ensure that only the right customers have access to the right data, it can be difficult to control the illegal proliferation of that data, thereby compromising company assets and creating real revenue losses. Figure 1. Business Initiatives Impacting IT Spending Which of the following business initiatives do you believe will have the greatest impact on your organization's IT spending decisions over the next 12-18 months? (Percent of respondents, N=614, three responses accepted) Cost reduction initiatives 43% Business process improvement initiatives 30% Security/risk management initiatives 29% Regulatory compliance 24% Improved internal collaboration capabilities 18% Business growth via mergers, acquisitions, or organic expansion Improved business intelligence and delivery of real-time business information Increased use of social networking technology for marketing, customer outreach, market research, etc. 16% 14% 17% 0% 10% 20% 30% 40% 50% Source: Enterprise Strategy Group, 2012. 1 Source: ESG Research Report, 2012 IT Spending Intentions Survey, January 2012.
Lab Validation: Content Raven Secure Content Distribution 4 Content Raven Secure Content Distribution Content Raven Secure Content Distribution allows organizations to securely distribute sensitive content to their customers and manage policies on how that content is consumed. The solution can be deployed on premise within a private cloud or purchased as a public cloud software as a service (SaaS) offering from Content Raven. Published files are encrypted and rendered on the Content Raven service with no temporary files created locally when accessed by the user. Policies control who can access the data and what they can do with the files (save, copy to a USB stick, print, etc.) when retrieved. Analytics, which provide real-time content access, can be used to make sure that the right content is getting to the right users at the right time. Figure 2. Content Raven Secure Content Distribution The Content Raven service boasts several features that provide a comprehensive solution for secure content distribution. Cloud-based services. Companies can publish and deliver content through the cloud with no installation required at the client. On-premise deployment. Content Raven can be contained behind the firewall to protect sensitive internal communication. Analytics. Organizations can quickly see who is viewing content, how often, and from where to tailor offerings to user preferences. Mobile support. Content can be securely delivered to most major mobile devices including iphone, ipad, Blackberry, and Android devices. Multiple file types. The secure delivery solution supports video, audio, Microsoft Office, PDF, Flash, and HTML packages.
ESG Lab Validation Lab Validation: Content Raven Secure Content Distribution 5 ESG Lab performed hands-on evaluation and testing of Secure Content Distribution at Content Raven s facilities in Marlborough, Massachusetts. Testing was designed to demonstrate the simplicity of delivering content securely, the ease of tracking data and analyzing content consumption, and the capacity for reducing costs by eliminating material and distribution expenses. ESG Lab used Content Raven s service, hosted in the cloud, to test the features and functionality of the Secure Content Distribution solution. A PC was used for the web-based administration console to publish content and also collect analytic data. Content was delivered to various devices, including a laptop, ipad, and Android device. Figure 3. ESG Lab Test Bed Agentless Simplicity and Versatility The key to effectively delivering content online is a straightforward solution that is easy to implement and consume. Content Raven s hosted service requires no installation and content is published using a web-based administrative console. Content is delivered to a viewer built into any browser using existing APIs. No plugins are required to view the content. ESG Lab Testing ESG Lab began testing by examining the ease of use of the administrative tool for managing users and publishing content to the Content Raven service. The first test ESG Lab performed was adding a user to the service, accessed by selecting the task from the main dashboard page.
Lab Validation: Content Raven Secure Content Distribution 6 As shown in Figure 4, a single dialog box is used to add a user. ESG Lab filled in the required fields, and granted the user mobile access to content. Administrators can grant content access to groups without the cumbersome task of selecting multiple users individually for access. Figure 4. Add a New User Once the user is added to the service, the final step to complete the task is for the user to access an e-mail sent to her from the Content Raven service. The e-mail contains an Authenticode that allows the user to register for the first time. An additional e-mail is sent with a password that must be changed the first time a user logs into the service. ESG Lab tested the registration process from the user s point of view and found that the two steps involved were straightforward and easy to follow. The e-mails contained hyperlinks to the web service for both the first time registration and initial login, making the process simple to complete. ESG Lab tested the publishing function next, using the same management interface. Multiple content formats are supported and ESG Lab chose to publish a video recording that was created in the lab. Figure 5 shows the attributes that can be added to the published content, including a version number, so revisions can be checked against users current served content and updated automatically. ESG Lab chose Online Documents as the distribution method. Content can also be burned onto CD/DVD and distributed for use without the need to connect to the online service. ESG Lab browsed to the video file from the local hard drive and chose it for the upload file. In addition, ESG Lab selected the file type video which readies the file to be delivered from a streaming server. After the attributes were chosen, ESG Lab selected the Add Content button.
Lab Validation: Content Raven Secure Content Distribution 7 Figure 5. Publish Content Before content can be published, the user must create a key and build a policy for access rights. ESG Lab was able to access the Publish Key option from the content page that lists the video file. As Figure 6 shows, multiple options are available for access policies. ESG Lab chose to make the video file available to two users, and to enable three Maximum Activations, which allows both users to access the content on three separate machines, including mobile devices. ESG Lab also set the rights for users to display the details of the file and remove the file from active content. Figure 6. Publish Key After the attributes were completed, ESG Lab chose the Publish key. This automatically generated an e-mail to the two users to inform them that new content had been assigned to them with a hyperlink to the content online. On a laptop with an internet connection, ESG Lab opened a browser window, logged into the Content Raven secure console service with the user brian.garrett@esg-global.com, and saw the content listed in the online console as new. ESG Lab chose the activate option next to the file and the key for the file was delivered to the console. Once the activation was complete, ESG Lab was able to click on the file and view the video as delivered through a browser API, as shown in Figure 7. No temporary file was created on the local laptop.
Lab Validation: Content Raven Secure Content Distribution 8 Figure 7. Secure Video Delivery ESG Lab also tested the content delivery on a second laptop with the user ginny.roth@esg-global.com, with the same results. Finally, ESG Lab published a PDF document to the same users and tested the document on a remote laptop, an ipad, and an Android tablet. All the devices were able to successfully access and read the PDF content. ESG Lab tested whether Content Raven policies can be used to restrict the number of devices from which a user can access a file and their ability to print or copy content. A policy which restricted access of a PDF to one device for a single user was created. The policy also blocked the ability to print or save the file. After initial access on a laptop, an attempt to access the file on an ipad failed as expected. It was also confirmed that the PDF could not be printed or saved. Why This Matters Content leakage is a growing concern for organizations of all sizes. Content leaking into the wrong hands can lead to increased risk, lost opportunity, a loss of reputation, and a loss of revenue. For example, consider the National risks associated with Wikileaks and the millions of dollars associated with the unauthorized duplication of electronic training materials. Endpoint devices (e.g., laptops and mobile phones) are the last line of defense in the reduction of content leakage. ESG Lab confirmed that Content Raven can be used to securely deliver content that can t be shared with a friend, viewed on another device, copied to a local hard drive or saved to a USB stick. The web-based user interface for publishers is powerful and easy to use and the agentless end-user experience is simply intuitive.
Lab Validation: Content Raven Secure Content Distribution 9 Actionable Analytics Part of the Content Raven solution is an analytics component that captures metrics on public content usage both when users are online and when they re offline. Reports can be presented as a detailed list, line graph, bar graph, or pie chart. These reports allow administrators to track metrics and make future distribution decisions based on how content is accessed. ESG Lab Testing ESG Lab ran multiple reports on a separate live system hosted by Content Raven that had collected information over several months in order to capture more data on usage. Figure 8 shows a Document Access report that details by date and report name the number of times a document was accessed. Figure 8. Content Access Report ESG Lab next created a pie chart report that showed the locations of users who accessed documents during a given date range. Figure 9 shows the results of the location report.
Lab Validation: Content Raven Secure Content Distribution 10 Figure 9. Location Access Report In addition to the above, ESG Lab was able to successfully run the following reports: Registrations: Number of active registrations and who the registrants are. Activations: Number of successful activations daily. Failed Activations: Number of failed activations due to unauthorized access. Reasons for failed activations include invalid keys and exceeding the maximum number of activations. Distributions: Comprehensive data on files and the status of their activation by users. Console: Data on client console downloaded and registered by users. Document Page: Details on document access, including user time spent by page. Why This Matters Using this detailed information on data usage, administrators can quickly see how and where data is accessed. Knowledge of the type of content that is most popular with their customers can aid organizations in content creation. Using this information, they can tailor their offerings to fit the market more effectively, thus increasing revenue potential. ESG Lab examined multiple reports generated by the Content Raven service, and found the information helpful in understanding how content is being viewed and by whom.
Lab Validation: Content Raven Secure Content Distribution 11 Trust and Reliability When delivering content over the web it is important to provide a trust model that protects data in transit, at rest, and when it is delivered to the endpoint. Content Raven provides end-to-end encryption to protect data after it s published for users. It also provides policies to limit which users can access the data and what they can do with the content once it s received. Since data is often only available through a hosted service, the reliability of that service is critical to those who consume that data. With the public cloud option, Content Raven s service is provided through Savvis cloud computing infrastructure with the data recovery and high availability functions that are offered by the Savvis solution. The service can also be hosted on-premise behind the corporate firewall. ESG Lab Testing ESG Lab tested the encryption used, starting with data published to the Content Raven service. As shown in Figure 10, when content is published, it is encrypted using AES 256 encryption and sent to the hosted service where it is stored as an encrypted file. When the user accesses the document, the access key is used to decrypt the document and present the readable content through a browser window. Figure 10. Encrypted Document ESG Lab tested the encryption by publishing a PDF document to the Content Raven service. With a browser, ESG Lab was able to view the content using a key to decrypt the data after choosing an option to activate the content. ESG Lab next attempted to examine the same file without the key available through a logged-in browser session. Using the offline mode, we were able to browse to the file located on the local hard drive. The title itself was changed to a long alpha-numeric string so it was not recognizable from the original file name. Using a text editor, ESG Lab opened the file to examine the contents and found encrypted, non-readable data. Figure 11 shows the content of the encrypted file on the hard drive.
Lab Validation: Content Raven Secure Content Distribution 12 Figure 11. Encrypted Content To effectively provide content to a diverse user community, it s important that strong access controls are present. ESG Lab tested the effectiveness of Content Raven access control policies by assigning access to multiple files and testing the actual content delivered to the end-user. ESG Lab assigned two files to user brian.garrett@esg-global.com : A PDF titled content raven datasheet A video file titled Brian Garrett Intro video ESG Lab also assigned thee files to user ginny.roth@esg-global.com : A PDF titled content raven datasheet A video file titled Brian Garrett Intro video An electronic reader file titled Ascent ebook After the content was published, ESG Lab logged in as the two different users and verified the results of the access control policies. As shown in Figure 12, the delivered content matched the policies created for the two users. ESG Lab also tried to circumvent the access policies by forwarding an e-mail from ginny.roth@esg-global.com to brian.garrett@esg-global.com with the access instructions to a document, but since the link to the Content Raven service still required a login, the user account was not able to access the content.
Lab Validation: Content Raven Secure Content Distribution 13 Figure 12. Content Access for Different Users With any cloud service, a primary concern for customers is availability of data. Sufficient durability must be available in the service to withstand outages and deal effectively with disaster recovery scenarios. Content Raven s cloud solution is currently hosted in the Savvis cloud computing infrastructure, which is a SAS70 Type II, certified managed hosted service. Savvis service level agreement provides 100% infrastructure and 99.99% end-to-end availability. The networking capabilities include 100 Mb/sec bandwidth and an Enterprise Grade QoS with server load balancing up to two pools. Why This Matters According to ESG research, the top concern organizations have in adopting public cloud strategies is data security. 2 However, over half of the companies surveyed expect public cloud computing to have a moderate to significant impact on their IT strategy over the next five years. 3 Organizations would be eager to provide content with a common platform for both internal and external users. Many solutions are available that provide a cloud solution for file storage and sharing, but are not equipped with the encryption and secure access rights technology that allows companies to feel confident that their intellectual property is shared with the right people and not distributed in the wild. Significant capital is invested in intellectual assets and the theft of those assets can be very costly to the business. ESG Lab tested the encryption algorithm and the access control policies of the Content Raven service and found effective security controls to allow companies to safely secure their content and manage the distribution. 2 Source: ESG Research Report, Cloud Computing Adoption Trends, May 2011. 3 Ibid.
Going Green Lab Validation: Content Raven Secure Content Distribution 14 Content Raven s solution provides customers the ability to address green initiatives within their organization. Using the cloud service for publishing content, the only assets required for electronic distribution of that content already exist in the data center, since files are stored and maintained within enterprise IT. ESG Lab Testing ESG Lab toured the distribution warehouse located at the Content Raven facilities and observed the materials required to print and distribute physical paper product. As Figure 13 shows, the physical facility itself is not the only piece required, but additional material needed included printers, paper, ink, binding equipment, etc. Distribution of content also has an impact on green initiatives through the use of oil and gas resources for delivery vehicles. Contrast those methods with Content Raven s solution and most physical assets are eliminated, as shown in Figure 13. Figure 13. Comparing Distribution Methods
Lab Validation: Content Raven Secure Content Distribution 15 In addition, ESG Lab tested document version updates and expiring documents. ESG Lab chose a PDF document, made a change to the graphic within the file, and published the content with a new version number. Using a remote laptop ESG Lab logged in as a user with access rights to the document and instantly received the changes made to the document, showing the speed to delivery of new and updated content compared to paper distribution. ESG Lab used the same PDF file and expired the document. As Figure 14 shows, ESG Lab logged into the service and instantaneously received an Expired status in the main document page. Figure 14. Expired Content Why This Matters The promise of green technology is not only an environmental benefit to a company but can contribute to significant cost reductions in CAPEX and OPEX expenditures. Converting physical assets to electronic versions not only shows a true reduction in hard dollars, but enables increased speed to delivery of updated content for customers. This provides tremendous competitive value to companies. ESG Lab examined the cost benefit ratio of Content Raven s solution and found it to be a compelling enabler for green initiatives, with the potential for significant savings as companies move from hard assets to electronic distribution.
Lab Validation: Content Raven Secure Content Distribution 16 ESG Lab Validation Highlights Creating and publishing content was quick and easy. Consuming content through a web browser was very intuitive and required no training to accomplish. Content was encrypted end-to-end and undecipherable without logging into the service online or using the required access keys in offline mode. Content access was controlled per user, ensuring that only the right users had access to assigned files. Actionable analytics were collected about file usage that allowed administrators to adjust permissions and access as needed. Secure electronic distribution of files provided a significant impact on green initiatives. Issues to Consider Users are added manually or bulk loaded from e-mail addresses. Integration with existing identity stores is currently not supported. Policies effectively control how content is distributed, who can access the content, and whether they can save or print the content. No polices currently control such access modes as type of device, location, and other contextual content. Current analytics provide useful data on how content is accessed. Any action taken based on data contained in the reports is currently not an automated or policy-driven process.
The Bigger Truth Lab Validation: Content Raven Secure Content Distribution 17 Companies have long struggled with delivering content, whether it s training materials, internal communications, subscriptions, or consumer digital products. The traditional methods of printed materials and postal delivery are costly and difficult to scale, especially in a business-to-consumer market. However, the digital delivery of content presents its own challenges to ensure that the data is secured and used as intended by the customer. Much of this content represents significant intellectual property and investment in research and development. The data leakage that can occur when this content is shared without permission strikes directly at a company s revenue potential and carries risks when internal communication inadvertently leaves the secure corporate environment. These risks become magnified by the introduction of mobile devices, where management of these endpoints is still a work in progress. Companies are already opening up such content as company confidential data (40%), customer data (38%), regulated data (36%), and intellectual property (35%) to mobile device users. 4 Solutions that have the flexibility to allow access and present data to smartphones and tablets securely are essential to creating a productive workforce and satisfied consumers of content. With cloud technology becoming a true cost reduction driver for corporate IT, it s evident that secure content distribution can provide significant benefits to the bottom line. But, the choices for file sharing in the cloud vary widely. Many address the need with peer-to-peer or SaaS solutions that lack the strong security controls required to restrict the free distribution of content beyond corporate policies. Content Raven attacks this problem head on with a solution that provides secure distribution of content to internal users, customers, partners, and contractors. Using a combination of policy management and analytical reporting, the solution controls how data is consumed and when content can be removed. Documents can be quickly published and easily accessed online with a simple browser. ESG Lab examined the cloud service provided by Content Raven and found publishing documents easy and intuitive, with no special software required for either the management tool or client. ESG Lab also found the secure distribution of files extremely effective in managing user access to data, and protecting against data leakage from the end-user. The data provided in the analytics reporting allowed ESG Lab to obtain actionable insight into who is accessing files, how often, and from where. It s clear that Content Raven has focused on a single mission to provide a secure content delivery platform that helps companies protect intellectual property while providing significant costs savings with electronic delivery. The wave towards public cloud services and the consumerization of IT puts Content Raven squarely in the sights of companies looking for secure content delivery solutions. 4 Source: ESG Research Brief, Securing IT Consumerization, August 2011.
Appendix Lab Validation: Content Raven Secure Content Distribution 18 Table 1. ESG Lab Test Bed Content Raven Secure Content Distribution Software Content Raven Cloud Service Version 3.0 Client Software Version 2.1 Clients Management Console Windows XP Client Laptop Windows XP Client Laptop Windows 7 Samsung Galaxy Tablet Android Version 3.1 Apple ipad ios Version 5
20 Asylum Street Milford, MA 01757 Tel: 508.482.0188 Fax: 508.482.0218 www.enterprisestrategygroup.com