File Sharing: Risk or Remedy?

File Sharing: Risk or Remedy? End users need the right tools for document collaboration, and in the era of consumerization, they ll find them with or without you! Published: July 2012 1

Effective file sharing is a necessity in knowledge-intensive organizations. Document-centric team collaboration is required for producing a variety of outputs, including internal-facing planning documents and external-facing deliverables. Teams need adequate tools to collaborate around work-related documents. Despite the need for effective document collaboration in the enterprise, many organizations are failing to provide their employees with the right tools to get the job done. The result is that knowledge workers are looking outside of the enterprise for solutions. Collaboration platforms (e.g. Microsoft SharePoint) offer content repositories for working with documents, but many IT departments have set these tools up in a restrictive, cumbersome and unintuitive manner. Today s knowledge worker wants platformagnostic, on-demand access to their files whenever and wherever they need them and they ll bring this functionality into the organization whether IT approves of it or not. Employees are bridging the established enterprise infrastructure into their preferred work environment using solutions that corporate IT departments do not, cannot, or only slowly approve of. In short, knowledge workers are willing to look at tools outside the paradigm offered by corporate IT to meet their needs. Central to this discussion are cloud file sharing solutions like Dropbox and Box. These services host files using cloud-based infrastructure and ubiquitous synchronization across all desktop and mobile platforms, and provide a range of functionality for uploading, managing, and distributing content. End users are driving the adoption of these tools, not corporate IT departments. In fact, many corporate IT departments are quick to dismiss these tools due to security concerns (perceived and real) or the fear that they ll dilute the value of formal content management systems. End users have no such concerns. They want easy-to-use tools that give them the functionality they need, and they have no qualms about sneaking services like Dropbox into the enterprise. Although most cloud file sharing solutions provide locally-installed applications (as well as mobile clients), they can also be easily accessed through traditional Web browsers. This makes it easy for end users to utilize these services, even in environments where corporate IT strictly controls what applications can be installed on company-owned machines. Files that are added to the cloud file transfer service folder can be instantly synced to and edited by multiple devices, as selected by the administrator of the account. 2

Why adopt Cloud File Sharing Solutions? How should corporate IT think about these solutions, and what is IT s role? The adoption of cloud file transfer solutions can be viewed in the broader context of the consumerization of IT. Companies are realizing that consumerization trends aren t just limited to bring your own device, but also bring your own applications. So why is this occurring? Simply put, end users aren t satisfied with the tools that they re being provided by IT. The rise of work from home policies, alongside the exploding prominence of mobile devices (smartphones and tablets) means that enterprise applications that were once seen as being adequate by end users are now viewed as clunky and outmoded. Most employees face friction in using established enterprise collaboration architecture, and users are proactively addressing these deficiencies by adopting their own tools. In many situations, they are also being prodded in this direction by external partners. Customers, suppliers, and consultants are requesting teams join particular cloud file sharing services for the purpose of inter-organizational document collaboration, yet few IT departments have policies and procedures in place to deal with these requests. File-sharing applications, as they become more ubiquitous, have become a significant concern for IT departments, especially in security-sensitive industries, such as health care and financial services. IT departments have to decide how strict the regulation of these applications will be, and enforce compliance of these regulations. IT can outright prevent the installation of the application on workplace desktops and laptops through administrative lockdown (at the expense of the freedom of the end-user to customize their workstation). Access to Web-based file sharing services can also be restricted by blocking specific domains. But IT will have a harder time preventing information from leaking through mobile device sharing. As with most personal unmanaged applications (PUAs), file-sharing applications will pop up with or without IT s consent. It s important to establish strict, enforceable policies that are frequently communicated while still allowing your users enough freedom to operate and manage their data comfortably. The first step in evaluating consumer file sharing tools is to determine why end users are adopting them. Learn about use cases behind adoption then conduct root cause analysis. More often than not, employees are using these tools in an ad-hoc fashion in order to compensate for real or perceived gaps in the current, official collaboration infrastructure. Identify those departments that are making heavy use of these services, and then carry out a functional examination of their business needs and objectives. In some cases, IT will be able to provide them with access to existing IT-sponsored tools that will meet their needs. But where these tools don t exist, IT should consider officially supporting cloud file sharing solutions to quickly and cost effectively close feature gaps. In some cases, limitations on current tools will be the driving factor behind ad-hoc adoptions of cloud storage services. For example, teams working with large email attachments will often have to turn to services, such as YouSendIt, in order to circumvent attachment size limitations. As with consumerization trends in general, IT should strike a reasonable balance between security and functionality. Don t dismiss these tools without taking a careful look at them first. Most file sharing vendors are beginning to offer document-level security and access 3

controls, as well as enterprise-class account management. Given their widespread use, there have been relatively few high-profile security breaches involving major vendors in this space. In most cases, the functionality offered by these tools DOES provide an edge over traditional content management systems in certain areas. For example, the mobile access options of traditional content management solutions like SharePoint are decidedly inelegant compared to the mobile offerings of most cloud file sharing services. Major vendors (particularly Box) provide enterprise-grade plans that give IT managers granular control over user permissions and security. IT can also promote policies that permit the use of file sharing applications in certain use cases, but not others. For example, a company may allow the use of Dropbox for sharing external-facing deliverables with partners, but disallow use of the service for certain types of sensitive internal planning documents. IT can also stipulate that users take advantage of onpremise endpoint encryption or document security solutions before uploading material to file sharing services. If IT wishes to actively encourage cloud file sharing, it must ensure it does not run afoul of preexisting security policies. Email permissions may need to be rewritten, and compatibility with the organization s OS of choice must be verified. Most consumerized cloud file sharing solutions do not have built-in anti-virus and anti-spam protection, so end users are often responsible for their own files. IT must choose compatible anti-virus software that can actively monitor and scan recently synced files. The entire internal IT environment must be considered before cloud file sharing is implemented. What functionality do these services offer? Who are the major vendors? Most cloud file sharing solutions offer the following features: Cross-Platform Access. The ability to upload and share files across a range of devices and operating systems, including browser-based access, on-premise desktop applications, and dedicated mobile apps. Local Sync Capabilities. Ability to automatically synchronize local files and folders into the Cloud in the background on platforms, such as Windows and Mac OS X, and most mobile platforms including ios, BlackBerry, and Android. Security. There are two sides to the security coin: security/encryption of the synchronization pipeline, and security/encryption of the content itself. Most vendors offer secure access to files, but document-level encryption is not yet a common feature. Version Control. The ability to track file and folder modifications and easily restore older versions. File/Folder Management. Basic file and folder management capabilities. Administrative Controls. The ability to perform centralized account management and centralized billing. Administrative controls should be particularly of interest to IT managers. 4

% of Respondents Application Integration. The ability to interact and sync with other applications, such as Microsoft Office, email applications, SharePoint, and CRM applications (e.g. Salesforce.com) in the enterprise as well as integration with other consumerized applications, such as personal task management apps or personal note taking apps. Leading Vendors Cloud file sharing is gaining popularity among consumers, and businesses are also moving in the direction of having third-parties handle their file storage and collaboration needs. File sharing was traditionally done through email or FTP. As consumer and business needs expanded, new entrant file sharing vendors began to crop up. Traditional vendors have also begun to buy their way into this rapidly growing market. For example, Citrix s recent acquisition of ShareFile signals its intent to aggressively move into this market space. Dropbox, Google Drive, Microsoft SkyDrive and Box are the most commonly used vendors according to a recent Info-Tech survey. 60% 55% 40% 33% 20% 21% 21% 18% 12% 12% 8% 8% 5% 5% 0% Source:, N = 66 Accellion, YouSendIt, SugarSync, Adobe SendNow, and Citrix ShareFile are just a few other key players on the cloud file sharing vendor list. Many of these vendors use the freemium model, with basic accounts being offered for free but additional costs for extra storage, upgraded support, or enterprise-level controls. 5

Dropbox Dropbox is commonly viewed as a go-to solution for cloud file sharing. Its developer-friendly API offers application developers the opportunity to build Dropbox integration into a wide variety of consumer and enterprise applications. Users can access the Dropbox cloud through a locally installed application and mobile applications, in addition to the Web interface. A noticeable drawback is that extra storage is expensive relative to other vendors. Dropbox secures data using SSL and AES-256 bit encryption, but it does not officially support the creation of personal private keys. As a result, Dropbox may not be appropriate for transferring highly sensitive files. Synchronization is free with a basic account, and Dropbox for Teams is offered as the step-up solution. Dropbox is ahead of Box on the consumer applications side, but lags in terms of enterprise integrations. Microsoft SkyDrive SkyDrive is Microsoft s cloud file sharing solution in the Windows Live suite. SkyDrive provides an online document editor tool and has the capability to sync multiple folders into the Cloud. Users can access and edit Microsoft Office files directly through the Office suite. This tight Office integration is one of the key value drivers for SkyDrive. A noticeable drawback is that only OneNote 2010 and Word 2010/2011 can have multiple users editing one document simultaneously; otherwise, the Web App is needed to utilize this feature. As a consumerfocused solution, SkyDrive does not provide many of the specific services required for enterprises and large businesses. Microsoft recommends SharePoint as its business solution. Google Drive Google Drive is a recently released software-as-a-service suite that offers collaborative file sharing and editing capabilities, and can directly interact with other Google products, such as Google+ and Gmail. The built-in document editor is compatible with PDF and Microsoft Office document files and its gallery can open Adobe Photoshop and Illustrator graphics editing files. Similar to other cloud-based storage solutions (like Dropbox), Google Drive can only automatically synchronize one folder to the Cloud. This service lacks encryption features and enterprise software integration capabilities. Box Since 2005, Box has grown into a formable competitor in the cloud file sharing and collaboration vendor landscape. It has integration capabilities with enterprise applications, such as Salesforce, NetSuite, Jive, and SharePoint as well as over 40 of the major ECM systems including EMC Documentum and Mobile Device Management vendors such as Good Technology and Mobile Iron. Its OneCloud partner ecosystem is gaining traction among ISVs, making Box the most integrated solution with the most commonly deployed enterprise systems. The account holder can define who has access and edit privileges to specific content on the Cloud. A comprehensive reporting on user activities, file/folder/collaborator changes, and security settings is available to the administrators providing full transparency and an audit trail to support corporate compliance policies. An Info-Tech survey shows that Box is not a widely used solution (18%), compared to Dropbox (55%) and Google Drive (33%). This is likely because of its accessibility and its enterprise-oriented nature, as Dropbox has free desktop sync whereas 6

Box does not, positioning it as a less preferred consumer starting point, compared to Dropbox. Box does provide desktop sync with its enterprise plans however. Though not as well known in the consumer file sharing market, Box is the enterprise brand that is best positioned as a good alternative to replace Dropbox for an IT sanctioned, enterprise-wide deployment of cloud-based file sharing services. What s the difference between cloud file sharing solutions & managed file transfer? Traditional file transfer techniques, such as basic FTP servers, are limited in handing growing data volume requirements and compliance standards that are fundamental in B2B operations. Managed File Transfer (MFT) services are specifically structured to satisfy intensive enterprise requirements and also integrate with enterprise software. MFT is a full-strength, high-security option that is process-centric and can handle larger amounts of data. For example, a studio requiring digital transfer of its multimedia content to its local broadcasters would be better off using a MFT solution in order to prevent any content leaks. Conversely, consumerized cloud file sharing solutions focus on the demands for public file sharing and built-in document editors. Knowledge workers who require flexible collaboration and editing options, such as multi-device syncing and mobile access are best suited for cloud file sharing, unless the raw data that they work with is highly sensitive. For more information about the MFT vendors, please refer to Info- Tech s Vendor Landscape: Managed File Transfer. What are the overlaps between cloud file sharing solutions & file backup services? Cloud backup solutions evolved from the traditional online backup where data is backed up to the Web to on-site appliances that compress, duplicate, and cache before being replicated to the Cloud. An enterprise-class cloud backup solution must include an on-premise cache of recently and frequently accessed files to mitigate any issues due to inconsistent Internet connectivity. Both consumerized cloud file sharing solutions and cloud file backup services store and manage files on a Cloud and can be easily accessed. Cloud file backup, however, is strongly focused on archiving and encryption capabilities. For more information on cloud backup vendors, please refer to Info-Tech s Vendor Landscape: Cloud Backup. What are the use cases? For team collaboration, how should SharePoint be used in conjunction with these solutions? Info-Tech identified three primary use cases for cloud file sharing services: personal file access, team collaboration, and partner collaboration. Survey respondents indicate that these services are predominantly used in the enterprise context for team collaboration and file access. 7

Source:, N = 52 Most vendors have structured their products around team use and collaboration. For instance, Dropbox gives its free users storage capacity upgrades of half a gigabyte (or a full gigabyte from Dropbox Pro) for every person that accepts an invite to the user s account. Dropbox also offers a one terabyte team account option for its paid service. This service, and others like it, is built to allow easy sharing of documents; file access can be easily granted at the discretion of the account holder. The upload process for teams is a relatively simple drag-and-drop function, as opposed to a product like SharePoint that requires multiple steps, including mandatory tagging of files and selecting items from multiple menus. Mobile applications also allow for on-the-go uploading, sharing, and editing of content. SharePoint can have serious accessibility issues when connecting through a VPN, and does not offer first-party mobile support. Freemium file sharing applications allow for the sharing of the entire folder across multiple devices with relative ease, so a file synced to (or from) a mobile device will appear as a downloaded local copy on every device that has access to the folder, and that file can be manipulated and edited much more easily than when saved on an external SharePoint server. The use cases for mobile file-sharing can seem limited since smartphones are not always ideal for editing content, but mobile sharing allows for the instantaneous capture and movement of media such as photos, video, and audio recordings to add to knowledge bases within the shared folder. A reporter doing an interview can upload her audio notes to the file-sharing application and it will almost immediately become accessible across her other devices. Raw data and files in early stages of production become easier to manage and proliferate through these file-sharing services. Tablet use is on the rise, and their increase in popularity goes handin-hand with increased use of cloud file transfer services. SharePoint s limited mobile functions 8

currently prevent it from being competitive in this area, especially in ios and Android environments. Partner (i.e. customer, supplier) collaboration is a less frequently cited use case of cloud file sharing services, but it s still notable in that these services allow for selective sharing of files and folders for ongoing B2B collaboration around non-sensitive documents. The administrator of the account can select a particular folder to share and sync to, and can then send invites to the relevant parties even if they re outside the organization. Set up cloud file sharing solutions to complement rather than supplant SharePoint When properly implemented, SharePoint and other file-sharing services do not need to be at odds with each other. Documents that are in their early stages can benefit from the more freeflowing collaboration that cloud file sharing can provide. In later stages of content creation, when documents are being prepared for publication, the switch can be made to SharePoint to take advantage of tight versioning and authorship controls. SharePoint offers a more rigid storage system, thus making it ideal for master document management, while the fluidity of cloud file transfer services can make long-term document management more challenging. SharePoint should always be used as a large-scale, long-term repository for templates and finalized documents. Use file sharing services for ad-hoc employee-to-employee document collaboration, and then transition to SharePoint for formal content creation and archival processes. Users can use SharePoint as the back-end file repository, collaborate and edit in the Cloud, and then return the document to SharePoint for storage. SharePoint 2013 to Offer Prosumer File Sharing? Microsoft will be announcing SharePoint 2013 during 2012. An anticipated, but speculative, feature of SharePoint 2013 is the availability of a prosumer cloud file sharing service that will integrate with Microsoft Office applications and mobile devices. Info-Tech predicts that Microsoft will improve access to SharePoint itself by allowing for greater mobile device access (possibly through a first-party dedicated app). These prosumer services may be offered as a professional upgrade of Microsoft s SkyDrive, but they will likely retain some of SkyDrive s consumerized attributes. Microsoft also recently announced its possible acquisition of the enterprise social network service, Yammer, which recently acquired the onedrum document collaboration and file sharing platform. If it proceeds, this acquisition will add value to SharePoint s enterprise social capabilities and extensive Office integration development. Microsoft should announce more details about SharePoint 2013 in Q4 2012. 9

Key Recommendations Cloud file sharing solutions have experienced explosive growth in the enterprise, driven in large part by employees plugging deficiencies in the established collaboration architecture by using their own tools. IT departments should NOT have the knee-jerk reaction of lock out everything to these services. Evaluate whether or not legitimate needs are being met by employees using these tools. If a root cause analysis shows that your existing toolset is insufficient to meet the needs of end users, consider formally adopting and deploying these services. Traditional means of sharing files (e.g. email attachments or SharePoint) can be clunky and ineffective for ad-hoc team collaboration. Knowledge workers demand access anytime and anywhere to their files. Leverage cloud file sharing services for maximum device ubiquity. Ensure that your approach to cloud file sharing solutions balances the benefits and risks. In some cases, policies should be established that prohibit highly sensitive internal documents from being shared over these services. Ensure that your file sharing vendor of choice integrates with your established enterprise architecture. Many vendors offer out-of-the-box integration with popular enterprise software, such as Microsoft Office and Salesforce.com. Most major file sharing vendors (i.e. Dropbox, Box, etc.) offer corporate plans for team collaboration these plans offer administrative controls beyond those provided in the freemium versions. IT departments should strongly consider purchasing an upgraded plan for enterprise use. Set up workflows that use file sharing services to complement rather than supplant your existing collaboration architecture: for example, use SharePoint for back end document management and file sharing solutions for fluid front end team collaboration. Train employees on proper usage of these products from a technology and security standpoint. 10