sponsored by Osterman Research, Inc.

P.O. Box 1058 • Black Diamond, Washington • 98010-1058 • USA Tel: +1 253 630 5839 • Fax: +1 253 458 0934 • info@ostermanresearch.com

www.ostermanresearch.com • twitter.com/mosterman

An Osterman Research White Paper

Published January 2014

SPONSORED BY

sponsored by

Securely Enabling Remote Workers at

Lower Cost Than Traditional Approaches

SPON

WH

ITE

PA

PE

R

SP

ON

©2013 Osterman Research, Inc. 1

Securely Enabling Remote Workers at Lower Cost Than Traditional Approaches

ENABLING HIGHLY SECURE REMOTE WORK There is a growing trend toward remote work: the enablement of remote employees, contractors, temporary workers, physicians, field salespeople, customer engineers and others who work away from a desk and who form a critical and growing component of the information worker landscape. Remote work provides a number of benefits to organizations that permit it, including: • Lower real costs, lower taxes and reductions in other operational costs because

office space does not have to be provided for all employees. • The ability to serve customers more effectively by working in their offices, at

remote locations, at home or while traveling. • Improved employee morale from employees who avoid commutes and can

achieve a better work/life balance. • The opportunity to realize greater employee productivity from employees who

can work wherever and whenever they choose. • The flexibility to employ workers in geographically distant locations and avoid the

cost of moving them to an office location. An important consideration in enabling remote work is the provision of an appropriate computing platform for these remote workers. Employers have four basic options: • Allow remote workers to employ their own laptop or other computer, as well as

their own copies of corporate-compliant applications – the Bring Your Own Device (BYOD) approach.

• Provide a laptop to each individual that is provisioned with corporate

applications. • Deploy a virtual desktop interface to allow access to corporate applications and

data stores. • Provide a “PC-on-a-stickTM” – a USB flash drive provisioned with a copy of

Windows and corporate applications – that remote workers can plug into any available computing platform.

Osterman Research has developed a cost model that compares the laptop, VDI and PC-on-a-stick approaches and determined that the PC-on-a-stick approach offers the lowest total cost of ownership. Moreover, the PC-on-a-stick approach offers greater security against data loss, greater flexibility and the lowest overall risk to an organization from security breaches, loss of intellectual property and other threats. ABOUT THIS WHITE PAPER This white paper compares the IronKey™ Workspace W500 and W700 offerings from Imation. Both are Microsoft Certified Windows To Go devices on a USB flash drive that can enable any PC to be used as a secure Windows 8.1 device. These devices take advantage of the local hardware on a PC or Windows tablet, but use the USB flash drive to boot the operating system and applications and to store all data. The result is a highly secure and completely portable PC experience designed to enable maximum flexibility for users, while allowing IT to retain complete control over the operating system, corporate applications and data with which users work. IronKey, the mobile security portfolio of Imation sponsored this white paper – information about the company and its relevant offerings is provided at the end of the document.

An important consideration in enabling remote work is the provision of an appropriate computing platform for these remote workers.

©2013 Osterman Research, Inc. 2

Securely Enabling Remote Workers at Lower Cost Than Traditional Approaches

THE NEED FOR BETTER SECURITY AND FLEXIBILITY THE MIGRATION TO EMPLOYEE-OWNED DEVICES The Bring Your Own Device (BYOD) trend is pervasive today in organizations of all sizes and across all industries. It enables users and IT to improve worker productivity and generate higher employee satisfaction, reduce operational costs, innovate more quickly, and sustain competitive advantage. BYOD reflects the general trend of enabling collaboration anytime, anywhere for workers who expect to be just as productive away from the office as they are when working within their corporate network (e.g., a presentation that is started on a laptop, revised on a tablet and approved by team members on a smartphone). Moreover, BYOD enables workers to achieve a seamless flow of information and access to applications across all of their devices, whether these devices are supplied by their employer or personally owned. More and more employees are bringing their own devices and preferred applications into the enterprise, creating what we call the BYODA (BYOD plus Applications) phenomenon. Workers’ behavior and expectations are contributing to the consumerization of IT, where lines of business and users themselves are having an enormous influence on the types of technologies and applications used. While employees expect anytime, anywhere access to their content to get their work done, their CIOs are now expected to support BYOD within the corporate environment. At the same time, the BYODA trend is also posing challenges to IT to secure and manage a much more diverse mobile device and application landscape. As evidence of the growth of personally owned devices in the workplace is the following figure that shows a significant increase in the penetration of personal hardware employed in mid-sized and large organizations. Moreover, Gartner has forecast that by 2016, one-half of employees will require employees to supply their own devices for work purposesi. Penetration of Personally Owned Devices in Mid-Sized and Large Organizations

Source: Osterman Research, Inc.

The BYODA trend is also posing challenges to IT to secure and manage a much more diverse mobile device and application landscape.

©2013 Osterman Research, Inc. 3

Securely Enabling Remote Workers at Lower Cost Than Traditional Approaches

SUCCESSFULLY ENABLING WORKERS ON THE GO Telework is increasing at a rapid pace: • The number of teleworkers in the United States grew by 79.7% between 2005

and 2012, most notably among the US federal government and US state governmentsii.

• As of September 2011 (the latest date for which statistics are available), there

were 168,558 US federal employees involved in teleworkingiii. • Forrester estimated that 34 million US adults were involved in telework to some

extent in 2009, a figure that the company expects to reach 63 million by 2016iv. • In the United Kingdom, 42% of professional staff work remotely for at least one-

half of the workweekv. • One study estimates that formal telework arrangements in Australia will increase

from 6% of employees in 2013 to 12% by 2020vi, although more than one-third of professionals in the country work remotely for at least one-half of the workweekvii.

Remote work typically enables employees to be more productive because they can avoid time spent commuting. Moreover, telework enables employers to reduce their labor costs by enabling smaller offices to be maintained, which leads to reduced taxes and lower facilities operating costs. However, worker mobility also creates a number of problems, not least of which is the need for remote workers to perform the duties of their job as efficiently and flexibly as when they are in an office. Plus, traditional approaches to telework, such as giving employees a laptop or using a virtual desktop interface (VDI) can be expensive because of the requirement for involvement by IT and because the technologies required to support these approaches can be expensive and, in some cases, not secure. In short, today’s mobile employee work style offers a number of important benefits, but enabling it creates a conundrum for most organizations: • Information workers need to work wherever they are with all needed capabilities

and as flexibly as possible to maximize portability.

• However, IT needs to provide these capabilities at a low cost and with minimal effort, and it needs to be able to centrally administer device access and usage policies remotely. It is essential that IT be able to secure access to corporate content and systems, particularly for remote workers who are likely to work from low security locations, such as their home networks, coffee shops or airports.

• BYOD complicates the problem by introducing a set of devices that employees

would prefer to use, but over which IT has relatively little administrative control.

ADDITIONAL REQUIREMENTS In addition to the conventional requirements for securely enabling remote work, at low cost and with a minimum of IT effort, are other, more sophisticated remote work requirements. This is particularly true for government workers, which represent the fastest growing market for remote work. Among these requirements are the need to protect devices used by these workers with military-grade encryption in the event they are lost or otherwise compromised, as well as support for Common Access Card/Personal Identity Verification (CAC/PIV) for active duty military personnel, government employees and federal contractors. For non-military government organizations, the Federal Information Processing Standard 140-2 (FIPS 140-2) Level 3 is required in a growing number of situations for both government employees and

Today’s mobile employee work style offers a number of important benefits, but enabling it creates a conundrum for most organizations.

©2013 Osterman Research, Inc. 4

Securely Enabling Remote Workers at Lower Cost Than Traditional Approaches

government contractors. For example, FIPS is required by the US federal government as a purchase requirement for any products that implement cryptography; many government contracts now require FIPS 140-2 Level 3 certification as a condition for bidding on a Request for Proposal. In addition, there are legislative and policy requirements, such as the Telework Act of 2010, that are driving more telework within the government sector; as well as a growing need to maintain continuity of government operations during storms, power outages, terrorist incidents, etc. It should be noted, however, that a large number of other industries can also take advantage of FIPS 140-2 Level 3, including healthcare, financial services, education, insurance and other industries in which workers deal regularly with sensitive and confidential information. For example, mobile healthcare workers – such as doctors on their rounds – often carry mobile devices that contain Protected Health Information that must be protected from unauthorized access according to HIPAA and HITECH requirements. Those in the financial services industry that deal with customers’ financial information must satisfy a variety of requirements, including PCI DSS and the Sarbanes-Oxley Act. WHAT’S THE BEST WAY TO KEEP MOBILE WORKERS PRODUCTIVE? There are four basic approaches that can be used to provide mobile workers with a computing platform on which to do their work: • Personally owned laptop

The easiest way to provision mobile workers with a computing platform, including regular employees, temporary workers and consultants, is to allow them to use their own laptops or desktop computers. This approach has the advantage of being the least expensive in the context of direct costs that are borne by the organization, but it is the most expensive from the perspective of the security risks that accompany it. Because individuals provide their own computing platform, IT has relatively little control over the security of the data downloaded to and stored on the computer, and its ability to control both corporate data and applications is minimized. This can lead to an inability to protect data from unauthorized access, an inability to capture content in corporate archiving or backup systems, an inability to process information through corporate content-filtering systems, potential licensing problems and other risks.

• IT-provisioned laptop

An IT-provisioned laptop is a more secure approach than a personally owned laptop, particularly if the laptop is encrypted. This gives IT more control over the applications and data that are used on the device, and it allows a single corporate laptop configuration to be established for ease of support. However, this is a relatively expensive approach compared to alternatives, as discussed later in this white paper.

• VDI

A virtual desktop interface (VDI) is a good solution for enabling remote workers because it gives IT control over the user experience, access to data and applications, and it puts IT in control over when users can have access to corporate systems. However, it is an expensive alternative for small deployments, realizing economies of scale and lower costs only when relatively large numbers of users are provisioned.

• PC-on-a-stick (e.g., IronKey Workspace)

Another option for provisioning teleworkers is to provide them with a fully functioning copy of Microsoft Windows and corporate applications on a USB flash drive that they can use with any PC certified for Windows 7 or higher operating systems, such as a personally owned laptop, a home desktop PC or any other Windows-enabled PC. As discussed below, the PC-on-a-stick approach offers a

The PC-on-a-stick approach offers a number of security and cost advantages compared to laptops and VDI.

©2013 Osterman Research, Inc. 5

Securely Enabling Remote Workers at Lower Cost Than Traditional Approaches

number of security and cost advantages compared to laptops and VDI.

THE BENEFITS OF WINDOWS TO GO A Windows-enabled USB flash drive on which IT installs a copy of the Windows 8.1 operating system, various corporate applications and storage for data is conceptually and practically quite simple: the user simply inserts the device into the USB port of a compatible Windows desktop or laptop computer and reboots the system, allowing the computer to boot directly from the USB device itself and not the local operating system or hard drive. While the monitor, keyboard and CPU of the host computer are employed, the hard disk on the host computer is bypassed in favor of the operating system, applications and storage space on the USB device. There are several reasons that organizations should consider the Windows To Go approach instead of providing laptops or VDI to teleworkers: • Low TCO

As discussed later in this white paper, the PC-on-a-stick approach to enabling mobile workers is much less expensive than providing laptops or enabling VDI, although VDI may have cost advantages for very large deployments. This advantage is reflected in not only lower initial cost, but also lower lifecycle costs, even for multi-year telework deployments.

• Reduced corporate risk

The PC-on-a-stick is inherently more secure than most laptops, since the content on the USB flash drive is impossible to access if it is lost. Moreover, it is much more impervious than a laptop to access by hackers and there is no “back door” to the drive contents. This can reduce or eliminate statutory liabilities associated with breaching customer data, the consequences of which can be very expensive to remediate. The PC-on-a-stick approach is the most secure of the various approaches considered in this analysis if military-grade hardware encryption is employed for the USB flash drive. Moreover, the PC-on-a-stick approach allows IT to manage remote devices in a highly secure manner, permitting the control of password policies and remote kill/wiping of lost devices.

• Greater employee flexibility

The PC-on-a-stick also allows more employee flexibility by permitting users to employ any available Windows PC operating with Windows 7 or higher – their home computer, any PC at their primary workplace, a PC at a client location, etc. Because the PC-on-a-stick can take advantage of all of the hardware features and software applications of the host PC – such as high-resolution monitors, printers, Webcams and other features – without any compromise of corporate security policies, users do not need access to a specific laptop or even an Internet connection to remain productive. The latter is particularly important for employees who cannot always remain connected to the Internet or to a high-speed connection, such as when on an airplane or in a remote location with poor Internet bandwidth.

• Other benefits

The PC-on-a-stick approach is a more efficient approach than providing laptops because it permits the mass deployment of an IT-created golden image, and because it offers lower lifecycle/refresh costs. Moreover, because a lost USB device is less expensive to replace than a lost laptop, the cost of inevitably lost devices will be lower for the PC-on-a-stick approach.

WHY A MICROSOFT-CERTIFIED DRIVE? One of the more interesting features of Windows 8.1 is Windows To Go, the ability to create a fully functional copy of Windows 8.1 on a USB flash drive. While in theory this can be implemented on basic flash drives, Microsoft recommends using, and will

The PC-on-a-stick approach is the most secure of the various approaches considered in this analysis if military-grade hardware encryption is employed for the USB flash drive.

©2013 Osterman Research, Inc. 6

Securely Enabling Remote Workers at Lower Cost Than Traditional Approaches

support only, Microsoft Certified Drives for Windows-to-Go. These drives are designed to meet the high performance, reliability and compatibility standards required for Windows To Go – requirements that relatively few standard USB drives are designed to satisfy. Also important to note is that Windows To Go – the Windows 8.1-enabled version of the PC-on-a-stick approach – runs Windows 8.1, although Windows 7 is the most widely used operating system worldwideviii. Fortunately, Windows To Go can successfully coexist in a Windows 7 environment with conventional laptops or computers running IronKey Workspace.

THE COST AND ROI ADVANTAGES OF THE IRONKEY WORKSPACE W500 AND W700 Osterman Research created a cost model designed to compare the Total Cost of Ownership (TCO) for the IronKey Workspace W500 and W700 USB flash drives, VDI and laptops. For each of these solutions, we considered all of the relevant costs: • The hardware and software required to deploy the solution for 125 users for

different project periods ranging from six months to three years.

• The IT labor to configure, deploy and manage each solution (based on a fully burdened cost for IT labor of $100,000 per year per full-time equivalent IT staff person).

• The cost of device replacement (for the PC-on-a-stick and laptop), which we assumed to be 2.3% per year (based on industry data).

• To calculate the costs of the VDI approach, we used a calculator available on the

VMware Web site at http://roitco.vmware.com/vmw/DesktopVirtualization/Index.

• For the laptop, we used the list price ($1,325.15) for a Lenovo ThinkPad T431s Ultrabook (Core i5 processor, Windows 7 Professional, 12Gb RAM, 128Gb SSD). Each laptop was configured with Symantec Drive Encryption, pricing for which varies from $93.61 to $143.53 per device based on the number of licenses purchased and the length of the support contract.

Finally, we compared the cost of deploying each solution for six months, one year and three years. More detailed cost data is provided in the Appendix to this report. COST COMPARISON As shown in the figure below, the cost of the PC-on-a-stick approach is less expensive than the cost for provisioning either VDI or laptops for 125 users for all three project durations.

The cost of the PC-on-a-stick approach is less expensive than the cost for provisioning either VDI or laptops for 125 users for all three project durations.

©2013 Osterman Research, Inc. 7

Securely Enabling Remote Workers at Lower Cost Than Traditional Approaches

Cost Comparison for IronKey, VDI and Laptop Cost per User for 125 Users

Source: Osterman Research, Inc. It is also important to note, as shown in the figure below, that the cost of even the most expensive PC-on-a-stick device (the 128Gb IronKey Workspace W700 for Windows to Go) is roughly the same as the VDI approach in Year 1, but substantially less expensive in Years 2 and 3. All of the IronKey Workspace models are much less expensive than laptops across the entire range of project lifetimes. Cost Comparison for IronKey W500, W700, VDI and Laptop Cumulative Cost for 125 Users

Source: Osterman Research, Inc.

The IronKey W500 is 7% to 59% less expensive than the VDI or laptop approaches for a six-month project, and 35-51% less expensive for a three-year project.

©2013 Osterman Research, Inc. 8

Securely Enabling Remote Workers at Lower Cost Than Traditional Approaches

IS THE PC-ON-A-STICK ALWAYS THE LEAST EXPENSIVE? Our cost modeling found that the PC-on-a-stick approach is normally the least expensive method of provisioning mobile workers. However, there are situations in which the VDI approach can be less expensive or on par with the cost of the PC-on-a-stick. For example: • At 180 users, the cost of VDI will be less expensive than the cost of a 128Gb

IronKey Workspace W500 device for a six-month project and will be almost the same cost for a one-year project. However, owing to the higher costs of IT labor to manage a VDI system, the PC-on-a-stick approach will be substantially less expensive for a three-year project.

• Similarly, for a 500-user deployment the 128Gb IronKey Workspace W500 device

will be more expensive than VDI for project durations of six months and one year. However, for a three-year project the PC-on-a-stick approach will be less expensive than VDI because of its lower IT management costs.

• In every case, the PC-on-a-stick approach will be less expensive than providing

laptops to the same number of users. ISSUES TO BE CONSIDERED IN ADDITION TO COST The cost advantage of the PC-on-a-stick approach is substantial, but it is also important to consider other issues that are more difficult to quantify that make this approach even more advantageous. For example: • Damage to a laptop could seriously impact user productivity until the damaged

unit is repaired or replaced. The impact to user productivity can be similar with VDI in situations where Internet access is not available, such as during a power outage, after a major storm, or when traveling and an Internet connection of sufficient bandwidth is unavailable.

• The risk of leaving confidential or sensitive data on a host machine, or the loss of

an unencrypted laptop, might result in a data breach along with the substantial costs that accompany such a breachix.

The costs related to a data breach can be significant, particularly if a breach notification statute in one of the 46 US states in which they exist would be triggered. This can result in enormous direct costs for remediation, not to mention the damage to an organization’s reputation, lost future sales and other consequences. The issue of data breaches is one that should not be taken lightly. Given that Ponemon Institute has calculated the cost of a data breach at $194 per recordx, a breach of even a small number of records from a single user could have very expensive consequences. Using Ponemon’s estimates, losing just 500 records in a single data breach could cost an organization $97,000 – data breaches of many thousands of records can cost millions of dollars. The significant reduction of this risk when using a Windows-enabled USB flash drive should not be underestimated and must be factored into the overall TCO of providing computing capabilities to teleworkers.

SUMMARY The growing trend toward mobility requires an approach that minimizes the cost of providing workers with computing capabilities. At the same time, these capabilities must be highly secure and reliable in order to minimize the risk that organizations face from potential data loss and a loss of employee productivity. Osterman Research has determined that in most situations the PC-on-a-stick approach is less expensive than either VDI or providing laptops, while providing the most secure computing environment of the three approaches considered.

The issue of data breaches is one that should not be taken lightly.

©2013 Osterman Research, Inc. 9

Securely Enabling Remote Workers at Lower Cost Than Traditional Approaches

ABOUT IRONKEY BY IMATION IronKey solutions meet the challenge of protecting today’s mobile workforce, featuring secure USB solutions for data transport and mobile workspaces. The IronKey line includes the world’s leading hardware encrypted USB drives, PC-on-a-Stick workspaces for Windows To Go, and cloud-based or on-premise centralized secure device management solutions. IronKey is the mobile security portfolio of Imation Corp. Additional information can be found at www.ironkey.com.

APPENDIX The following tables present the detailed costs associated with each solution discussed in this white paper Cost of IronKey W500 (128Gb) 125 Users

Option 1 Option 2

Cost Element 6-Month

TCO Year 1 Year 2 Year 3 3-Year

TCO IronKey devices $56,875 $56,875 $0 $0 $56,875 Loss $663 $1,325 $1,325 $1,325 $3,976 Software Kit $5,000 $5,000 $0 $0 $5,000 Device Management License

$6,250 $6,250 $0 $0 $6,250

Device Management Maintenance

$1,250 $1,250 $2,250 $0 $3,500

Create golden image $625 $625 $0 $0 $625 Configure devices $192 $192 $0 $0 $192 Labor for updates, maintenance, etc.

$7,512 $15,024 $15,024 $15,024 $45,072

TOTAL $78,367 $86,542 $18,599 $16,349 $121,490 Cost of IronKey W700 (128Gb) 125 Users

Option 1 Option 2

Cost Element 6-Month

TCO Year 1 Year 2 Year 3 3-Year

TCO IronKey devices $74,875 $74,875 $0 $0 $74,875 Loss $872 $1,745 $1,745 $1,745 $5,234 Software Kit $5,000 $5,000 $0 $0 $5,000 Device Management License

$6,250 $6,250 $0 $0 $6,250

Device Management Maintenance

$1,250 $1,250 $2,250 $0 $3,500

Create golden image $625 $625 $0 $0 $625 Configure devices $192 $192 $0 $0 $192 Labor for updates, maintenance, etc.

$7,512 $15,024 $15,024 $15,024 $45,072

TOTAL $96,577 $104,961 $19,019 $16,769 $140,748

©2013 Osterman Research, Inc. 10

Securely Enabling Remote Workers at Lower Cost Than Traditional Approaches

Cost of VDI 125 Users

Option 1 Option 2

Cost Element 6-Month

TCO Year 1 Year 2 Year 3 3-Year

TCO VMware Software License and Support

$7,500 $7,500 $0 $0 $7,500

Server $32,355 $32,355 $0 $0 $32,355 Storage (0.6 terabytes) $18,125 $18,125 $338 $338 $18,800 Networking: one switch $4,000 $4,000 $0 $0 $4,000 Hours required for deployment (35)

$1,683 $1,683 $96 $96 $1,875

Hours required for Client administration

$20,583 $41,166 $41,166 $41,166 $123,498

TOTAL $84,246 $104,829 $41,600 $41,600 $188,028 Cost of Laptops 125 Users

Option 1 Option 2

Cost Element 6-Month

TCO Year 1 Year 2 Year 3 3-Year

TCO Hardware $165,644 $165,644 $0 $0 $165,644 Loss $1,930 $3,859 $3,859 $3,859 $11,578 Configuration $6,010 $6,010 $0 $0 $6,010 Disk encryption software $11,701 $17,941 $0 $0 $17,941 IT labor $7,512 $15,024 $15,024 $15,024 $45,072 TOTAL $192,796 $208,478 $18,884 $18,884 $246,245

©2013 Osterman Research, Inc. 11

Securely Enabling Remote Workers at Lower Cost Than Traditional Approaches

© 2013 Osterman Research, Inc. All rights reserved. No part of this document may be reproduced in any form by any means, nor may it be distributed without the permission of Osterman Research, Inc., nor may it be resold or distributed by any entity other than Osterman Research, Inc., without prior written authorization of Osterman Research, Inc. Osterman Research, Inc. does not provide legal advice. Nothing in this document constitutes legal advice, nor shall this document or any software product or other offering referenced herein serve as a substitute for the reader’s compliance with any laws (including but not limited to any act, statue, regulation, rule, directive, administrative order, executive order, etc. (collectively, “Laws”)) referenced in this document. If necessary, the reader should consult with competent legal counsel regarding any Laws referenced herein. Osterman Research, Inc. makes no representation or warranty regarding the completeness or accuracy of the information contained in this document. THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND. ALL EXPRESS OR IMPLIED REPRESENTATIONS, CONDITIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE DETERMINED TO BE ILLEGAL.

i Gartner, Bring Your Own Device: The Facts and the Future (April 11, 2013); Analyst: David A. Willis ii The State of Telework in the U.S., updated September 2013 iii 2012 Status of Telework in the Federal Government, United States Office of Personnel Management iv http://www.shrm.org/hrdisciplines/technology/Articles/Pages/Telecommuting-Likely-to- Grow-Bans.aspx v http://launchgroup.com.au/wp/study-predicts-the-end-of-the-office/ vi http://www.cmo.com.au/mediareleases/17298/more-australians-teleworking-highlights- need-for/ vii http://launchgroup.com.au/wp/study-predicts-the-end-of-the-office/ viii http://www.redmondpie.com/windows-7-market-share-increases-finally-crosses-windows-xp/ ix http://www.ncsl.org/issues-research/telecom/security-breach-notification-laws.aspx x http://www.fiercehealthit.com/story/cost-data-breaches-drops-us-not-healthcare/ 2012-03-22