Osterman Research

What Really Is the "D" in BYOD?

The Bring Your Own Device (BYOD) trend is consuming lots of digital ink on blogs, IT managers are wrestling with the problems created by it, and a growing number of vendors are addressing the issue with innovative new solutions. But when we talk about the “Device” in BYOD, what do we really mean? I contend that BYOD should really be BYODA: Bring Your Own Devices and Applications (remember, you saw it here first!).

The problems with BYOD in a device-only context are several:

IT must spend more of its already scarce time to manage employee-owned devices like iPhones, iPads, Android smartphones, Android tablets, etc., in addition to the devices they supply to employees. This consumes an increasing amount of staff time in IT departments that are already resource- and budget constrained.
More strategically, employee-owned devices that access corporate applications, download email, store attachments and the like are mini-repositories of sensitive and confidential information that can create a variety of compliance problems. For example, a lost device that cannot be remotely wiped (not all companies have yet implemented this capability) can create enormous data breach notification problems, not to mention the potential exposure of intellectual property.
Even for devices that are not lost, imagine going through an e-discovery, regulatory audit or similar exercise in which you have to identify, search and extract data from potentially thousands of devices that are spread around the globe.
When employees leave your company, you have to ensure that a) sensitive or confidential corporate data has been returned to the company along with the device itself and b) that copies are not stored in repositories outside of IT’s control.

How are these problems any different for an organization when users download Dropbox, share company files via Hotmail to get around file-size limits in the corporate email system, or post information to Twitter or Facebook? Fundamentally, the problems are the same for devices as they are for applications: IT must spend time managing/blocking/creating policies about these applications if they want to exercise any sort of control over the content stored or sent using them, they face compliance issues when data is stored in personal cloud repositories, they face the same kinds of search and extraction problems when going through e-discovery or regulatory audits, and they have no assurance that corporate content is not still somewhere in the cloud after an employee leaves.

In short, the BYOD problem is not really a device-focused issue, it’s part of a larger governance issue that encompasses both devices and potentially thousands of different (mostly cloud) applications.

Published May 9, 2012

The Real Importance of Google Drive

By Michael Osterman

Google has finally announced Drive, its storage and synchronization solution that—at least on one level—is designed to compete with Dropbox, Microsoft SkyDrive, YouSendIt Dropbox, Trend Micro SafeSync, SugarSync, GoodSync, Syncplicity and other file-synchronization tools. On an overly simplistic level, file synchronization is a superset of online backup, often focused on individual users, because of its addition of automatic synchronization features—and it’s one of the hottest areas of growth in the storage space right now. Secure file transfer—another growing area of interest and investment—is a related market, but somewhat different because of its emphasis on the transfer of content as opposed to its storage.

Drive now creates a new front in the ongoing, multi-front battle between Google and Microsoft in the context of communications (Gmail vs. Exchange Online), online productivity applications (Apps vs. Office Web Apps), search (Search vs. Bing), real-time communications (Talk vs. Lync), etc. However, Drive may represent the biggest headache for Microsoft in a couple of ways. First, by integrating so tightly with Gmail and Google Docs, Drive creates even more of an ecosystem in the cloud, allowing organizations to create and store everything online. Drive does not represent a dramatic shift toward making it easier to migrate to the cloud, but is another—albeit important—push in that direction. To underscore this, Google is making cloud storage very inexpensive and focusing on both individuals and corporate customers. For example, Drive offers 16 terabytes of storage for $800 per month, or five cents per gigabyte per month. This is dramatically lower than Amazon’s S3 pricing of 11 centers per gigabyte per month at that storage level—even at 5,000 terabytes of storage per month, Amazon’s pricing is 5.5 cents per month.

Second, and perhaps more important, the growing ecosystem of cloud capabilities offered by Google and even Microsoft itself, as well as the addition of very inexpensive storage in Drive, will be yet one more thing that deemphasizes the importance of the OS in the minds of many corporate decision makers. As has been discussed by many others, the rise of the browser’s importance is more or less coincident with the fall of the OS’ relevance. That’s not to say that the choice of operating system is not an important one, but justifying an expensive migration from Windows 7 to Windows 8 (or even Lion to Mountain Lion) will become more difficult in an age where applications and communications tools are accessed increasingly using a cloud model.

What Drive represents, then, is much more important than just another Dropbox competitor, but rather another arrow in the Google quiver directed against Microsoft. Microsoft has already taken some preemptive steps as a result, lowering the price of Office 365 last month and increasing the amount of free storage on SkyDrive just this week.

Published April 25, 2012

Peer-to-Peer Storage Where You Are the Cloud

By Michael Osterman

I had dinner last night with people from Symform (about whom I blogged late last year) and some of their prospects. Symform is a Seattle-based company that has applied what is, in essence, the Skype model to data storage in an attempt to dramatically drive down the cost of cloud-based storage. Rather than build out a traditional data center, Symform customers provide all of their storage themselves on a quid pro quo basis. Here’s how the system works:

Content is uploaded to the cloud from your environment and segmented into 64-megabyte chunks that are protected using 256-bit AES encryption.
Each of these 64-megabyte chunks is then divided into one-megabyte segments.
For each group of 64 one-megabyte segments, 32 one-megabyte parity fragments are added using a RAID 96 algorithm.
These 96 one-megabyte fragments are then distributed randomly across the base of Symform customers worldwide (although most are currently in Europe and North America, with a handful throughout the rest of the world).

When a Symform user downloads content from the cloud, it is gathered from these disparate sources and assembled into the content that has been requested. The 32 parity segments for each block of 64 one-megabyte segments add 50% to the overall storage load, but makes the system highly redundant when local storage is corrupted, customers’ storage systems are turned off or otherwise unavailable, etc. Any 64 of the 96 blocks of data are all that is needed to restore each segment of data.

One of the key advantages of the Symform approach is its extremely low cost: the first 200 gigabytes of storage is offered at no charge, while unlimited storage costs $3.50 per user per month. The only “string attached” is that customers provide as much storage locally as they receive, since their local storage is essentially part of someone else’s cloud. However, Symform also offers an option for those who do not want to contribute local storage.

In addition to offering cloud-based storage at low cost, Symform has also developed interesting solutions to some of the problems associated with cloud storage. For example, their “Turbo Seeding” technology allows IT solution providers to upload customer data to the cloud more securely than when drives filled with customer data are shipped to the cloud provider for the initial data upload. Their “Hot Standby” copies data to the cloud and to another local or remote device for instant access in the event the primary data storage is destroyed or otherwise taken off-line, thereby speeding data restoration.

Another advantage of the Symform approach is its extremely high level of security. Because the data uploaded to the distributed cloud of storage providers is essentially shredded into bits of data, they are useless to anyone who might intercept and decrypt them. Practically speaking, this renders various national requirements to store data only in certain geographies moot—whether all regulators around the world will be enlightened enough to accept this might be another matter.

Symform’s approach is clearly innovative and provides a unique and distributed cloud experience as opposed to one based on remote data centers. They are definitely worth a look.

Published April 19, 2012

How Seriously Do You Take Data Breaches?

By Michael Osterman

Press reports of data breaches are all too common these days, with some breaches exposing millions of records to at least potential exposure to criminals and others. These breaches can be caused by any number of issues, ranging from lost or stolen laptops or smartphones, misplaced backup tapes or USB sticks, direct hacker attacks, installation of keystroke loggers resulting from malware infiltration, advanced persistent threats, malicious loss of data from disgruntled or departing employees, social media exploits, malvertising, etc. Any IT or business manager will agree that data breaches are a serious issue, but how real do they believe the threat to be? For example:

Are tools like Dropbox used in your organization without solutions in place to protect against the loss of data from them?
Is every company-supplied laptop, smartphone and USB stick encrypted so that, if lost, corporate data won’t be lost along with them?
Are your users accessing your corporate network and data assets with their own iPads, smartphones, laptops and home computers without solutions in place to manage their use?
Are DLP solutions in place to prevent unencrypted Protected Health Information, credit card numbers or other sensitive information from being sent through the corporate email system?
Are your users employing their personal Webmail accounts when the corporate email account won’t let them send very large files?
Can files sent outside of your organization be time-limited so that they disappear after a set period?
Can personally-owned smartphones and tablets that contain corporate information be remotely wiped in the event they are lost?
Are you archiving your electronic business records so that this content is not inadvertently purged?

These are just a few of the questions your IT and business decision makers need to be asking and the issues for which funding should be a priority if the answers are not satisfactory. Data breaches can be extraordinarily expensive given that privacy notification laws are becoming the norm, not to mention the cost of losing the sensitive data itself.

Solving a problem begins with taking it seriously.

Published April 10, 2012

Don't Ask Too Much; Don't Post Too Much

By Michael Osterman

There are numerous stories in the press about companies who demand to see the Facebook profiles of job applicants or current employees. In some cases, employees have been denied employment, suspended or fired for refusing to provide this access.

The argument offered by employers for demanding this access is that it provides them with more information about prospective or current employees, much like a credit check or background check would provide. And, from a purely factual standpoint, employers who hold to this position are right: examining a Facebook profile will provide more information about someone than not examining that profile.

But are employers wise to demand access to your Facebook profile? In my opinion, absolutely not.

There is an interesting open letter—albeit a fictional one—that offers a resignation from a director of software development. This resignation was in response to his company’s new policy of requiring prospective employees to allow the company to look over their shoulder when accessing Facebook, or preferably to give the employer their Facebook login information.

In one interview after implementing the new policy, a prospective new hire—after providing her Facebook login credentials—promptly declared that she was a lesbian and was prepared to file suit if a heterosexual “less qualified in any way” was hired instead of her. She went on to explain that even if she was hired she might demand to see the employment contracts of all other employees to determine if she was being paid less than her male or heterosexual counterparts.

A few interviews later, another applicant declared—again after providing his Facebook credentials—that his partner was expecting a child and he would be exercising his right of taking six months of leave as allowed by law in Ontario. He went on to ask, “you would never refuse to hire someone because they plan to exercise their legal right to parental leave, would you?”

This director resigned because he was no longer able to hire whom he wished. By knowing too much about prospective employees, his hiring decisions could immediately be suspect even if his motives were completely above reproach.

Here are two lessons I think we can draw:

Employers are better off not asking for prospective or current employees’ Facebook credentials because knowing too much can make their hiring decisions much more complicated and litigious than they have to be.
Don’t overshare or post content that you don’t want to come back to haunt you. Does the entire Facebook world really need to know your drinking habits, your every idle thought, or every opinion you hold? For example, as I write this I’m looking at the public Facebook profile for someone who looks like a teenager and has posted information about a body part that I might consider inappropriate if I were an employer. Another profile uses profanity in the “Activities and Interests” section. Yet another profile is of a 20-something woman whose clothing in her profile picture might not fully cover my MacBook Air.

Published April 4, 2012