Dropbox open for business

With all the brouhaha about the risks of the free cloud storage and file-sharing app, should channel partners be warning customers away? Dean Gurden reports

It is a given that businesses need to be mobile and collaborative, with cloud-based services fast becoming an essential means to achieve this. Hence we have the likes of Google, Microsoft, Box and Apple avariciously eyeing up the enterprise with their cloud storage offerings.

Perhaps most high profile of them all, Dropbox is also going all out to corner its share of this potentially lucrative market, adding a version for business.

"Business just got better" goes the Dropbox strapline and, yes, cloud-based file-sharing services such as Dropbox are certainly making it easier for employees to share files and information.

But should businesses be wary about rushing ahead and embracing these competing services? What about possible data breaches, third-party surveillance and malicious or accidental disclosure of information by employees?

Some believe that businesses do not really have a choice in the matter. A global survey by security vendor Check Point last June of 790 IT professionals in the US, UK Canada, Germany and Japan, entitled The impact of mobile devices on information security: a survey of IT professionals, found that of the 25 per cent of companies that forbade employees using file-sharing sites, 28 per cent admitted that some of their staff do not adhere to the policy.

Acronis' 2013 Data Protection Trends Research, evaluating responses from 570 UK IT professionals, also found that although corporate files are already commonly shared through third-party cloud offerings, 69 per cent of respondent organisations did not have a policy for public clouds and 80 per cent had not trained employees in the correct use of these platforms.

The statistics are sobering, but with its registered user numbers exceeding 200 million, it is the relative ubiquity of its product that Dropbox naturally likes to push.

"It's already a solution that people know, like, trust, understand and rely upon to make their individual lives run better," says Dropbox spokeswoman Hilary McQuaide.

"Dropbox for Business is essentially the same product that people are already familiar with and use, with a whole range of additional controls for the IT administrator."

McQuaide is at pains to point out this is what the company has been trying so hard to achieve. "It's about giving organisations control and visibility, so they can do what they want whether they have 10 employees or 10,000," she says.

"That's what we have really focused on - letting IT see exactly what is happening within their teams or organisations in terms of who's logging in and what is being shared."

Jason Hart, vice president of cloud solutions at data protection vendor SafeNet, agrees that Dropbox has done a lot to reassure IT departments.

"With Dropbox for Business, the company has continued to bring to market new features, such as remote wipe, increased administrative console functionality and dual-account client support, making it even more attractive to IT administrators," he says.

Dropbox appears to be pinning its hopes on this new dual-account client facility being the clincher for many companies. By enabling users to have both their personal and business Dropbox accounts on the same client or device, IT administrators can let employees use the app while keeping a strong demarcation between their business and personal files.

Hart believes this is crucial because it solves the Bring-Your-Own-Dropbox headache that was facing businesses.

"It allows IT administrators to show a clear separation of personal and business files to ensure control of data and, combined with file encryption, they can now comply with internal data privacy policies and external regulations around electronic data storage," he says.

"This is huge for heavily regulated markets such as healthcare, financial services and legal - basically anyone who cares about the privacy of their business and personal files."

Two-factor authentication

As a minimum, cloud services should support the same kinds of functionality that businesses now realise from on-premise solutions, says David Gibson, vice president at Varonis.

"Make sure it has two-factor authentication by default, actively monitors accounts for abnormal behaviours, and notifies subscribers immediately when a breach is suspected," he says.

In pointing out the obvious - that many organisations have already made big investments in internal file-sharing solutions, as well as the processes and controls for managing them - Gibson also raises another consideration: what will it mean for an organisation if it uses a range of file-sharing technologies?

How will internal users collaborate with ones that use a cloud service, or will everyone move to the cloud? Which data will be migrated?

"For organisations that already have a file-sharing infrastructure, it may make sense to consider extending it to provide the features users want without actually moving or bifurcating data," he suggests.

So how does Dropbox think its business product has been received?

Predictably, Adam Nelson, head of channel partnerships at Dropbox, says there has been a lot of interest from channel partners - from smaller MSPs and IT consultants to large VARs - since its channel programme launched in June.

"With our channel partners we're finding that their customers are already using Dropbox, so we're working with the partners to not only deliver the solution, but help deploy it in a way that really fits the end client's site," he says.

"That's the value that our channel partners can offer because we do not have a view into what else a business might be using, and that is where our partners can create an even more productive experience for the client."

As for those CIOs trying to resist or who are still undecided about these cloud-based file-sharing apps, McQuaide thinks they are looking at it all wrong.

"They should be looking at it from the perspective that it's a wonderful problem to have," she says. "If you know your organisation is ready and willing to adopt, or perhaps already using, a cloud-based solution, that can only be a good thing. That's where we can work with CIOs and talk about what we are doing to meet their needs."

Don't put your head in the sand

SafeNet's Hart agrees with McQuaide. As cloud app usage and document storage continues to proliferate, channel companies should be encouraging businesses to re-examine old-fashioned attitudes towards usage of these apps across the enterprise, he believes.

It is a sentiment roundly endorsed by Nigel Hawthorn, MobileIron's EMEA director. The worst scenario is for IT departments to ignore consumer services such as Dropbox and pretend they are not happening, he says.

"If enterprises are still thinking of Dropbox as enemy number one, trying to block access will eventually just lead to more security risks as employees keep their mobile devices at their side and off the corporate network," he warns.

"Inevitably, more corporate data will be stored in the personal cloud and IT will have to prioritise making consumer apps such as Dropbox secure for enterprise use."

Hawthorn (pictured, right) warns the onslaught of these consumer apps entering the enterprise will be impossible to keep at bay.

"However, this provides a great opportunity for the channel to become advisers in the space," he says.

"It should be counselling customers on how and when to embrace the personal cloud, and talking about the pros and cons of such apps and services to help customers define which are suitable for their business."

When it comes to the cloud, the proverbial horse has bolted. For those employers looking to become or remain mobile and collaborative, the message would appear to be: give your employees what they want or give them an alternative.

Top three tips for your customers

1. Remove the temptation to use personal cloud services and instead provide an app for your customer's employees before they find one on their own. If they already have a file-sharing infrastructure, it is usually faster to extend its capabilities than move everything to a cloud service.
2. Know your customer's data - know what is sensitive, who is responsible for
it, who uses it and who has access to it.
3. Make sure content, access and usage are reviewed regularly by data owners, and that no one has access to data without owner approval.
Source: David Gibson, vice president at Varonis