Google Chrome Devices in the Enterprise Top Six Considerations

The simultaneous needs for flexibility and control and for freedom and security often create tension between users, IT administrators, and business leaders. Additionally, these tradeoffs mean that the days are long gone when IT pros had just one operating system to manage for end users. Yours is now, and will continue to be, a multi-OS world.

While most enterprise users access cloud services on desktops and laptops running Windows, some enterprises are investigating the suitability of Google Chrome™ _{devices for enterprise use.} These devices (both Google™ _Chromebook™ _{devices and Google}™ Chromebox™ _{devices running Google}™ _{Chrome OS}™_{) could} present an opportunity for enterprise IT professionals to improve service delivery and user experience for targeted user groups, such as those who primarily use web apps or thin clients.1 Are Chrome devices a good fit for your enterprise? Maybe—if your targeted user groups can meet the qualifying requirements that a deployment would entail. This paper guides you through the top considerations that should be part of your evaluation of Chrome devices (see table 1).

EXECUTIVE SUMMARY

Users have embraced the cloud in their personal digital lives, and enterprise IT

organizations are looking at cloud technologies as a way to provide IT services to

users. However, these technologies involve tradeoffs that you should understand.

For example, the convenience of cloud-driven mobility for employees sometimes

means less control for IT.

Qualifying Requirements

A Google Chrome™ device rollout will be most successful if your organization can:

Engage with the Google ecosystem Depend on broadband Internet access for full functionality

Move users to a cloud-first model and store some company data in Google’s cloud

Other Important Topics

Things to consider if your organization meets the qualifying requirements

Manageability considerations Security considerations

Suitability of your users, existing software, and use cases to the Chrome devices model

Table 1. Organize your evaluation of Google Chrome™ _devices

Chrome Devices in Context

As an enterprise IT professional, you serve multiple user segments—each with different software needs and potentially different access rights—and each user wants to be productive anywhere from a growing catalog of devices. How do you negotiate the tradeoffs between user needs and organizational requirements for security, compliance, and centralized management?

The devices you put in users’ hands can simplify or complicate this struggle—and there are many choices, including

Chromebooks (see Figure 1). The “right device” is not one perfect tool for every user—you know that tool doesn’t exist. Rather, the “right device” is one that supports the greatest degree of overlap between the sometimes-competing needs of the user and the enterprise. And because there are multiple user groups with different needs and multiple devices with varying levels of manageability and security, there are probably multiple “right devices” for your enterprise.

Who Uses Them and How?

Today’s users and organizations are turning increasingly to the cloud, so Chrome devices are enjoying rising success amongst consumers and educational institutions, and sales

are expected to continue to grow (see Figure 2). The devices could find homes in the workplace serving roles that rely primarily on web apps or corporate data based in the cloud, such as reservation agents or customer service representatives.

Google

Chromebook

Sales Growth

2.1 M

11 M

Figure 2. Google™ Chromebook™ sales figures show that device sales are increasing—and market analysts expect the growth to continue2

The Enterprise Device Spectrum

2 in 1

Terminal

Laptop

Tablet

Smart Phone

Google

Chromebook

Desktop

Low Compute Power

Content Consumption High Compute PowerContent Creation

Enterprise adoption appears to be slower, perhaps due to organizational investment in Microsoft software, questions about security, and the complexity of adding another platform to the enterprise IT environment. Many enterprises rely heavily on Windows and applications that run on Windows. This dependence could be an obstacle for some organizations because Chrome devices represent a cloud-first computing model that is quite different from the traditional model, which is characterized by software and data residing on each local device. Enterprise IT professionals sometimes worry about costs and complexity associated with migrating custom software and legacy applications from the traditional model and Windows to the cloud-first model and/or Chrome OS. Other considerations for enterprise adoption include integration with the organization’s larger IT infrastructure. For example, if organizations plan to manage their Chrome devices centrally, they will need another management console and new credentials for every user. IT professionals also wonder about security, manageability, and offline functionality of Chrome devices. Users might wonder how a move to Google Apps for Business™ _{would affect their ability to collaborate with} colleagues in other organizations who use Microsoft® _Office.

Despite these concerns, some organizations find the Chrome device value proposition compelling enough to warrant investigation. This paper discusses usage considerations in greater detail in the section Chrome Device Suitability in Your Application Landscape. For now, just consider the use cases in which Chrome devices could see additional success— as task-oriented, or limited-access devices. Users might welcome a Chromebook as a lightweight secondary device (provided the apps and data users need are in the cloud). Chrome devices might also be natural fits for user segments that rely primarily on web apps (or simple apps that could be easily migrated), and in non-demanding environments like customer kiosks, devices for guest workers or contractors, as thin-client replacement devices, and in call centers.

Watch for Growth in These Areas

It is reasonable to expect that Chrome devices will continue to gain traction in some predictable market segments. Are your organization’s user groups among them? Industries where Chrome device use could increase include retail, government, hospitality, travel, and education. Within organizations, user segments that are already doing most of their work in the cloud or with web apps could also see Chrome device growth. Chrome devices might also be good fits where users share devices, such as in retail.

These potential growth areas have the following in common: many users in these groups perform prescribed, repetitive tasks in which multiple users access common resources, so the cloud-based computing model could be a good fit. In addition, users access common apps and cloud-based files or data, and individual user files and local storage are not required. Think of front-desk employees or reservation agents in travel and hospitality.

Google Chrome

devices could

work well for:

• Employees who primarily use web apps

• Fixed-function workers currently served

by thin clients

Are Chrome Devices Right for

Your Enterprise?

Now that you have that background and overview of the Chrome device market presence, let’s explore whether Chrome devices are right for your enterprise. Chrome devices appeal to some enterprise IT professionals because of their potential to reduce costs and IT effort associated with maintaining a Windows desktop infrastructure. However, these benefits alone are not enough to justify a hasty rollout. There is much more to consider. The overarching question for your Chrome device evaluation is one of

enablement: will these devices allow your users to do their jobs efficiently? Table 2 helps break that large question into manageable chunks. First, look at the qualifying requirements

to help decide if a deployment in your organization is likely to achieve maximum results. Then, if your enterprise makes that first cut, think about the other important topics shown.

The Essentials: Qualifying Requirements

The qualifying requirements represent the foundation for an optimally successful Chrome device deployment. If your organization can meet one or more of these requirements, then Chrome devices might be a good option for your business. This section examines the details and implications for each qualifying requirement.

Can You Engage with the Google Ecosystem?

By design, Chrome devices rely heavily upon the Google ecosystem—Google’s collection of apps and cloud-based services—for computing functionality (Figure 2). This collection includes Google Apps for Business, the Chrome Web Store and Google Apps Marketplace for apps and extensions, Google™ _{Play for media, the Chrome device management} console, and the Chrome browser.

This dependence upon the Google ecosystem means the following for Chrome devices:

• Each user must have his or her own Google account— hosted on Google servers—to use services, install apps, or access user profiles created by an IT administrator. • By default, users must enter their Google account

credentials to log on to a Chrome device.

• User settings, preferences, and data are associated with the user’s account and stored in the cloud.

• Apps can only be installed through the Chrome Web Store or Google Apps Marketplace.

• Updates to Chrome OS are pushed from Google servers and, by default, applied to Chrome devices automatically upon startup.

• IT administrators can only manage Chrome devices through Google’s cloud-based management console.

Qualifying Requirements

A Google Chrome™ device rollout will be most successful if your organization can:

Engage with the Google ecosystem Depend on broadband Internet access for full functionality

Move users to a cloud-first model and store some company data in Google’s cloud

Other Important Topics

Things to consider if your organization meets the qualifying requirements

Manageability considerations Security considerations

Suitability of your users, existing software, and use cases to the Chrome devices model

Table 2. The two categories of considerations shown here can help organize and simplify your evaluation of Google Chrome™ _devices

As a result of this dependence, some users will need to make adjustments in the way they’re accustomed to working. For example, users will have one browser—Chrome. Web apps or sites that rely on certain technologies to display content, such as Java®_{, ActiveX}®_{, and Silverlight}®_{, will not work on Chrome} devices.3 _{As another example, users can use Microsoft Office} 365 web apps on their Chrome devices, but cannot use a locally installed version of the Microsoft Office Suite, which is more fully featured than its web-based counterpart.4

Some organizations might plan to work around these limitations with a virtualization solution from a third-party vendor, such as Citrix or VMware. With these solutions, users can access a web page that presents a Windows session through the browser on a Chrome device. However, this approach will not deliver the native user experience and performance to which users are accustomed, and these solutions require additional costs in software (and perhaps server hardware). These costs might offset the savings that organizations hope to achieve by deploying Chrome devices. Furthermore, if you need to use some type of virtualization solution to provide Office or other software to a user segment, that need could indicate that those users are not good candidates for Chrome devices.

Some organizations could be uncomfortable with dependence on the Google ecosystem, and compared to the traditional model based on Windows, Chrome devices represent a

Google Chrome

browser

and rendering engine

Google Chrome apps

Services and functionality delivered through a browser or as standalone software

Google

Chrome

Web Store

Google’s source for Chrome and Chromebook apps, themes, and extensions

The Google Chrome

Ecosystem

HP® _{Chromebook 14}

Google™ Chromebook™

Google Apps

Marketplace

Google

Chrome OS

A Google account is required to use services or install apps.

Figure 3. Google Chrome™ devices are designed for engagement with the Google ecosystem—including apps from the Google™ _{Chrome Web Store or the Google Apps}™ _{Marketplace—and Google services such as Gmail}™ _{and Google Apps}™_.

For more information on this ecosystem, see “Google Chromebook and the Google Chrome Ecosystem.”

If you need some type of virtualization

solution to deliver legacy software to

a user segment, then those users

might not be good candidates for

different paradigm for personal computing in the enterprise. These facts, coupled with organizational inertia, could cause enterprise IT professionals to pause. If enterprises need apps that are not available through the Chrome Web Store or Google Apps Marketplace as a web app, or as embedded functionality in a web page (that does not rely on Java, Silverlight, or ActiveX), they must create the apps themselves or find a workaround. Either option could be costly and create productivity obstacles.

Can Your Users Depend on Broadband

Internet Access?

Keep in mind that the Chrome device model of personal computing presupposes Internet connectivity. If you deploy Chrome devices, user productivity can be at its peak when the device enjoys a reliable broadband Internet connection. Chrome devices and the Google Apps productivity suite offer quite robust offline functionality. For example, changes users make to Google Docs while offline are simply saved on the device, then synchronized with the cloud when the device reconnects. IT administrators and users should not rely on offline capability, however, especially in web apps or apps from the Chrome web store. With many apps, users will need an Internet connection to be fully productive due to the apps’ dependence on the cloud.

Some Chromebook models have an Ethernet port, and others can connect to Ethernet through a USB-to-Ethernet adapter. However, we expect that most users, especially highly mobile ones, will choose wireless 802.11a/b/g/n connectivity. While it is possible to tether a Chromebook to a desk with an Ethernet cable, doing so seems to subvert one of the value props of Chrome devices—support for mobile work styles.

Your evaluation of Chrome devices should include an

assessment of user segments to determine where they do their work. Most enterprises have a wireless broadband network in place on premises, but coverage is not yet ubiquitous when users are away from their primary work location. Public

hotspots and residential wireless Internet access can be unpredictable, which can impede productivity. And anyone who has traveled and had to rely on hotel wireless networks has felt the frustration of being stymied by a slow or unreliable connection. Also, bandwidth limitations or the absence of wireless networking service can be troublesome when users are working away from the corporate desk.

Are You Ready for a Cloud-First Model?

When you deploy Chrome devices, you subscribe to a different computing paradigm than the one with which enterprise computing evolved. While your users, IT staff, and workflows probably intersect with the cloud at several points today, the Chrome device model relies more heavily on the cloud. This cloud dependency could have policy implications in addition to a practical impact on users’ daily workflows.

• Consider data storage policies: As with any initiatives in your organization that use cloud-based services, you will want to consider the policy implications of the Chrome device computing model. Users (and IT administrators, through management settings) can choose to store data on the device, but by default, all user-generated content is stored in the Google cloud and associated with users’ accounts. If Chrome devices in your targeted user segments will handle sensitive data, such as intellectual property or personally identifiable information (PII), then you should consider what corporate policy and regulations have to say about cloud storage. If your enterprise works in a regulated industry, make sure you investigate whether Google’s cloud storage complies with the applicable regulations.

• Consider practical impact on user workflows: The cloud-centric Chrome device model will entail adjustments in the way users do their jobs. It introduces new software, which users access differently, and requires changes in the way users create and share content. For example, knowledge workers within an organization—your enterprise’s customer service reps, for instance—could

rely on a shared folder in Google Drive™ to collaborate on documents. They would not then have to email a document back and forth for review. However, this collaboration model might not work quite as well with colleagues in other organizations who are not committed to Google Apps for Business.

The Chrome device model entails important changes for you and your team as IT professionals, too. Your budget might need to account for the subscription-based licensing structure of Google Apps for Business.5 _{And your team will need to learn} a new cloud-based management console to manage Chrome devices, if you plan to manage them centrally. This paper covers manageability in the Manageability Considerations section.

Other Important Topics to Consider

If your targeted user segments meet the qualifying requirements for Chrome device deployment (readiness to engage with the Google ecosystem, dependence on broadband for complete functionality, and readiness for a cloud-first model), then you are ready to tackle the additional important topics:

• Manageability considerations • Security considerations

• Suitability of your users, software, and use cases to the Chrome devices model

Manageability Considerations

One reason Chrome devices appeal to enterprise IT professionals is that the cloud-based devices can help administrators get out of the hardware-maintenance business. There is no OS image to maintain, and devices can be up and running with less configuration than that required by traditional computers. However, because it is unlikely that you will deploy Chrome devices to all of your user segments, adding Chrome devices means adding another OS to your multi-OS environment, not simplifying that environment down to one. Rather than consolidating all device management into the elusive “single pane of glass,” you will need to add

a management console. Because Chrome devices will probably not replace all conventional PCs, and laptops in most organizations, you will need to manage Chrome devices alongside your current desktop infrastructure. This means you will continue to administer conventional directory services user accounts in addition to Google user accounts, albeit with different tools.6

Overview of Chrome Device Management

Chrome devices are managed by the Chromebook management console, a hosted cloud service that administrators can access from a browser. The console provides a single location from which administrators can configure Chrome features for users, set up Chrome device access to VPNs and Wi-Fi® _{networks, track Chrome device} shipments, pre-install Chrome apps and extensions, and complete other tasks. Enterprises must purchase a per-device management license, which could be up to $150 per device.7 Administrators must associate each Chrome device with a user account in the console before anyone (including administrators) logs on to that device for the first time. If this pre-association does not occur, the device must be wiped completely before it can be enrolled for centralized management through the console. And devices can only be physically wiped (either by a user or an administrator): lost or stolen devices cannot be wiped remotely. The potential risk from the lack of remote wipe capability is mitigated, however, because important data is probably stored in the cloud and any local data on the device is encrypted (see further explanation in the Security Considerations section).

Chrome devices require little ongoing software maintenance. Google pushes OS updates that are installed automatically without user or administrator intervention. Any available updates to apps or extensions are also automatically applied when a user launches the app or extension. Apps, extensions, and user settings are associated with a user’s Google account and pulled down to the device when the user logs on. This

approach gives IT administrators some control over devices and their use. For example, administrators can use the management console to control which apps and extensions users can install from the Chrome web store.

Security Considerations

You have already begun to think about security with Chrome devices because you had to consider corporate policy and regulations surrounding data storage in the cloud. Now we’ll consider security on the Chrome device itself and on Google’s servers.

Chrome devices help protect data and guard against malware and identity theft with a layered approach, starting with automatic OS and app updates as you saw in the

Manageability Considerations section of this paper. Out-of-date software is a favorite avenue of attack by malware and hackers, so these automatic updates help protect data and users. Other security layers include the following:

• Installation prohibited: Chrome OS does not allow installation of software except through the Chrome Web Store or Google Apps Marketplace. While this might annoy users, it is also effective protection against malicious executables embedded in web pages and email attachments. Administrators have additional control through the admin console, where they can specify apps and extensions to allow, block, or preinstall on managed devices.

• Verified boot: Critical firmware is stored in a trusted platform module (TPM), which provides a more secure, encrypted space to store sensitive data such as cryptographic keys. When the device boots up, these keys are used to help ensure that OS code has not been tampered with. If an anomaly is detected, the device automatically enters recovery mode, and a new version of the OS is applied.

• Sandboxing: Each app and web page on a Chrome device runs in an isolated environment that works to prevent malicious code from affecting the OS, other apps, or other tabs open in the browser.

• Encryption: Any data stored on the device (such as downloads or browser and session data) are encrypted with keys stored in the tamper-resistant TPM.

Data and documents in the cloud are also protected by multiple layers of security, including Google’s physical facilities security. Other layers of protection include the following:

• Google servers run a custom OS and file system on custom hardware, making them less subject to compromise than off-the-shelf servers.

• Administrators can choose to require that users log on to Google services through HTTPS encrypted sessions, or with two-factor authentication.

• Secure Sockets Layer/Transport Layer Security (SSL/TLS) connectivity is available for all Google Apps customers and is enabled by default for new customers.

• Users’ data and downloaded files on their devices are segregated from other users’ data and encrypted with keys stored in their Chrome devices’ tamper-resistant TPMs. If a Chromebook were stolen and its disk removed, the thief would still need that user’s encryption keys to read it.

Is Enterprise Data Private?

Enterprises sometimes ask about the privacy of data stored in Google’s cloud. Does Google mine business subscribers’ data to generate ads the way it does with consumer data? How and when does Google scan corporate data belonging to subscribers?

Google is on record stating that “Enterprise customers using Google Apps™ _{for government, Google Apps for Business}™_, or Google Apps for Education™ have individual contracts that define how we handle and store their data.”8

Make sure you understand how that contract relates to Google’s privacy policy to know how your data might be read and used. Read the privacy policy at http://www.google.com/ policies/privacy/.

User documents and files that are encrypted locally and then stored in Google’s cloud are stored encrypted in the cloud.

• A spam blocker and built-in virus scanning are integrated into Google Apps.

This layered approach to security might increase your peace of mind. It also helps explain why Chrome devices are currently not subject to many of the security woes that cause problems on Windows and Android™ _{devices. Even so, some} enterprise organizations might want to add further protections to these security layers to address unique security needs and compliance requirements. These additions could add to the cost and management burden of a Chrome devices solution.

Chrome Device Suitability in Your

Application Landscape

If Chrome devices still look like viable options for your enterprise after considering manageability and security issues, the final area to assess is use case and application suitability. Do Chrome devices make sense in your

organization’s unique application landscape?

This portion of the evaluation entails identifying user segments for whom Chrome devices are not good fits, and those for whom they are a possibility. Some examples of each are shown in Table 3.

Some of the possible user groups in the left column of Table 3 require additional caveats. For example, users who create basic documents with office productivity software: if those users rely on advanced functions, such as pivot tables in spreadsheets or mail merging features of a word processor, Chrome devices might not meet their needs. Additionally, a rollout to healthcare workers might require additional policies, training, and software to help ensure PII is handled and stored properly.

When you have identified which of your user segments are possible candidates for a Chrome device rollout, look at the applications the users need to do their jobs. You can enable these users by doing one of the following:

• Migrate those applications to run on Chrome OS • Rebuild the applications for Chrome OS or as web apps

• Employees who are currently served by thin clients or web-based applications

• Fixed-function workers such as call center employees, reservation agents, and customer service reps

• Knowledge workers who create basic documents with office productivity apps

• Employees who work in multiple branch office locations • Customer or employee kiosks

• Branch office deployments where a shared device is used to access web-based corporate apps and data

Chrome devices are less well suited for…

Google Chrome

devices might

work well for…

• Designers and engineers who use compute-intensive software such as AutoCAD® _{or 3-D simulation software}

• Graphics artists who use Adobe® _{Creative Suite}® _or

work with video and audio

• Spreadsheet users who rely on advanced functionality not yet available in Google™ _Sheets

• Departments that use custom or legacy software for Windows®

• Enterprises with a large presence in China** • Departments or businesses that rely on

Microsoft® _Lync® _{for collaboration}

**Chrome devices are not sold in China, and the Chinese government restricts (either blocks, filters, or throttles) Google services upon which device functionality depends.

• Find suitable replacements in the Chrome Web Store or Google Apps Marketplace

• Rely on web-based functionality that does not require Java, ActiveX, or Silverlight

• Deploy a virtualization solution that presents a Windows session through the Chrome browser

As an example, think about your critical enterprise software, such as human resources (HR), enterprise resource planning (ERP), and customer relationship management (CRM) systems. Many of these core programs are legacy residents in enterprise data centers and are built on a traditional multi-tier, client-server architecture. Popular business software such as Oracle® database management programs and SAP® _{Business Suite are} examples. Newer programs, such as Sales Cloud® _{(CRM) by} Salesforce.com®_{, are strictly cloud-based with nothing to install.} If your target user segments use legacy programs built on the client-server model, migration could be a large undertaking unless your deployment, vendor, and licensing agreement support web-based functionality.

Another thing to consider is your Windows software, both on user end points and in the backend. Many enterprises have a significant investment in this software that they must continue to leverage. Also think about printing. Do your users print often? Currently, users cannot attach local printers to Chrome devices, nor can they print directly to shared network printers inside the business. Organizations must instead use the Google Cloud Print™ _{service, in which print jobs are transferred}

externally to Google servers and then sent back to internal printers. These internal printers must be compatible with Google Cloud Print or attached to a PC running Windows and a Chrome browser.

If your users collaborate with colleagues outside your organization, this is another thing to consider. Those external colleagues could be committed to PCs running Windows and Microsoft Office, so a switch to Chrome devices and Google Apps could complicate the collaboration work streams. If your enterprise software runs on Windows, you will need to evaluate the cost and risk associated with switching to an environment focused on Google. It is true that Chrome devices can now support access to a virtual Windows desktop through solutions offered by Citrix, VMware, and Ericom. However, if your enterprise needs to build a virtual Windows solution to run on Chrome devices, then perhaps you are trying to force Chrome devices into a use case where they don’t naturally belong.

Summary

Chrome devices are gaining a lot of tech media attention and enjoying some market success. However, as you’ve seen, Chrome devices are not enterprise-wide replacements for all users’ computers. If you add Chrome devices, you are adding another OS, another management console, and a different paradigm to your already-complex environment. Still, Chrome devices could make sense for targeted users and well-defined use cases. Before deploying them broadly, enterprise IT pros should consider their ability to engage with the Google ecosystem, their ability to depend on broadband Internet access, and their readiness to move targeted users to a cloud-first model.

Whether you modify apps for

Google

Chrome OS

or find

suitable replacements, make sure

to include time in your deployment

plans to retrain employees.

The analysis in this document was done by Prowess Consulting and commissioned by Intel.

Results have been simulated and are provided for informational purposes only. Any difference in system hardware or software design or configuration may affect actual performance.

Prowess, the Prowess logo, and SmartDeploy are trademarks of Prowess Consulting, LLC. Copyright © 2014 Prowess Consulting, LLC. All rights reserved.

1 _{Google makes additional claims about potential benefits of deploying Chrome devices. See http://www.google.com/intl/en_us/chrome/business/devices/.} 2 _{CNET. “Chromebook shipments hit 2 million mark in 2013.” April 2014. http://www.cnet.com/news/chromebook-shipments-hit-2-million-mark-in-2013/.}

3 _{The fact that the Chrome browser does not support these technologies could become less of a limitation as HTML 5 replaces older code. Chrome and Chrome devices}

fully support HTML 5.

4 _Microsoft® _{Office 365}™ _{requires a subscription, but these apps have fewer features than natively installed Office.}

5 _{As of date of publication, Google’s published pricing for Google Apps for Business}™ _{is up to $65 per user per year, or up to $120 per user per year for Google Apps for}

Business with Vault. See www.google.com/enterprise/apps/business/pricing.html. This pricing does not include per-device management licenses, which are required if you plan to manage Chrome devices centrally.

6 _{Google facilitates this dual management requirement with the Google Apps Directory Sync}™ _{provisioning tool. It provides one-way synchronization of user information residing}

on Lightweight Directory Access Protocol (LDAP)–based directory services like Microsoft® _{Active Directory}® _{Domain Services into Google user accounts.}

7 _{We cannot be completely certain about this price because Google does not publish pricing information for Chrome device management licenses. We spoke with a Google sales}

representative who confirmed that Google does not offer evaluation licenses and does not have a formal volume licensing agreement. The stated price of $150 per device is an estimate based on the data we gathered and one reseller’s listed price. See https://shop.promevo.com/index.php/featured-products/chrome-os-management-software.html.

8 _{Amit Singh, Google Enterprise Vice President. Quoted in Bank Info Security. “Google’s Paying Clients Exempt from Privacy Policy?” January 2012.}