Late last year when Google introduced the first Chrome OS notebook, the Cr-48, it offered developers, journalists, and curious fans the chance to beta test the browser-as-operating system as part of the company’s pilot program. Before the big announcement, Google also approached a select group of companies, offering them a fleet of Cr-48s to test for enterprise readiness. American Airlines, Cardinal Health, Intercontinental Hotel Group, Kraft, Logitech, and Virgin America are a few of the corporations taking part in this experiment to discover the benefits (and limits) of cloud computing.
Google touts the core elements of Chrome OS—apps and data in the cloud, little local data storage, automatic updates, multi-layered security—as a revolution in computing for both consumers and businesses. However, these same elements are cause for concern for both groups, particularly when it comes to security and administration.
So is Chrome OS a smart move for your business or should you pass?
Early Interest and Benefits
Chrome OS is best suited for companies that have already taken steps toward entrusting important data and apps to the cloud. When Google approached Virgin America Airlines about participating, the two companies had already partnered on some initiatives—including in-flight wireless—and Virgin had recently switched its corporate e-mail over to Gmail.
“Based on everything we heard about the Chromebook, this seemed like a really great fit,” a Virgin America spokesperson told us. Most of the airlines’ more than 1,700 employees (called teammates) are, naturally, very mobile. So rolling out Chrome-based netbooks “made a lot of sense” to the brass. “This test is great because it will allow us to see how [cloud computing is] going to work down the road.”
Having every employee on the same platform is a huge benefit, and the notebook’s design is an advantage, too. The airline cited the Cr-48’s light weight as a plus, as employees have to carry so much from port to port. And as of the end of 2010, Virgin was actively working toward moving everyone’s data into the cloud. “There are a lot of advantages for the company. It will be an interesting test,” said the spokesperson.
On the Cr-48 pilot program page, Google lays out five reasons why Chrome OS is right for businesses: great user experience, built-in security, easy administration, low cost of ownership, and integration with Google apps. Of these reasons, administration and security offer the greatest challenges and raise the most skepticism.
Security Promises and Concerns
There are multiple layers of security to consider with Chrome OS notebooks, starting with the hardware itself. Since the notebook is a browser portal to a world of web apps and requires users to log into their Google Apps accounts, the risk of compromised data due to loss or theft is minimal. Because everything is stored in the cloud, users won’t lose key data or documents.
Additionally, Chrome OS notebooks encrypt the small amount of data locally cached on the device. Google even claims that the hardware is “tamper-resistant.” Groupon, who recently joined the pilot program, specifically wanted to try the OS because it exposes their field agents to fewer security threats or danger of data loss, according to Google.
Another layer of security comes from within the Chrome software. The operating system automatically checks for updates each time it boots, applying security patches as necessary. Google claims that users will be protected from malware and other harmful scripts. Even if harmful code does sneak through, the Chrome OS’ Verified Boot process will identify it and repair itself without requiring the user to lift a finger.
Add these benefits to the synchronous backup system already in place for Google Apps for Business, which protects you from losing data due to the failure of one server or server farm, and it’s apparent that Google is taking security very seriously.
As for the cloud in general, Rajen Sheth, Group Product Manager of Chrome OS for Business, feels that "we’re at a point today where the cloud is actually safer than the typical desktop machine."
However, what’s not clear is how secure your data is within Google’s walls. Danny O’Brien, Internet advocacy coordinator for the Committee to Protect Journalists, points out that Google doesn’t encrypt user data on its servers. Sheth countered that this is to preserve speed and functionality. Instead, data is encrypted in transit. And while on its servers Google spreads data across multiple servers and utilizes uses data obfuscation and random file names.
Additionally, Google Apps data is secured under the SAS-70 auditing industry standard and certified under the Federal Information Security Management Act of 2002 (FISMA). Theoretically, this means your data is safe from prying eyes—even from other companies whose data resides on the same server as yours. But that’s not the only way it might be compromised.
Last year, one of Google’s engineers was fired for abusing his administrator privileges after he accessed confidential user data in order to harass several individuals. This was only the second time an employee has been fired for such an offense in Google’s history. And Sheth maintains that data stored on the company's servers is safer than in-house systems. The potential for abuse is always there when companies trust their data to third parties, but Google's safeguards are robust. Even the ultra security-conscious US Army Intelligence department has signed on for the pilot program.
Another potential threat comes from web apps outside of Google's system. As Chrome is a browser, users will be able to take advantage of a wider world of apps from the Chrome App Store or elsewhere online. Though there are base security measures in place when it comes to how the code interacts with the browser and your notebook, the issue of data security on remote servers still looms. And, in these cases, Google doesn’t have any accountability. Sheth pointed out that IT admins can block apps or extensions and use Chrome OS with existing firewalls and proxies. But this doesn't address the core issue of cloud safety.
There are also murky legal matters to consider. GNU founder and free software advocate Richard Stallman warned last year that data stored on third-party servers is easier for law enforcement to seize than data stored on-site or on a personal computer. While Google has a relatively strong privacy track record, it's still an area of concern.
No IT Required?
Chrome OS' automatic updates will not only push security fixes to notebooks, but also new features and updates. Google touts this as a time- and resource-saving measure. No longer will IT managers need to manually upgrade software, and companies can save on license fees. However, administrators might not welcome update cycles they can’t control.
Neil Clarke, technology director at Far Hills Country Day School in Far Hills, New Jersey, pointed out that upgrades sometimes result in a loss of productivity if there’s a change in the user interface or new features are introduced. Whenever users have to relearn how to use once-familiar programs, there is the potential for confusion and increased calls to the IT department. “Would I want a major upgrade to come through in the middle of the school year? Absolutely not,” Clarke said.
In the past year, Google pushed 25 updates to the Chrome browser that improved security and stability, and a few over the short lifetime of the browser that tweaked the user interface but haven't introduced drastic, disruptive changes. This may always be the case for the browser and OS, but what about the web apps owners use? Google's Sheth told us that, in 2010, Gmail added 30 new features while maintaining 99.984 percent uptime. Customers don't have to use all of those features, but some they can't turn off or make disappear, either.
Sometimes older software is maintained because it’s preferred, not because the IT department doesn’t have the time, resources, or money to upgrade. With web apps, companies lose the ability to retain the software versions they know will work best for their employees. Consider popular consumer products, such as Facebook; each time the social network updates some aspect of its design, there’s an outcry from at least some users. Once the new design is in place, there’s no going back to the old one, even if the new design makes the service less user-friendly.
Had Microsoft Office been a web app back in 2007, business users would have been forced to upgrade to the radically new interface—perhaps without any warning or training. Having to learn an entirely new way to interact with Office without any way to go back to the older version would not have been an ideal situation for employees or their employers.
Google does acknowledge that some administrators would like more control, so Chrome now offers full management controls. "IT administrators can easily configure and customize their Chrome deployment to meet their business security and policy requirements, and push updates when ready," Sheth told us in a statement. This only offers control over the browser and OS, not web apps, but is a good step toward ensuring that any changes that go through on the Chromebook side are at least approved and prepared for.
Working in The Cloud
Google is banking on the cloud computing trend to drive Chrome OS’ adoption in the enterprise area. However, Stephen Baker, vice president of industry analysis for the NPD Group, points out that the cloud consumers use isn’t necessarily the same as the one for business. “[The services businesses use] aren’t really in the cloud. They’re proprietary to those specific companies, typically.” For instance, if a corporation uses Salesforce to create and manage a web app, it maintains a level of control consumers don’t have. The same can’t be said for Google apps such as Docs or Gmail.
In defense of Chrome OS, Sheth noted that there's no restriction to Google services even though users need a Google login. Any web app accessible from a normal browser -- even those that reside on local servers -- is accessible from the OS, so companies can maintain their proprietary cloud apps while getting the benefit of a Chromebook.
The issue of connectivity is thornier. Chrome OS notebooks are expected to ship with both Wi-Fi and integrated mobile broadband, but there are still areas where wireless connectivity simply isn’t available. Google's stance is that "the moments when most of us are offline are increasingly rare," and for those times when users aren't connected, the OS supports HTML5's offline functionality. This would allow a web app to save a copy of itself and the data you need temporarily to the browser cache so that it functions just as if you were online.
Not all web apps utilize this capability, though it's available to developers right now. Even when this caching is available, it's not always automatic. Users need to give permission or make a conscious choice in some cases. What if you don't anticipate needing an app or file before going offline and you can’t access them once you’re out of range? During our early testing of the Cr-48 and in the subsequent months, we haven't encountered many apps that had offline functionality.
Corporations in major urban areas with excellent 3G or 4G coverage (and whose employees don’t often travel off the edge of the wireless map) may be willing to take the Chrome OS plunge. However, some companies may choose to wait until faster 4G networks become more widespread.
Outlook
As the Chrome OS pilot program continues and real notebooks running Google's software gear up for their entry into the market, it's safe to assume that this platform has a lot to prove. “At first blush, [Chrome OS is] probably not going to have a huge business impact,” said NPD's Baker. “For the foreseeable future, it’s an early adopter, cutting-edge kind of product.” Another potential obstacle is the success of Google's separate Android OS, which is finding its way into all sorts of tablets, including models with built-in keyboards.
For now, companies that want to dip a toe into the cloud computing waters may want to deploy the Chrome browser on Windows-based machines—which has all the same features as the OS. This is a safer choice for nervous IT managers, and it allows them to explore Chrome’s benefits while bypassing the operating system’s limitations. However, if Google can address some of the concerns business customers have about security, manageability, and offline capability, Chrome OS could turn some of those pilot program partners into full-fledged customers.
