Thin Clients: Will Cost Savings Trump Security?

The New York Times ran an in-depth article recently detailing the impact of thin client technology in the workplace. The story takes a look at the reasons why the idea has had trouble getting off the ground during the last 15 years, and why it's suddenly gaining traction now.

Author Ashlee Vance says many companies opt for thin client solutions to take advantage of better energy efficiency and lower maintenance costs. "Perhaps best of all," says Vance, "the users’ data is stored on the network. If the machine on your desk breaks, you just get another one and connect to the data warehouse, and off you go."

What stood out most to me in his article is the point Vance makes about the security of this emerging technology. He notes that there is a tendency to shy away from thin clients because "people are used to keeping confidential and personal information on their own machines, and many companies see moving away from traditional desktops as a risk. In 2008, only 3.7 million thin clients were shipped, compared with 300 million PCs, according to IDC." Vance says, however, that sales are likely to increase as "companies begin a number of test projects" next year to address these concerns.

Despite the fact that most evidence points to thin clients as a more secure computing solution, let's assume for the moment that IDC's numbers represent an overly-cautious approach in enterprise. If that's the case, I'm curious to know what it would take to convince a company's IT department that thin client technology is a safe option for its computing needs.

For example, most businesses were hesitant to adopt the iPhone the second it became available because of concerns there was no effective way to manage -- or wipe -- stored data in the event the smartphone was lost or stolen. Considering the reluctance of businesses to choose iPhones that have the potential to carry only a small amount of data, I can only imagine how unlikely a company would be to adopt a computer solution capable of carrying far more sensitive information.

On the other hand, since thin client technology can save a company many thousands of dollars in energy costs alone, perhaps businesses might be inclined to take greater security risks all in the name of belt-tightening. While I'm sure most companies wouldn't take chances like that, I wonder about the mom-and-pop businesses that are just squeaking by and need to make the tough decisions. What about the SMBs who have to cut corners somewhere and are forced to choose between health care for its employees or storing confidential customer data on a central -- and potentially less secure -- central server.

What's your take on thin clients? Do you think they are more or less secure than individual workstations? Where would you draw the line at saving money vs. risking data intrusion or loss?

[khess]

Thin client technology is far more secure than traditional desktops. If you have a traditional desktop, put something secret on it, give me 30 minutes and I'll know the secret. Here's how: I don't care if your OS has a password or not; I'll simply remove the hard drive, slave it onto my computer or attach it via a USB cable and in a few minutes, I have access to everything on your computer. Not secure.
The only way to secure a local hard drive is to use an encryption technology like PointSec and some secure erase program for files you want removed completely.

[OlyComputers]

Thin Clients are certainly more secure out of the box but their is a secondary concern: Flash drives.

Vance was right that people want to have confidential files stored locally. It's not so much a matter of the security risk, but the perceived risk by people who aren't familiar with the concepts of network security. So where do you think these people are going to store those files? On flash drives which are much easier to lose or steal.

On the other hand, Flash drives to provide the private storage you lose with a thin client and can be a very useful tool if used properly. When it comes down to it not all positions should have a thin client. Your CEO deserves a dedicated system, your IT manager needs a system that will work if the network goes down, anybody who routinely works with files over 1Gb needs a local hard drive or else you'll lose more in their productivity than you'll save on power.

I do want to point out that Thin clients are not, in any way, practical for a "mom and pop" business. If you only have five computers, switching to 5 new thin clients and one server will be a serious initial cost and barely save you anything on power since you're adding a high energy system. Not to mention the need of a qualified IT person if anything goes wrong. There is a lot more to go wrong in basic use of a thin client, since there are more components between "power up" and "usable system". The best combination of security, performance and usability is full desktops with network storage. I get nervous when I don't have the option of a local log-on, and in any business less than 50-100 computers the network infrastructure and need for an IT staff person negates the financial benefits of the thin client.