A Fine Line
If “time is money,” no one knows this better than Movado. The premier watchmaking company, based in Switzerland and Paramus, N.J., designs, manufactures and distributes some of the world’s most recognized brands including Ebel, Coach, Hugo Boss, Juicy Couture, Lacoste and Tommy Hilfiger.
The company has distribution offices around the world and a workforce of more than 1,100 desktop and laptop users, running an average of more than 30 applications. The company has always focused on best practices to proactively protect the entire organization, but the number of applications and employees’ ability to access them were creating problems.
Specifically, Movado’s IT help desk was being inundated 24 hours a day with support calls for everything from spyware and popups that impacted computer performance to installing new printers. Even simple issues were impacting productivity, when employees had to wait for an on-site visit from IT personnel to fix a problem.
The solution was privilege management software from Viewfinity that enabled the company to control and streamline its systems and eliminate “nuisance” calls to the help desk.
Stuck in the middle
“We were seeing the same issues as other companies who give employees full system access to their own PCs,” says Steve Welgoss, Movado project manager. “When people are all local administrators, it becomes a Catch-22. They needed the ability to be self-reliant on some issues like printer installations or Java updates. But by giving them widespread administrative rights, end users would install the Google toolbar and other troublesome applications and add-ons if IT wasn’t watching.”
Basically, there weren’t enough people on the help desk to take care of everyone’s problems immediately. “We also had licensing concerns if people were adding personal software to a business machine,” Welgoss says. “We started seeing more viruses, adware and spyware on people’s computers. We were fighting fires daily.”
Director of technology services Ken Borthwick, the person responsible for Movado’s overall computing environment, agrees that total admin access for everyone was a problem. The immediate solution was to start taking total access away from many desktop users. But laptop users still had full control, and this became a security issue.
“The majority of the Microsoft security patches that came out on a monthly basis were only applicable if the user had admin rights on their machine,” Borthwick says. “We were kind of caught in the middle. We needed certain people to have those rights but there were a lot of issues. …We had standards and everyone was protected by anti-virus software that was updated regularly, but there were no restrictions.”
Employees would report that “their machines were running slowly,” Welgoss says. “Invariably, it was some sort of spyware or adware issue. We didn’t need to run an ROI report to see what was going on. There were just a lot of self-inflicted wounds.”
But removing total access was something of an exercise in futility. “We’d have to go back and reinstall them as needed, but the ‘as needed’ list was a lengthy one,” Welgoss says. “Too many programs required admin access in order to run. We ended up turning them back on for so many people that calls to the help desk went up again.”
It was at this point that Movado began looking at several outside solutions. “We investigated Microsoft’s group policy controls that would grant people access to things they needed, while removing them from the administrators group. But too many changes had to be made and the group policy is sometimes a challenge for remote users connecting over low speeds. It would have been a lot of effort to get that to work right.”
The partnership with Viewfinity literally started through an online search, Welgoss recalls. “The ‘def con’ level was rising in terms of our problems: We couldn’t sit back and wait for the next software conference to talk to vendors. So we went out pounding the pavement for solutions.”
Every potential solution they found, however, was client-based. Viewfinity was the first one with a cloud-based solution that could meet Movado’s needs.
“We began implementing it early in 2011 and started with a 60-day pilot,” Borthwick says. “After that, we dedicated a person to the Viewfinity project and ran the product in listen mode for another 60 days in order to monitor what our people were doing and to see if the system recognized when privilege elevation was needed.”
The benefits are more anecdotal than based on hard stats, “but calls to IT pretty much dried up for base issues,” Welgoss says. “We didn’t have to run out to people’s desks to do things like install drivers.”
This resulted in a significant increase in productivity. “When people can control things they already know how to do on their home computer, such as installing a new printer, they don’t need you to do it for them,” he says. “Furthermore, they don’t want to call the help desk and get in a queue when it’s something they can do themselves in 90 seconds.”
Borthwick estimates that there was an immediate 20 percent reduction in calls related to that type of basic issue, which he and Welgoss agree was driven by the Viewfinity implementation.
Asked whether that figure could improve further, Welgoss says, “It depends on what type of software we use in the future. But it’s certainly not going to drop back. As we go to the cloud, and based on our reporting needs, some software might require local admin access. If that’s the case, Viewfinity can elevate privileges for some employees on an as-needed basis. We won’t have to open their computer fully every time we want to install a new piece of software.”
Borthwick also notes that some of the benefits of the new system are security-related. He couldn’t quantify it, “But we have a level of comfort now. We’re confident that our system is not exploitable due to the combination of anti-virus protection and the lack of privilege elevation.”
And with more employees traveling or working from home, Movado needs the ability to support a mobile workforce. “It’s increasingly important to make changes on the fly,” Welgoss says, “and that’s what Viewfinity enables us to do.”