Customer Solution Case Study
/ / Airline Reduces Risk of Information Leaks, Increasing Confidence and Growth
(
Microsoft Internal Only – Do Not Distribute Externally
Overview
Country:United States
Industry:Airline
Customer Profile
JetBlue Airways brings “humanity” back to the airlines with unique in-flight comforts and economical pricing. Based out of New York City, the airline serves 23 U.S. cities with a fleet of 47 aircraft.
Business Situation
JetBlue boosts employee morale by sharing company information before it’s released to the general public. But continued growth increased the importance of shielding information from unauthorized eyes.
Solution
Deployed Microsoft® Windows® Rights Management Services for Windows Server™ 2003 and the Microsoft Office System in a 120 user pilot program, adding information protection to its messaging system and document-creation tools.
Benefits
Increases intellectual property protection
Clarifies confidentiality policies
Enforces confidentiality policies
Extends protection to custom programs / “RMSis a system that can help prevent the unintentional sharing of information with external parties.”
Todd Thompson, Vice President of Information Technology, JetBlue Airways
In a fiercely competitive industry, JetBlue Airways maintains an edge by doing things a little differently. Since its founding, JetBlue has been committed to using technology to drive productivity and facilitate communications. The use of electronic communications, however, can increase the risk of information leakage. JetBlue sought to augment its messaging system so that it could easily enforce information-distribution policies for e-mail messages and documents.
JetBlue found the answer during a pilot program of Microsoft® Windows® Rights Management Services (RMS) for Windows Server™ 2003 and the Microsoft Office System. With protection built in at the file level, internal communications are less likely to be read by the wrong people, and executive staff can be confident that electronic communications are guarded, and JetBlue’s intellectual property remains private.
The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS DOCUMENT. © 2004 Microsoft Corporation. All rights reserved. Microsoft Confidential.
Intended for Microsoft Internal Use Only.
Microsoft Internal Only
Situation
Founded in 1999, JetBlue Airways is a newcomer to the highly competitive airline industry. This low-cost carrier has gained a large and loyal clientele, distinguishing it from other budget airlines by providing rare comforts such as leather seats and live satellite TV service throughout its fleet. JetBlue also stands on the cutting edge by employing technology to improve communication and collaboration, empowering employees and boosting their productivity. In an industry that primarily uses technology to benefit customers, JetBlue also extends e-mail and Intranet access to frontline employees including baggage handlers, ticket agents, and flight attendants.
“Communication is not only a critical component to accelerating our growth, but is fundamental to maintaining employee productivity and satisfaction, and boosting their ability to deliver excellent customer service,” explains Todd Thompson, Vice President of Information Technology for JetBlue. “Unfortunately, the underlying reality is that unprotected electronic communications can always be forwarded, printed, or copied, so ensuring confidentiality is nearly impossible.”
A committed user of Microsoft software, JetBlue deployed Microsoft® Exchange Server 2003 for messaging and Microsoft Active Directory® directory services to manage user access to the network. While security measures were in place to prevent external parties from accessing its system, no reliable means existed to help prevent electronic confidential information from being viewed by unauthorized recipients. Finding a way to close this gap was critical for JetBlue not only to maintain its growth and expansion but also to avoid unintentional sharing of intellectual property, which could blunt the company’s competitive edge. Executive staff needed a high level of confidence that tools used to distribute electronic communications would help prevent critical information from being accessed by people beyond company walls.
To accomplish all of this, JetBlue planned to strengthen information security with a solution that would enable a more distinct way to highlight company policy for its employees. The ideal solution would prevent inadvertent leaks by enforcing company policies instead of relying on recipients to understand and comply with the policies. The solution should be easy-to-use, so that, out-of-the-box, it would help to prevent e-mails and documents—such as financial reports, product specifications, and customer data—from being copied, forwarded, or printed without express permission.
“For JetBlue to stay competitive and continue to be successful, it’s imperative that we better control the flow of confidential information within the company without suspending communications among our employees,” explains Thompson. “It boils down to one, simple fact: JetBlue has to have a secure internal e-mail system and a means to link usage rights directly to documents.”
Solution
JetBlue required an enhanced information-protection solution that would mesh seamlessly with its existing infrastructure, could scale quickly to accommodate growth, and would permit employees to continue using familiar tools. Windows RMS for Windows Server 2003—an information protection technology that works with RMS-enabled applications to help safeguard digital information from unauthorized use, both online and offline, inside and outside the firewall—provided an intriguing solution to the problem. By combining Windows authentication with persistent usage policies, RMS provides protection for the distribution and usage of information, such as intranet content, documents, or e-mail messages. With RMS-enabled applications, such as Microsoft Office Outlook® Professional 2003 and Microsoft Office Word Professional 2003, JetBlue employees can continue using a familiar tool set.
“Leveraging our IT infrastructure is important to JetBlue, and RMS can help us support this initiative,” says Dennis Crumbine, Director of Application Development and Project Management for JetBlue. A seamless integration and functionality that extends to custom applications makes RMS a perfect fit. And a simple deployment is the icing on the cake.”
Deploying RMS
In a pilot program, JetBlue rolled out RMS along with Microsoft Office Professional Edition 2003 to more than 120 users—straight out of the box—on a single server cluster running Windows Server 2003 and Microsoft SQL Server™ 2000. Administrators configured the RMS server to communicate with JetBlue’s server that is running Active Directory directory service and confirm whether an e-mail or document recipient is authorized to access the content. Each client computer in an RMS system must have the Windows Rights Management client component installed in order to create and access rights-protected content, and the installation of this component across the pilot program was completed quickly and efficiently by using Microsoft Systems Management Server (SMS) 2003.
“RMScan fit seamlessly into our existing infrastructure, resulting in minimal impact to our users,” says Crumbine. “The deployment during the pilot program was quick and painless, and employees are able to continue using familiar tools that have the added ability to include a solid layer of rights management protection on all confidential communications.”
Creating Rights-Protected Content
During the pilot, JetBlue personnelcreated rights-protected content using Outlook Professional 2003, Word Professional 2003, Microsoft Office PowerPoint® Professional 2003 and Microsoft Office Excel Professional 2003 by assigning usage rights and conditions to a file directly from these RMS-enabled applications. Users simply choose the authorized recipients from a list of the organization’s authorized network users, which are stored in the Active Directory directory services, and then selectthe usage rights that should be applied to the content—for example, read only privileges, or read rights with additional print rights. To speed things up, users also can apply a centralized “Company Confidential” template that already has rights pre-defined. Once usage rights are applied, the RMS-enabled application encrypts the information and the usage rights together. The information and rights remain encrypted during transport, extending rights management protection beyond the reach of the organization’s firewall.
When a recipient opens rights-protected information, a request is sent to the RMS server to validate the recipient’s credentials. Upon validation, a user-specific and machine-specific use license (stating the particular usage rights that are granted to the specific recipient) is issued, and the RMS-enabled application enforces the usage rights. Because the content stays encrypted until the information recipient is validated, if a rights-protected e-mail message or document does reach an unintended recipient who does not have access rights, that person will be unable to open or view the content.
Benefits
RMS can strengthen JetBlue’s information security strategy to a level that lets the company maintain a high degree of secure contact with employees and allows it to continue to leverage technology in ways that are unique to the airline industry. RMS can also help JetBlue sharpen its competitive edge and expand its business with confidence.
“RMS is a system that can help prevent the unintentional sharing of information with external parties,” explains Thompson. “We cansafeguard technical and avionics initiatives and control how we share information with employees, giving us confidence that the tools will not hinder our ability to grow and compete.”
Increases the Protection of Intellectual Property
Today, JetBlue does not have reliable methods to prevent internal communications from being intentionally or unintentionally distributed to the public or competitors. But RMS provides a solution that reduces the risk that electronic confidential information will be shared with an unauthorized party. For example, when JetBlue distributes company-wide e-mail messages that contain vital yet private information, the employee writing the message can apply usage rights to the content. Similarly, employees can apply protection rights to documents such as company manuals which contain highly confidential policies and procedures that help make JetBlue a successful company. With RMS, JetBlue staff can increase the information protection around the invaluable intellectual property within these manuals by setting content expiration dates or requiring several levels of authentication before a recipient is allowed access to the content.
Says Crumbine, “The additional protection provided by RMS can enable JetBlue to share internal information with employees with more assurance so that unauthorized access is minimized. This ability to communicate with employees helps build morale and knowledge, and ultimately facilitates the delivery of excellent customer service.”
Clarifies and Enforces Corporate Confidentiality Policies
As a company expands, it becomes more difficult to rely on individual discretion to keep information private. Electronic communications provide an open forum and, the larger an organization becomes, the greater the risk that employees inadvertently will misinterpret or mishandle confidential information or its prescribed policies. For JetBlue to successfully meet this challenge, it needs a more obvious, systematic approach to protect communications and enforce policies. RMS can help by making it easy to enforce corporate confidential distribution policies because usage rights are embedded at the file level and remain with the information, maintaining its privacy even if the information is, for instance, posted to the Internet for others to access.
JetBlue also can help ensure that the right level of protection is consistently applied to specific documents, such as financial reports or project plans, using centralized rights management templates that are exposed to all RMS-enabled applications, making it easy for JetBlue personnel to protect documents according to company standards.
Flexible Technology Provides Potential for Expansion
Moving forward, JetBlue can use RMS to extend information protection to customized applications that share data, particularly for such crucial applications as the JetBlue Blue Notes, which pilots use to access electronic flight manuals and documents. RMS prepares the way for enhanced security, online collaboration and exchange of, for example, the many legal documents that are required to help run the company.
“JetBlue is in a tough industry, but we’ve achieved success because of the unique approach we’ve taken to running our business,” says Crumbine. “RMS can provide us the added ability to apply a higher-level of security to all communications, and we won’t have to compromise how we work.”
Windows Server 2003
Microsoft® Windows ServerTM 2003
The Microsoft Windows Server 2003 family helps organizations do more with less. Now you can: Run your IT infrastructure more efficiently; Build better applications faster; Deliver the best infrastructure for enhancing user productivity. And you can do all this faster, more securely, and at lower cost. For more information about Windows Server 2003, please visit: