EDITOR’S NOTE MANAGING APPS AND CONTENT IS KEY TO MOBILITY
BYOD BRINGS USER CONTROL, MANAGEMENT CHALLENGES
Juggling BYOD Benefits and Burdens of Management in the EnterpriseSmartphones and tablets provide IT new ways to deliver access to corporate systems and increase productivity. But evolving BYOD policies, the shift from managing devices to managing apps and data, and ongoing security concerns still challenge admins.
HOME
EDITOR’S NOTE
MANAGING APPS
AND CONTENT IS KEY
TO MOBILITY
BYOD BRINGS
USER CONTROL,
MANAGEMENT
CHALLENGES
JUGGLING MANAGEMENT AND BENEFITS OF BYOD IN THE ENTERPRISE 2
EDITOR’SNOTE
Evolving Endpoints Require Agility as Well as Scrutiny
Shortly after users began bringing smartphones and tablets into the enterprise, they began looking for ways to use them for work. IT administrators have learned to balance expectations for increased productivity and savings from employee-owned mobile devices with the attendant management and security headaches.
As reporter Jake O’Donnell explains in this handbook’s feature article, vendors and IT are starting to shift their focus to control of applications and content rather than chasing
numerous devices. Bring your own device (BYOD) policies are now joined and enforced by new mobility management technologies.
Consultant Dan Sullivan takes a close look at BYOD challenges, including setting usage policies, enforcing them and staying nimble as endpoint management continues to evolve. n
Eugene DemaitreAssociate Managing Editor
Data Center and Virtualization Group TechTarget
HOME
EDITOR’S NOTE
MANAGING APPS
AND CONTENT IS KEY
TO MOBILITY
BYOD BRINGS
USER CONTROL,
MANAGEMENT
CHALLENGES
JUGGLING MANAGEMENT AND BENEFITS OF BYOD IN THE ENTERPRISE 3
MANAGING MOBILITY
Managing Apps and Content Is Key to Mobility
In a few short years, tablets and smartphones went from being consumer-focused products to altering the enterprise landscape in a funda-mental way. Modern workers demand the abil-ity to work whenever and wherever they can, and mobility has made it all the easier.
With the rise of consumer devices in the workplace comes a whole new set of challenges for IT. Who should be allowed to access cor-porate data on a mobile device, and on which devices? What data should be accessed, and how is it accessed?
IT gained a better understanding of man-aging devices once the devices started their major influx into the enterprise, especially in the bring your own device (BYOD) model. While challenges still remain, the prevalence of devices has moved mobility from a specialized part of conducting business to a business-as-usual process that’s one and the same with an organization’s overall mission.
For years, BlackBerry was king of enter-prise mobility, offering IT control through the BlackBerry Enterprise Server (now Black-Berry Enterprise Service). But devices running Apple’s iOS, Google’s Android and Microsoft’s Windows Phone operating systems didn’t have those management capabilities at first.
The problems presented by the flow of mobile devices into the market spawned a whole new set of technologies to tackle secu-rity and compliance concerns. Mobile device management (MDM) was a start, but it has taken a backseat to a more pronounced, holis-tic approach to mobility marked by enterprise mobility management (EMM).
EMM gives IT many more controls than just over the device. The basic components of an EMM platform include management of devices, applications and content as well as collabora-tion and user profiles. Some EMM systems include their own email and browser clients as
HOME
EDITOR’S NOTE
MANAGING APPS
AND CONTENT IS KEY
TO MOBILITY
BYOD BRINGS
USER CONTROL,
MANAGEMENT
CHALLENGES
JUGGLING MANAGEMENT AND BENEFITS OF BYOD IN THE ENTERPRISE 4
MANAGING MOBILITY
well as application development capabilities. Over the past year or so, the EMM market
has seen a great deal of change and consolida-tion as technology vendors see a clearer shift to mobility in enterprise. Large vendors, including IBM, Citrix, Oracle and VMware, have closed significant acquisitions of EMM startups to complete their mobility portfolios. Others, like Microsoft, Dell, Samsung and CA Technolo-gies, have developed their own EMM products.
A dwindling number of independent compa-nies still specialize in EMM, with Good Tech-nology and MobileIron the undisputed leaders. There has been speculation that both com-panies, and any remaining independent EMM vendors, will be bought this year.
SEEKING SECURITY IN A MOBILE WORLD
Enterprises can only do so much to lock down devices. There’s a constant threat of jailbreak-ing, and devices are inevitably stolen or lost. Increasingly, the focus is shifting from manag-ing devices to managing the data and the appli-cations accessed on those devices.
When it comes to managing data, enterprises
have a number of options. Containerization (or sandboxing) allows users to separate personal data from corporate data in a BYOD setting. For example, a container for an email client keeps the user’s enterprise email separate from per-sonal email.
Dual persona takes a similar approach, with IT provisioning a work profile and a personal profile on a device. When an employee leaves an organization, IT can wipe the data within the work profile on the dual-persona device.
Mobile application management (MAM) allows IT to control access and data inside applications that run on company-controlled mobile devices. As enterprises learn more about how mobility can speed up business processes and make workers more productive, unlocking the capabilities of mobile applica-tions and the means needed to manage those applications becomes key.
Mobile apps can’t simply be legacy desktop applications regurgitated into a mobile form factor. They must be tailored to meet the needs of mobile workers and be compatible with dif-ferent devices and operating systems.
One approach IT shops have taken around
HOME
EDITOR’S NOTE
MANAGING APPS
AND CONTENT IS KEY
TO MOBILITY
BYOD BRINGS
USER CONTROL,
MANAGEMENT
CHALLENGES
JUGGLING MANAGEMENT AND BENEFITS OF BYOD IN THE ENTERPRISE 5
MANAGING MOBILITY
mobile app development is mobile backend as a service, where IT uses application program-ming interfaces and software developer’s kits to tie mobile applications with cloud computing services.
Mobile content management (MCM) is an active market in which IT buyers have many options. Organizations can use more con-sumer-based products such as Dropbox and Google Drive, and there are also more enter-prise-grade platforms like those from Box, Acronis, Accelion, Soonr and WatchDox.
In addition, vendors are offering MCM and secure file transfer through EMM systems such as Citrix’s ShareFile and AirWatch’s Secure Content Locker.
Despite years of refinement and practice, BYOD still manages to be an enigma to many businesses. How an IT shop approaches BYOD varies depending on the business. Some adopt a full BYOD slate for their devices, while oth-ers, many of which are in regulated industries, don’t allow those kinds of freedoms.
An alternative method to BYOD calls for
corporate-owned, personally enabled (COPE) devices. With COPE, an organization gives end users a choice of devices that can be managed and operated as if they were BYOD devices. This approach can be more cost-effective than BYOD because enterprises can purchase devices directly from OEMs at bulk discounts.
BYOD policies can provide guidance for both IT administrators and end users on the best practices for using personal devices in a work setting. Admins must align the needs of the organization with needs of the end users, and striking that balance presents both opportuni-ties and challenges.
Policies can include stipulations such as acceptable use, reimbursement, applications, security and device choice. Having clear, con-cise policies that fully lay out the do’s and don’ts for mobile devices in the enterprise can save headaches for both IT and end users.
Mobility gives end users more control over their productivity. When IT understands the tools at their—and its own—disposal, the enterprise as a whole benefits. —Jake O’Donnell
HOME
EDITOR’S NOTE
MANAGING APPS
AND CONTENT IS KEY
TO MOBILITY
BYOD BRINGS
USER CONTROL,
MANAGEMENT
CHALLENGES
JUGGLING MANAGEMENT AND BENEFITS OF BYOD IN THE ENTERPRISE 6
BYOD CHALLENGES
BYOD Brings User Control, Management Challenges
The combination of easy-to-use applica-tions, ready access to the Internet and large numbers of Web- and cloud-based applications make smartphones and tablets logical choices for many employees. Unlike other elements of IT infrastructure, however, end users have driven the adoption of mobile devices, not cen-tralized IT planning. To compound the chal-lenge, many of the infrastructure management tools that enterprises have were not designed to accommodate mobile devices.
An enterprise that supports mobile devices needs to consider several risks and manage-ment concerns, particularly with bring your own device (BYOD) policies.
n Deployment. In cases where businesses pro-vide mobile devices to employees, IT depart-ments must activate, configure and install applications on each device. Since many of these devices were designed for consumer use,
they may have apps for a single person to con-figure a single device. This is more akin to set-ting up iTunes on an iPad than to an enterprise provisioning application.
At one time, BlackBerry Ltd.’s devices were unusual in their level of enterprise support, but that has changed. Apple, for example, now offers the Apple Configurator for basic iOS device management, while Exchange Active Sync offers some mobile device management (MDM) features for Windows Phones.
If you plan to support a large number of devices, consider using an MDM application, which enables large-scale provisioning, con-figuring and monitoring of mobile devices. Remember that you may need to support mul-tiple mobile device OSes, such as Android, BlackBerry, iOS and Windows.
A mobile device deployment may also require changes to enterprise applications. You may need to update Microsoft Exchange ActiveSync
HOME
EDITOR’S NOTE
MANAGING APPS
AND CONTENT IS KEY
TO MOBILITY
BYOD BRINGS
USER CONTROL,
MANAGEMENT
CHALLENGES
JUGGLING MANAGEMENT AND BENEFITS OF BYOD IN THE ENTERPRISE 7
BYOD CHALLENGES
policies or add an MDM app that works with ActiveSync.
For example, ActiveSync can be used to remotely wipe a device, which resets the device to factory-default settings. Add-on MDM apps can enable selective wiping of data while leav-ing other data intact.
n Application testing. Web applications that work well on desktop computers are not neces-sarily suited for mobile device use. In addition to testing for browser compatibility, you’ll want to evaluate usability on mobile devices’ smaller screens.
Look for new features prompted by mobile devices. Microsoft Office 365, for instance, includes cloud sync so changes on one device are pushed to versions of the document on other devices.
Test the performance of apps over Wi-Fi and cellular networks, which may be signifi-cantly slower. The results from such testing can
help support a decision to revise service-level agreements.
Web applications should be tested on mobile devices to identify which apps can be sup-ported on mobile device browsers and which ones can be better supported using a virtual-ized desktop.
n Security. If a mobile device is lost or stolen, it can result in the loss of private or confidential information. It’s easy to block employees who have been terminated from using enterprise-controlled devices, but what about the data on their smartphones? Security measures you can use include Secure Sockets Layer (SSL) certifi-cates, full-disk encryption, desktop virtualiza-tion and remote wiping of devices.
SSL certificates should be installed on mobile devices when your organization needs to authenticate client devices accessing its appli-cations. In the past, SSL certificates authen-ticated servers so that end users had some
Test Web apps to identify which ones can be supported on mobile device browsers and which can be better supported with virtual desktops.
HOME
EDITOR’S NOTE
MANAGING APPS
AND CONTENT IS KEY
TO MOBILITY
BYOD BRINGS
USER CONTROL,
MANAGEMENT
CHALLENGES
JUGGLING MANAGEMENT AND BENEFITS OF BYOD IN THE ENTERPRISE 8
BYOD CHALLENGES
assurance they were using legitimate websites. Today, it is just as important for businesses to ensure that mobile devices have been authenti-cated to mitigate the risk of access from unau-thorized devices.
Full-disk encryption is another way to reduce the risk of data loss. A potential draw-back is that some mobile apps may not work on fully encrypted devices. This can be especially problematic when employees use their personal devices for business.
Remote wiping can make device data inac-cessible. Employees should understand what remote wiping does to a device and under what circumstances it would be used. As with full-disk encryption, this can become a particularly difficult issue when employee-owned devices are involved.
When evaluating mobile device management applications, consider if they will allow you to perform selective wipes that erase confidential information without the collateral damage of a full device wipe.
Desktop virtualization systems provide access to centrally managed and stored desk-top applications and data. Users can run virtual
desktops on mobile devices without the risks associated with downloading confidential data to these devices or having to install applica-tions locally, except for the virtual desktop client.
ESTABLISHING EMPLOYEE USAGE POLICIES
Allowing employees to use their personal mobile devices for work-related tasks can provide plenty of advantages: less laptop lug-ging, easier connectivity and potentially better interfaces. It can also help a company’s bot-tom line if the company doesn’t have to pay for smartphones, tablets and data plans. But there are risks with bring your own device practices, including security vulnerabilities, support costs and potential legal liabilities. Businesses that allow for BYOD should have well-defined policies and mechanisms to enforce them.
n Defining BYOD policies. The first step in devel-oping a set of BYOD policies is to define the scope of control the business expects to main-tain over employee-owned devices.
At one end of the spectrum, a business could
HOME
EDITOR’S NOTE
MANAGING APPS
AND CONTENT IS KEY
TO MOBILITY
BYOD BRINGS
USER CONTROL,
MANAGEMENT
CHALLENGES
JUGGLING MANAGEMENT AND BENEFITS OF BYOD IN THE ENTERPRISE 9
BYOD CHALLENGES
treat devices as if they were corporate assets in return for allowing employees access to IT resources from their personal devices.
The other extreme is to assume no control over the devices themselves and instead focus on access controls and limiting risks such as leaving corporate data on BYOD devices. The optimal policy may lie somewhere between these two poles.
BYOD policies should address acceptable use of corporate IT resources on mobile devices, minimal security controls on the device, and the need for company-provided components, such as SSL certificates for device authentica-tion. They should also cover rights of the busi-ness to alter the device, such as to remotely wipe a lost or stolen device.
Acceptable-use policies could require the use of a virtual private network when access-ing corporate systems and prohibit the storage of passwords to business applications. Secu-rity controls might also require encryption of stored data, protection of device passwords and registration of devices with an MDM system. Employees should be informed of all BYOD policies and agree to them.
Written policies and employee consent are not enough to protect a company’s informa-tion assets. Even well-intentioned employees can make mistakes, such as forgetting to set a device password or downloading confiden-tial information over an unencrypted session. Mobile device policies should have an enforce-ment mechanism to ensure that they are applied consistently.
n Enforcing BYOD policies. Chances are that some of your company’s existing applications can enforce BYOD policies. But before you try to use these apps, consider two key questions: “Are these applications sufficient to meet all enforcement requirements?” and “How diffi-cult is it to manage mobile devices with these applications?”
Consider the widely used ActiveSync. It pro-vides for policy enforcement, but mobile device manufacturers have not always supported all ActiveSync enforcement mechanisms.
Microsoft has established an ActiveSync logo program to encourage standard criteria for a minimum level of policy enforcement. Quali-fied devices must support automatic discovery,
HOME
EDITOR’S NOTE
MANAGING APPS
AND CONTENT IS KEY
TO MOBILITY
BYOD BRINGS
USER CONTROL,
MANAGEMENT
CHALLENGES
JUGGLING MANAGEMENT AND BENEFITS OF BYOD IN THE ENTERPRISE 10
BYOD CHALLENGES
remote wipe, required password, minimum password length, timeout without user input and a maximum number of failed attempts, among other things. If enforcement mecha-nisms are sufficient and your employees are using supported devices, ActiveSync could address your needs.
Third-party mobile device management applications can support a wide array of policy enforcement operations, including full lifecycle management, app inventory control, data pro-tection, certificate distribution, device configu-ration and lockdown.
Policy enforcement begins with provisioning. MDM apps can help ensure consistent con-figuration of devices, install applications and create accounts on self-service management portals. If your policies limit the apps that can be deployed on a BYOD device, use an MDM system that can detect unauthorized apps.
Most MDM products support remote wiping, but completely wiping a device is drastic and, in many cases, may not be necessary. MDMs can selectively wipe data, allowing admins to delete corporate data while leaving personal data intact.
Your policy may require all devices accessing corporate systems to be registered with your IT department and configured with an SSL certificate for authentication. MDM apps that support certificate distribution can minimize management headaches for this operation. MDM systems can further ease the burden by reporting on expired certificates, revoked certificates and other certificate management concerns.
Finally, look for MDM apps to provide device configuration and lockdown functions. For some users, you may wish to lock down cam-eras, Bluetooth, GPS and Wi-Fi. If you specify an encryption policy, investigate an MDM that can enforce this policy on both fixed storage and Secure Digital cards.
Good BYOD policies share two charac-teristics: They are clearly defined, and they are enforced. BYOD policies should address acceptable use, security controls and the rights of the business to alter the device. Existing enterprise applications, such as Microsoft Exchange ActiveSync and certificate manage-ment systems, may be sufficient for enforc-ing policies. If you require more control over
HOME
EDITOR’S NOTE
MANAGING APPS
AND CONTENT IS KEY
TO MOBILITY
BYOD BRINGS
USER CONTROL,
MANAGEMENT
CHALLENGES
JUGGLING MANAGEMENT AND BENEFITS OF BYOD IN THE ENTERPRISE 11
BYOD CHALLENGES
devices and the ability to generate management reports about BYOD use, an MDM system may be a better option.
NEW MANAGEMENT CHALLENGES
BYOD is a change in the way many enterprises operate. It requires businesses and employ-ees to accommodate one another’s needs and expectations. When this is done well, both par-ties benefit. Let’s look at BYOD in terms of the changing nature of IT control, as well as tips on adopting BYOD policies and practices.
n The changing nature of IT control. A com- mon scenario has been for the business to own the infrastructure, the end-user devices and the applications used for business opera-tions. Today, these same organizations face an emerging management model that must account for more contracted resources, such as public clouds and other service providers, as well as more use of employee-owned devices. The result is a mix of business-owned, busi-ness-contracted and employee-owned devices that requires more consensus on policies and
practices than in the past. At first, it might seem as though businesses
are losing control, but that’s hardly the case. Businesses may have less direct control over devices, but they have not lost control over what matters most: data and applications. Businesses should implement BYOD policies and practices that protect those valued assets.
n Benefits and risks of BYOD. Both employ-ees and businesses can benefit from BYOD. Employees can consolidate hardware, have improved connectivity, and work with more user-friendly and functional interfaces than were available with some corporate applica-tions. Enterprises can benefit from potentially lower hardware and support costs as well as improved employee productivity.
Risks include security breaches, unantici-pated legal liabilities arising from questions of data security and control, and higher support costs. The details of a mobile device imple-mentation will affect these support costs.
n Tips on accommodating BYOD. To minimize potential drawbacks and manage employee
HOME
EDITOR’S NOTE
MANAGING APPS
AND CONTENT IS KEY
TO MOBILITY
BYOD BRINGS
USER CONTROL,
MANAGEMENT
CHALLENGES
JUGGLING MANAGEMENT AND BENEFITS OF BYOD IN THE ENTERPRISE 12
BYOD CHALLENGES
expectations, focus on three tasks prior to widespread BYOD adoption: defining policies, implementing a policy enforcement mecha-nism, and evaluating mobile device apps and enterprise applications that you intend to support.
Define policies that address acceptable use of business applications and assets on mobile devices. You should also specify the minimal security controls and the rights of the business to alter mobile devices, such as remotely wip-ing them if needed.
BYOD and related security policies must be enforced. Existing IT systems may be able to support some levels of compliance.
More comprehensive policy enforcement will likely require a mobile device management system. An MDM should support provisioning,
monitoring, policy enforcement and, if required, some degree of device controls such as disabling Bluetooth.
Evaluate the enterprise applications you expect to support on mobile devices. Identify the minimal requirements, such as screen size, resolution and data transfer speeds.
Also, consider if the Web applications will be delivered to mobile devices through a Web interface or through an app. Software vendors may have apps for their products. In the case of popular enterprise applications, such as Micro-soft SharePoint, third-party software develop-ers may be able to meet your needs.
One way to minimize risks during evaluation is to begin with testing in the IT lab, followed by small pilots. If these tests are successful, you can roll out support incrementally. This approach can reduce the risk of scalability problems affecting a large number of users.
The goal of IT support for BYOD is to inte-grate employee-owned mobile devices into the business in a way that complements the exist-ing IT infrastructure and applications without compromising the security or functionality of corporate resources. —Dan Sullivan
Define BYOD policies, implement a policy enforcement mechanism, and evaluate mobile device apps and enterprise software that you intend to support.
HOME
EDITOR’S NOTE
MANAGING APPS
AND CONTENT IS KEY
TO MOBILITY
BYOD BRINGS
USER CONTROL,
MANAGEMENT
CHALLENGES
JUGGLING MANAGEMENT AND BENEFITS OF BYOD IN THE ENTERPRISE 13
ABOUT THE
AUTHORS
JAKE O’DONNELL covers consumerization, enterprise mobility and BYOD news for SearchConsumerization. Prior to joining TechTarget, Jake was a local news reporter for several newspapers and websites.
DAN SULLIVAN is an author, systems architect and consultant with over 20 years of IT experience with engagements in advanced analytics, systems architecture, database design, enterprise security and business intelligence.
Juggling Management and Benefits of BYOD in the Enterprise is a SearchConsumerization.com e-publication.
Margie Semilof | Editorial Director
Phil Sweeney | Managing Editor
Eugene Demaitre | Associate Managing Editor
Patrick Hammond | Associate Features Editor
Linda Koury | Director of Online Design
Neva Maniscalco | Graphic Designer
Rebecca Kitchens | Publisher [email protected]
TechTarget 275 Grove Street, Newton, MA 02466
www.techtarget.com
© 2014 TechTarget Inc. No part of this publication may be transmitted or re-produced in any form or by any means without written permission from the publisher. TechTarget reprints are available through The YGS Group.
About TechTarget: TechTarget publishes media for information technology professionals. More than 100 focused websites enable quick access to a deep store of news, advice and analysis about the technologies, products and pro-cesses crucial to your job. Our live and virtual events give you direct access to independent expert commentary and advice. At IT Knowledge Exchange, our social community, you can get advice and share solutions with peers and experts.
COVER ART: FOTOLIA
