BYOD: Pick Your Poison, A comparative study of BYOD solutions

Transcription

1 1 BYOD: Pick Your Poison, A comparative study of BYOD solutions Saurabh Nagrecha Abstract The rapid proliferation of personally owned mobile devices in the workplace environment with access to company resources, otherwise known as bring your own device (BYOD), is a policy which has been frowned upon until recent times. Adapting to this trend comes with a lot of challenges, which must be met without compromising business data security. This paper surveys key market solution providers in the BYOD arena and compares the services they provide. I. INTRODUCTION Bring your own device or simply BYOD as a business policy seems to be a radical and innovative move in terms of changing how business environments function. Employee productivity is cited as the number one driving force behind such a trend. Shifting the cost of devices away from the employer is another reason why businesses see this as a viable solution. Popular concerns against it can be broadly classified as those related with data breaches and ancillary concerns regarding provision of a sustainable user experience by the IT department of the business providing BYOD to its employees. The greater objective of a BYOD programme would be to drive employee satisfaction and productivity through the use of technology, while reducing mobile expenses. So, the BYOD trend can be seen as a shift of cost from mobile device costs to providing IT environments for the business to the employees personal devices. The freedom to choose resources, otherwise not made available by their enterprise, is a lucrative selling point. Employees take better care of the devices because of a sense of ownership. Businesses effectively get to use high priced devices for productive purposes. The BYOD idea continues to experience inertia due to pertinent issues like (but not limited to) potential security breaches, liability for repairs on damages, implementation of a company-wide acceptable use policy, provision of IT support. Compliance mandates such as HIPAA, PCI DSS, and GLBA lay down certain requirements related to information security and safeguarding of specific data. BYOD implementations vary according to the specific needs of the target business environment, thus making a generalizations difficult. Certain common traits are exhibited by most solutions and are adapted almost ubiquitously. User devices can access privileged company resources like , file storage, contacts, calendars, and so on. Solutions permeate various levels of device architecture and each has its own advantages. Mobile Device Management (MDM) allows the IT department to have full control of devices. This works out well in case of company provided devices serving strictly as business phones, more like the traditional Blackberries. Imposing this on the personal phones restricts the infringes on the privacy of the users, defeating the purpose of having a personal phone. Much like delineating boundaries between business and personal life, the need for a dynamic user profile environment for work related applications is required. Enter Mobile Application Management (MAM), where this can be done to exercise control over only specific applications, instead of the entire device. IT departments need only control, monitor, secure and maintain specific corporate applications, leaving control and access to other applications solely with the user. The IT departments only need to verify whether the user s personal applications on the devices are compliant with the security guidelines practiced by the department. Work related applications could be procured using an in house app store, with recommendations from the IT department. Such applications could be custom home-brewed or could be made available with an additional layer of security on top of existing applications. Home brewed applications for common tasks face constantly evolving competition from third party providers and hence must be updated

2 2 with minimum lag between the competing products and indigenously developed ones. Another approach is to embrace this and provide for user level authentication in existing applications. For example, personal can be freely accessed from the device, whereas work requires specific authentication. Specific off-the-shelf applications can be wrapped in a layer of security, encryption and control. But this requires the application s original package files, which might not always be possible. II. BYOD AND EXISTING CHALLENGES Potentials for breach of security are viewed as the biggest foe of BYOD and often overshadow other challenges. Implementation of a sustainable BYOD programme requires constant maintenance, support, monitoring, legal clearance, employee awareness, even an in-house development team in certain cases. Besides all the work devices, the IT department is now faced with managing a broad spectrum of user owned devices. This presents them with all of the responsibility, and none of the full fledged freedom they would enjoy with a business-owned device. As BYOD is aimed at the enhancing the end user s experience, IT and app developers are required to churn out latest updates which are BYOD friendly versions of popular apps. Failure to do so may result in employees either circumventing the policy or ending their participation in the BYOD programme. Provision for support on popular platforms is a non-negotiable aspect of providing BYOD. The whole idea behing BYOD is to allow for employees to have freedom over their choice of work device. Of course, baselines have to be established regarding regarding allowable devices. These, in keeping with production cycles of new devices, must be rapidly revised and accomodated for. Employee trust models must be established regarding sensitive data and certain applications. This is a very dynamic idea considering all the compliance conflicts which might arise from the difference between usage patterns of corporate devices as opposed to personal devices. Users tend to download more apps in general on personal devices and hence are prone to the devices running out of compliance sooner. Ownership of data on the device becomes a tiered concept. If users do not respond well to security measures on the device, they would be dissatisfied and this would be unfavorable. Liability of usage is a contentious issue. Companies are required to protect corporate data, but the extent to which this is enforced, is subjective. The definition and employee awareness regarding Acceptable Use Policy of devices is important to ensure justified distribution of liabilities. Usually, corporate liability is seen to decrease when they shift to BYOD. It is limited to protection of corporate data and is not liable for personal activity on the device. Reimbursement of BYOD devices (partial or full), may also entail legal obligation on the user s part. Onsite versus offsite usage liabilities add to an already complex liability model. Delineating what activities are monitored by IT and which are exempt from this is necessitated by the establishing of personal boundaries on an employee owned device. Measures to tackle faulty/compromised devices usually attempt to selectively wipe the corporate data present on the device. A remote lockdown, location tracker, and a clean wipe of the device are additional features which could be implemented. Additional concerns such as internal marketing concerns in order to switch to BYOD, though recognized as challenges in their own right, are beyond the scope of this report. III. TARGET REQUIREMENTS FOR A BYOD SOLUTION A multi-tier set of requirements are assumed for the BYOD solution. These assumptions may not hold for all businesses, but are considered within the scope of this paper to apply to the organization. The definition of mobile device for the purposes of this study only covers smart phones and not tablets or laptop computers. Though many of the conclusions can be extended to tablets and laptops, some specific influential factors may not apply for these devices. Popular approaches to packaging offer Softwareas-a-Service (SaaS) and Virtual Machines (VMs). SaaS is a delivery model in which software and data associated with it are hosten on the cloud. Virtual machines on the other hand run right off the native host device. This is an important decision in terms of tackling circumstances where a device has been misplaced/compromised. SaaS solutions offer a convenient snip-and-forget method for a compromised device. The data always resides on

3 3 the cloud and the cached data on the device is wiped by the deliberate severance of the link. In VM solutions, one utilizes less bandwidth while isolating operations, reducing the load on IT to manage the additional cloud operations required by SaaS. A paranoid usage policy is assumed here in order to make the choice between the two. SaaS requires the user to constantly maintain a secure link with the cloud in order to function. This might not always be available or feasible. VM solutions aren t strongarmed into being dependent on such constrains faced by SaaS. If the communication of a device running a SaaS is intercepted, it results in greater leakage than a VM container. A compromised VM device, having only limited sensitive data minimizes the risk associated with device loss. For example, the device a project member uses is privy to only certain information, whereas that of the project lead would contain more sensitive information on it. In case of loss of the former, less damage would be caused than if the latter s device was to be lost. In addition to these primary features, other desired features are to be considered as well. Reseller theming is assumed to be inconsequential in terms of its effect on user experience. Licensing is required to be recurring so that revised policy changes can be smoothly incorporated. Support that is available 24 7 is a required feature. Locational scalability is a desired trait for any business and the provision of such a trait is viewed as favourable. In terms of fault tolerance, standalone servers are more resilient, and a required trait. Additionally, load balancing and fail over capabilities are viewed as beneficial. Basic mobile configuration features such as passcode requirements, device restrictions, Exchange account seeding are assumed to be satisfied. In terms of ios5 features, one would ideally like to prevent icloud, encrypt and sandbox . On demand features which are managed by IT, like remote wipes, remote locks and passcode removals are considered to be non negotiable. App management environments like an in house app store are a plus, but are not considered to be a huge bonus. Employees are expected to know what they want in terms of business related applications. The ability to export data is required for monitoring purposes and is required for version control and to backtrace any malignant changes. Certificate requirements are another non negotiable feature, considering that sensitive corporate data is on the line. Solutions which cater to the largest spectrum of devices are considered favourably. IV. COMPARISON OF EXISTING SOLUTIONS The following market leaders in terms of BYOD solutions are considered for the comparison survey: Airwatch SmartMan by Dialogs MaaS360 by Fiberlink Good Dynamics IBM Endpoint Solutions Mobile Iron Symantec Zenprise Publicly available data was used in order to make comparisons, the summary of which is spread across Table I and Table II. Missing data has been reported as unknown in both tables. Missing data is not considered to be grounds for elimination of candidate providers. As can be expected of market leaders in the field, most of the providers are largely similar in most features. A finer look at the tabulated data reveals a few salient points as per our target requirements, thus eliminating a few solutions. In terms of non negotiable features, Symantec fails to provide major release support and Fiberlink s MaaS360 fails to provide for standalone servers. IBM and Dialogs SmartMan do not provide VM packaging and are thus considered unsuitable. Good Dynamics only provides perpetual licensing which doesn t leave much flexibility in licensing choices. This leaves us with Airwatch, Mobile Iron and Zenprise. Only Zenprise provides a desktop app for an administration console. V. CONCLUSIONS We can see that Zenprise provides the best possible solution in that it provides all the required features without any compromise. Airwatch and Mobile Iron are close second contenders. Overall, a virtual machine based solution would be deemed favourable on grounds of reliability, communication efficiency, data security and maintenance.

4 4 Feature Airwatch Dialogs SmartMan SaaS /Thin Layer Virtual Machine Reseller Theming Fiberlink MaaS360 Good IBM Mobile Iron Symantec Zenprise Packaging yes yes yes yes Coming yes yes yes yes no yes yes no yes yes yes yes yes yes no yes yes yes yes Licensing Perpetual Recurring yes yes yes no yes yes yes yes Maintenance Purchase Mandatory Mandatory Optional unknown Optional Mandatory Mandatory Mandatory Includes Major Releases Includes yes yes yes yes yes yes no yes support 24x7 yes unknown yes yes yes yes yes yes Scalability Locations yes yes yes unknown yes yes yes yes Fault Tolerance Standalone Server Fail over capability Load Balancing yes yes no yes yes yes yes yes Mobileconfig features Require yes yes yes unknown yes yes yes yes Passcode Device Restrictions Exchange account seeding WiFi Config ios5 Features push retail yes yes yes no yes yes yes yes apps Exncrypted mail Sandbox mail Prevent icloud WiFi autojoin On Demand Features Remove Passcode Remote lock Remote wipe Push Text message yes yes yes yes no yes yes yes TABLE I A COMPARATIVE ANALYSIS OF MARKET LEADERS IN BYOD SOLUTIONS. FEATURES ARE CATEGORIZED BY TYPE.

5 5 Feature Airwatch Dialogs SmartMan Push Web Apps Catalog of in house apps recommended retail apps VPP integration Fiberlink MaaS360 Good IBM Mobile Iron Symantec Zenprise App Management yes Coming yes yes yes yes yes yes Administration Console Web yes yes yes yes no yes yes yes Desktop App no no no unknown yes no yes yes Alert when no response Alert when roaming Alert on Forbidden App yes yes yes unknown yes yes yes yes yes yes yes unknown no yes yes yes yes yes yes unknown yes yes yes yes Data Export App Inventory Device History yes yes yes unknown yes yes yes yes Device Status yes yes yes unknown yes yes yes yes Enterprise SCEP Integration yes yes yes unknown Coming yes yes yes Local CA with yes yes yes unknown Coming yes yes yes SCEP Certificate Features Apply Certs to yes yes yes unknown yes yes yes yes Exchange Apply Certs to yes yes yes unknown yes yes yes yes VPN Other Devices Android Blackberry yes yes yes unknown Coming yes yes yes Symbian Windows Mobile Windows Phone 7 yes Coming yes Coming yes yes yes yes TABLE II A COMPARATIVE ANALYSIS OF MARKET LEADERS IN BYOD SOLUTIONS (CONTD). FEATURES ARE CATEGORIZED BY TYPE.