Protecting Corporate Data in the "BYOD" Environment

Transcription

1 Protecting Corporate Data in the "BYOD" Environment Bring-Your-Own-Device Environments Offer Many Benefits, But Businesses Must Also Insure the Integrity of Corporate Assets Wednesday, August 3, 11

2 Executive Overview The Consumerization of IT wave is hitting enterprises at full force as end users begin to demand more freedom and flexibility in the way they interact with business applications. Frontline end-users as well as senior executives want the convenience of using just one smartphone or one tablet for both work and personal use. They re tired of carrying two devices and want to eliminate the hassle of physically switching from one to the other. This movement has prompted many businesses to offer employees the option of Bring Your Own Device (BYOD) to work rather than forcing users to rely on corporate-owned devices. In addition to responding to user preferences, embracing the shift to BYOD makes sense from a business and an IT perspective. In addition to increasing employee productivity and improving employee morale, the BYOD approach reduces the cost of IT capital expenditures as well as on-going support costs. BYOD also gives IT the opportunity to establish itself as being on the same side of end users by granting the freedom to interact with business applications as end users wish to. Page 2

3 Executive Overview (Cont.) At the same time, senior management and IT also need to ensure they protect corporate applications and data accessed by personal smartphones and tablets. In the event that a device is lost or stolen, or in the event an employee decides to maliciously pirate corporate info, safeguards must be in place so that the company can keep assets safe. This white paper examines the benefits the BYOD approach and also presents how the proper technology combined with effective policies enables employees to increase their productivity while protecting company interests at the same time. Wednesday, August 3, 11 Page 3

4 Consumerization of IT Forcing Enterprises to Consider BYOD Environments The popularity of smartphones and tablets is growing exponentially as more and more consumers realize the benefits of having instant and fun access to the Internet and wherever they go. In fact, consumers are having so much fun, they now want to bring these devices to work with the freedom to also interact with business applications. This trend, often referred to as the Consumerization of IT, has prompted many enterprises to seriously consider the creation of a Bring Your Own Device (BYOD) environment. Many studies illustrate just how strong the movement is and why all businesses need to consider BYOD right now. As reported by the 451 Group in June 2011, the smartphone has become the key communication tool for enterprise workers, allowing them to quickly access , instant messaging and most importantly, mobile enterprise applications. 1 In The 451 Group's Enterprise Mobility Survey in March 2011, 41% of US companies reported that more than half of their employees were using smartphones. 12% stated that every employee was equipped with a smartphone and 62% of these companies plan on deploying one or more mobile applications in As these studies and many others demonstrate, the Consumerization of IT wave is here. Businesses can brace for the full impact by creating a BYOD environment that not only addresses the demands of end-users, but also generates multiple benefits. Page 4

5 The Benefits of the Bring-Your-Own-Device to Work Approach Lower Total Cost of Ownership: By giving employees the option of using their own smartphone or tablet for business purposes, enterprises reduce device capital expenditures since fewer devices need to be purchased. Businesses also reduce on-going costs for mobile phone usage as well as Internet-access data plans. And because end users who bring their own devices understand how the devices work to a much greater degree, users typically do not require as much technical support, which reduces on-going IT costs. Improved Morale: Giving employees the freedom to bring their own device also gives them more control over their computing environment and acknowledges the fact that business-life and personal-life both sometimes need attention on a 24x7 basis. In addition to keeping current employees happy, the BYOD approach also serves as an effective recruiting and retention tool for companies working to attract the best and brightest professionals. Improved Productivity: With the ability to easily switch from personal applications, music, photos and to corporate applications, businesses are much more likely to see increased productivity from employees away from their jobs at night and on weekends especially if the mobile platform creates a fun, interactive and familiar environment they enjoy. Page 5

6 Securing Corporate Applications and Data on Personal Devices When giving employees the BYOD option, businesses must also turn to an effective mobile application management (MAM) platform and well thought-out policies to ensure applications function optimally and to keep corporate applications and data safe. When a mobile platform that provisions applications is deployed properly, businesses can keep corporate assets just as safe on employee-owned devices as they can on corporate-owned devices. An effective MAM platform makes it possible to disable application access and remotely wipe corporate data from devices when employees leave the company or change job roles, as well as when devices are lost or stolen. The technology also makes it possible to leave personal applications, data, music and pictures intact so that employees don t have to worry about losing personal content. This is an important aspect when asking employees to use their own devices for business applications. Mobile platform technology also makes it possible to easily deploy and update corporate-branded applications that create a fun and interactive experience for end users. This boosts productivity by increasing the time employees want to spend using business applications, when not on the job. With just one device accessing both personal and business content, they can easily move from one view to the other. In many cases, users can take care of their own configurations and other tech-support issues. Page 6

7 Key Mobile Application Management Platform Capabilities When researching MAM platform solutions for adopting the BYOD approach, it s critical that enterprises turn to a leading provider to ensure security and performance. By looking for a solution that includes all the key capabilities required, businesses can facilitate the BYOD process and ensure the integrity of corporate assets. Here s a recommended list of attributes to look for in a MAM platform: Enables creation of secure applications that ensure authorized useraccess with a simple software development kit (SDK) that can be used by developers Allows for fast distribution and automated updates of applications Permits IT to maintain control of business applications on devices owned by employees Provides end users with a familiar application interface Allows end users to opt-in to corporate policies before receiving access to corporate applications and data, and then logs this event for compliance reporting Facilitates employee ability to download applications and access additional content such as PDF files and videos Gives application developers the ability to manage application testing during the development process with smooth transitions to the pilot and roll-out stages Page 7

8 Carefully-Planned Policies Must Complement the Technology In conjunction with the MAM platform, businesses must also apply a clear set of policies. In addition to policies that communicate how IT will manage personal devices and distribute applications, a second set of policies is needed to help employees understand the access that the business must be given to personal devices to protect corporate data and applications. Employees must also understand the consequences of conditions that might dictate the need for a complete wipe of a device, such as when devices are lost or stolen. In return, businesses should declare how they will not infringe on personal applications and content as long as policies are adhered to by employees. Page 8

9 Carefully-Planned Policies Must Complement the Technology (Cont.) The policies should not restrict employees beyond what is reasonable since the premise of BYOD is an equal swap: employees alleviate the business from the need to purchase devices in exchange for receiving access to both personal and business applications. It s best to give employees sufficient freedom in the use of the devices and only clamp down on anyone that violates the policy. Businesses should also create a methodology for determining which mobile devices will be supported for accessing corporate applications. Each device operating system requires platform programming, so support should not be offered to any and all devices, but businesses should make sure they support mainstream devices. Page 9

10 Mobile Platforms IT Should Support Strategy Analytics recently issued a mobile device adoption report with these observations, which can serve as a guide to businesses in the deviceselection process. 3 In the past, creating applications was expensive and timeconsuming, requiring custom development for each application. Apperian s toolkit builds on the Apple SDK, and focuses on a simple development interface so enterprise users can develop applications quickly and affordably. The toolkit includes the following components: ios (Apple) and Android device adoption has gained tremendous ground in the corporate space, following on the heels of the explosive consumer-driven adoption of these two platforms. Although BlackBerry has lost market share to competitors, it remains the dominant enterprise-mobility platform. The mobile-device market will be a four-horse race between Android, BlackBerry, ios and Windows Phone. IT departments will have to officially support these four major mobile platforms for the foreseeable future. Page 10

11 Recommended Best Practices and Policies Through recent interviews conducted with CIOs, Deloitte Consulting 4 has developed a set of baseline policies and best practices that enterprises can use as a starting point for creating BYOD policies and user agreements. Here are some adapted excerpts from those guidelines that help reduce business risk as well as legal liabilities: Improve End-User Satisfaction - Streamline the devicecertification process to provide more timely access to state-ofthe-art devices, whether through a more agile IT department or through a BYOD model. Document the guidelines for which devices to evaluate, the evaluation criteria, and how to notify users on what devices are permitted on the network. Communicate clearly how mobile devices must be configured and how they will be supported. This is particularly important if there will be different support levels for user-owned and company-owned devices. Also take into account the variances across different regulatory domains and openly communicate to users on how devices are evaluated, the device-certification roadmap, and permitted/prohibited devices. This will help manage expectations. Page 11

12 Best Practices (Cont.) Reduce Security Risk Develop a tightly-coordinated suite of technical and policybased solutions as well as consistently-applied processes for all of the following areas: Device-access controls Local and remote data wipe Device configuration Data encryption Patching and updating Authentication Network access control for detecting and preventing unauthorized and unrecognized devices from connecting to the network Device partitioning Security Appropriate use monitoring Partitioning is another important aspect of a BYOD solution as it allows a clean separation of personal and business applications and data. This in turn makes it possible to lock down and manage business applications and data without impacting personal content on the device. Page 12

13 Best Practices (Cont.) Ensure User Compliance - To reduce business risk and legal liabilities, develop user agreements and provide training so users understand mobile security risks, their responsibilities, acceptable-use policies, prerequisites for connecting any device to the network, and inappropriate use. Also implement processes for notifying users when and why they are out of compliance while providing the steps they must take to become compliant. User agreements will also need to be tailored for different countries due to differences in regulatory requirements. Simplify Application Development and Distribution - Establish a mobility-aware enterprise architecture and application design framework that ensures consistent use of best-practice design patterns. Use cross-platform SDKs that support multiple mobile-operating systems and support disconnected and loosely-connected local applications. SDKs should also support browser-based applications that decouple the application from the mobile OS and virtual desktop solutions that reduce the need for a local client. Establish a private enterprise-application store so employees have a single, trusted place to download the latest mobile applications. Reduce Device Support - Implement centralized device management registering devices with a central management application to monitor every device for health status, configuration settings, push applications, and software patches. This should be a cross-platform solution to support the broadest array of devices from a single management console. Page 13

14 Apperian Maximizes BYOD Benefits While Minimizing Risk Apperian has developed a MAM platform is already helping businesses take on the challenge of deploying a BYOD environment. The Apperian EASE (Enterprise App Services Environment) platform provides businesses with the ability to enable their developers to create secure apps and allow their IT professionals to efficiently distribute, update, manage, and provision apps for an entire organization. EASE gives IT the control it needs while at the same time providing users with a familiar interface from which to choose apps, view additional information, and access training materials such as PDF files and videos. EASE also provides developers with software tools that allow them to ensure users are authenticated and authorized while also ensuring app updates take place automatically. Developers can also easily manage app testing in-house during the development process and then transition smoothly to the pilot and roll-out stages. Page 14

15 EASE Delivers Multiple Benefits Architecture Enables Scalable Cloud-Based Services: EASE runs as a cloud-based service on a server with a hosted SaaS configuration. The platform is highly scalable since commonly-downloaded files are situated on a content-delivery network that ensures fast application and data delivery at peak demand times. A large number of simultaneous users can thus download and update apps quickly. Branded Catalog Provides Users with Authorized Applications: The EASE customer-branded application catalog enables users to see all apps they are authorized to access. Users can view detailed information for each app, including screen shots and related media such as PDF files and videos. Users can also search for apps, see a list of all rich media, and manage pending updates. Wednesday, August 3, 11 Page 15

16 EASE Benefits (Cont.) SDK Streamlines Mobile App Creation: The EASE SDK provides a number of libraries that help enterprises create mobile apps. This includes APIs to authorize users and check that the current version of the app is in use. The SDK ensures that users have the right to run a particular app, tracks usage, and checks that the proper version is being used. Apperian also supports developers on an ongoing basis by continuously enhancing the SDK as new technologies emerge. Private Database Authenticates Users: Both the branded app catalog and the SDK provide the ability to use a private (local) database for authentication. Administrators can create accounts with a username and password or invite users via a one-time link to set their own passwords. Bulk import of users is also supported. Wireless Distribution for ios and Android: Wireless distribution is available with ios4 and Android and fully supports over-the-air delivery of single or multiple applications to user devices. EASE ensures that users are authorized to receive apps before delivery. Page 16

17 EASE Benefits (Cont.) Integrates with Active Directory for Additional Password Protection: The branded app catalog and the SDK both also provide the ability to use Microsoft Active Directory authentication via LDAP. This allows users to be added and authenticated without storing sensitive password information on any EASE cloud services. Active Directory groups can be used to set the rights of users, and enterprise accounts can list one or more domains to ensure users attempting to register with a "white listed" address domain will be provided with a custom message to contact their corporate admin. Web Portal Enables Anywhere, Anytime System Administration: The EASE Web Portal provides administrators with the ability to manage apps, users, and groups from any Internet connection. Administrators can temporarily or permanently disable app access for individual users or groups without revoking all user access. EASE also allows developers to upload new apps and versions for testing. For users, the portal provides account confirmation and password verification. Page 17

18 EASE Benefits (Cont.) Integrates with Active Directory for Additional Password Protection: The branded app catalog and the SDK both also provide the ability to use Microsoft Active Directory authentication via LDAP. This allows users to be added and authenticated without storing sensitive password information on any EASE cloud services. Active Directory groups can be used to set the rights of users, and enterprise accounts can list one or more domains to ensure users attempting to register with a "white listed" address domain will be provided with a custom message to contact their corporate admin. Web Portal Enables Anywhere, Anytime System Administration: The EASE Web Portal provides administrators with the ability to manage apps, users, and groups from any Internet connection. Administrators can temporarily or permanently disable app access for individual users or groups without revoking all user access. EASE also allows developers to upload new apps and versions for testing. For users, the portal provides account confirmation and password verification. Page 18

19 Reduce IT Costs, Improve Morale and Increase Productivity Without a doubt, the Consumerization of IT wave has arrived, and businesses must react now to employees and senior managers that will insist on bringing their own devices to work. The good news is that a set of policies such as those presented above combined with a proven mobile-application-management platform like EASE from Apperian, gives enterprises the ability to truly catch and ride the wave as it develops unstoppable momentum. With clear policies and effective technology in place, businesses can ensure the security of their applications and data while reducing IT costs. And perhaps even more importantly, businesses can also improve morale while and giving employees the flexibility they need to raise their productivity levels. About Apperian Apperian, Inc., the mobile application management (MAM) company, brings enterprise apps to a new level of productivity with its Enterprise App Services Environment (EASE). For developers who create, and IT professionals who deploy and manage mobile applications in the enterprise, Apperian's EASE is a cloud-based MAM platform that provides a developer SDK, templates for creating native apps, rapid provisioning, secure deployment and an easy update process, all via a client branded app catalog. Apperian customers include Cisco Systems, Procter & Gamble, The Estee Lauder Companies, Talecris Biotherapeutics, and NetApp. Contact information sales@apperian.com 1 The 451 Group: Enterprise Smartphone Demand Nears an Inflection Point, June 20, The 451 Group: Enterprise Mobility Survey, March Strategy Analytics: Mobile Platform Adoption, June David Smud Director, Deloitte Consulting, LLP Page 19