Strategies for Embracing Consumerization

Transcription

1 Strategies fr Embracing Cnsumerizatin Micrsft Crpratin Published: April 2011 Abstract Increasingly, wrkers want t use their wn devices, such as slates, smartphnes, and prtable cmputers, fr wrk. Fr IT t be able t embrace cnsumerizatin, risks t the enterprise and its data must be minimized thrugh assessing and understanding user needs and device types. When cnsumerizatin is prperly planned and managed, it enables businesses t deliver prductivity gains and cmpetitive advantage. This paper describes strategies and best practices that help ensure that crprate assets remain secure and establish new rles fr empwered emplyees and IT as partners.

2 Cpyright infrmatin The infrmatin cntained in this dcument represents the current view f Micrsft Crpratin n the issues discussed as f the date f publicatin. Because Micrsft must respnd t changing market cnditins, it shuld nt be interpreted t be a cmmitment n the part f Micrsft, and Micrsft cannt guarantee the accuracy f any infrmatin presented after the date f publicatin. This white paper is fr infrmatinal purpses nly. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS DOCUMENT. Cmplying with all applicable cpyright laws is the respnsibility f the user. Withut limiting the rights under cpyright, n part f this dcument may be reprduced, stred in, r intrduced int a retrieval system, r transmitted in any frm r by any means (electrnic, mechanical, phtcpying, recrding, r therwise), r fr any purpse, withut the express written permissin f Micrsft Crpratin. Micrsft may have patents, patent applicatins, trademarks, cpyrights, r ther intellectual prperty rights cvering subject matter in this dcument. Except as expressly prvided in any written license agreement frm Micrsft, the furnishing f this dcument des nt give yu any license t these patents, trademarks, cpyrights, r ther intellectual prperty Micrsft Crpratin. All rights reserved. The example cmpanies, rganizatins, prducts, dmain names, addresses, lgs, peple, places, and events depicted herein are fictitius. N assciatin with any real cmpany, rganizatin, prduct, dmain name, address, lg, persn, place, r event is intended r shuld be inferred. Micrsft, Active Directry, ActiveSync, AppLcker, Bing, BitLcker, BitLcker T G, BranchCache, Frefrnt, Htmail, Hyper-V, Internet Explrer, Kinect, Lync, Outlk, RemteFX, SharePint, Silverlight, SkyDrive, Windws, Windws Intune, Windws Live, Windws Media, Windws Server, Windws Vista, Xbx, Xbx LIVE, XNA, and Zune are either registered trademarks r trademarks f Micrsft Crpratin in the United States and/r ther cuntries.

3 Cntents 1 Executive Summary What Is the Cnsumerizatin Imperative? New Wrkplace Expectatins Opprtunities and Challenges Ahead Factrs fr Success What Are the Enabling Technlgies? Clud-Based Applicatins and Services Desktp Virtualizatin VDI Flder Redirectin Applicatin Virtualizatin Chsing the Right Technlgy Enabling a Diverse Set f Devices Wrk Frm Hme PC r Bring Yur Own Cmputer Slates and Tablets: Windws-Based r Nn-Windws-Based Devices Windws-Based Laptps, Slates, and Tablets Nn-Windws-Based Slates and Tablets Smartphnes What Are the Main Cnsideratins if Enterprises Are t Embrace Cnsumerizatin? What Operating Systems and Hardware Need t Be Supprted? Supprt Plicy Update Methds Csts Hw Will Regulatry Cmpliance Be Achieved? What Applicatins Will Be Used? Hw Will Applicatins Be Deplyed and Managed? Hw Will Devices and Data Be Secured? Data n the Lcal Device Data in the Clud r Crprate Data Center Only Enabling Netwrk Access Enfrcing Netwrk Security User Authenticatin Hw Will Devices Be Managed? Hw Will User Respnsibilities Be Managed? Slutins fr Managing Cnsumerizatin in the Enterprise PCs and Slates Windws Optimized Desktp... 23

4 7.1.2 Windws with Windws Intune VDI Smartphnes Windws-Based Phnes Nn-Windws-Based Phnes Micrsft Can Help Summary... 32

5 1 Executive Summary The definitin f a wrkplace is changing, and the bundaries between prfessinal and persnal lives are being redefined. Users n lnger wrk nly within their ffices, but ften check late at night and update persnal Web sites during the day. The ffice cmputer is accmpanied by prtable cmputers, slates, and smartphnes. Cmputing pwer is nw available acrss a wide range f devices. Cnsumer devices such as smartphnes and slates are nw becming pwerful enugh t be able t run the types f applicatins that were traditinally restricted t desktp and prtable cmputers. Fr many wrkers, such cnsumer devices appear t represent the future f cmputing and empwer them t d their jb mre efficiently. The highly managed IT infrastructure within mst enterprises can seem t be a cumbersme and restrictive envirnment, and des nt prvide much flexibility. There are s many chices available t cnsumers that members f the wrkfrce prefer t use their wn device at wrk and pressure IT t supprt their grwing need t stay prductive and cmpetitive. The challenge fr IT is t be able t embrace cnsumerizatin where it is apprpriate, while at the same time minimizing risks t the enterprise and t its data. Many newer devices were nt initially designed fr enterprise use, and careful planning is required t enable the level f management and cntrl that mst enterprises require. As a leader in business and cnsumer technlgies, Micrsft is in a unique psitin t understand and prvide guidance n hw best t embrace cnsumerizatin respnsibly within enterprises. This white paper utlines specific guidance fr rganizatins that are cnsidering whether t adpt the latest cnsumerizatin trends. This paper explres the pressures and the main scenaris f cnsumerizatin in the enterprise. It als describes the primary pints f cnsideratin, including legal and cmpliance issues and the technlgies. Als presented are examples f different appraches in managing cnsumerizatin. 2 What Is the Cnsumerizatin Imperative? Cnsumerizatin is the grwing trend where business users are making the ultimate chice in what devices, applicatins, and services they use t get their wrk dne. 2.1 New Wrkplace Expectatins The wrkplace envirnment is changing, due in n small part t advances in mbile devices and remte wrking technlgies. Many wrkers are spending time wrking away frm the ffice, perhaps wrking at hme fr part f the week, increasingly blurring wrk-life bundaries. 5

6 Many wrkers are nw using their wn devices and have the flexibility t wrk ut f hurs, s there is great ptential t imprve user prductivity, such as during a cmmute. Technlgy enthusiasts can be demtivated if they are expected t use lder devices that have restrictive sftware, applicatins, and netwrk access plicies, when they are at wrk. Recent studies have cnfirmed this trend. Fr example, an IDC study that Unisys cmmissined fund that 40 percent f the time that users spend n their hme cmputer is actually fr wrk. In additin, 50 percent f the time that users spend n their smartphne is als related t wrk Opprtunities and Challenges Ahead Cnsumerizatin is the grwing trend where business users are making the ultimate chice in what devices, applicatins, and services they use t get their wrk dne. By embracing the wrkfrce and empwering it with the latest and greatest technlgies, IT can help businesses unleash prductivity, reduce csts, and stay cmpetitive. In fact, in a recent study, 83 percent f IT decisin-makers characterized the effect f cnsumerizatin as mstly psitive 2. Hwever, embracing cnsumerizatin is nt an easy task and needs deliberate planning frm IT. Cmpanies shuld evaluate hw t ensure prductivity anywhere, while still prtecting data, maintaining cmpliance, and enabling adequate PC and device management. This all puts pressure n IT t prvide cmpelling slutins fr end users while maintaining a secure and wellmanaged envirnment. Examples f such pprtunities and challenges can be fund in hspitals. Hspitals are majr cnsumers and creatrs f persnal data, and medical staff need access t this data wherever they are n the hspital site. This data access is ften prvided by mbile data carts, and there is increasing pressure n IT t enable medical staff t use mre mbile devices. Hwever, privacy and security requirements, such thse cntained in the Health Insurance Prtability and Accuntability Act (HIPAA) and the Health Infrmatin Technlgy fr Ecnmic and Clinical Health Act (HITECH), pse special challenges, particularly mbile devices may prvide access t data abut patients. 1 IDC & Unisys Cnsumerizatin f IT Benchmark Study, June IT Managers Selectively Embrace Cnsumerizatin, a cmmissined study cnducted by Frrester Cnsulting n behalf f Micrsft, February

7 3 Factrs fr Success There are several key factrs that shuld be addressed s that unmanaged cnsumer devices can be successfully used within the wrkplace: 1. Assess and understand yur users. The first phase invlves assessing what cnsumer-grade applicatins and devices yur emplyees are using at wrk tday. It will als be helpful t create a prfile f yur end users and the typical scenaris that they encunter. Depending n the user impact n the business and the needs f users, yu may have a different level f tlerance fr their use f cnsumer technlgies and a different pace and apprach fr hw t embrace cnsumerizatin fr different user types in yur cmpany. The recent Smart Wrkfrce Segmentatin Helps Yu Better Identify and Meet Wrker Needs Study 3, which Micrsft cmmissined and Frrester Cnsulting cnducted, can be used as an example t evaluate hw ther midsize-tlarge rganizatins are distributing technlgy, what drives these decisins, and hw it affects the business. 2. Assess and understand cntent and infrmatin sensitivity. Users, and the cntent that they cnsume and generate, vary in their level f infrmatin sensitivity. Fr example, sme users may deal with sensitive legal issues, whereas thers may deal with infrmatin that is intended fr a public readership. Similarly, sme data, such as sales cntracts, is highly sensitive and shuld be kept within securely managed strage. Alternatively, ther data, such as marketing brchures, can be shared using cnsumer technlgies such as Windws Live SkyDrive withut presenting any risks t the rganizatin. As with any technlgy, adpting cnsumer technlgies fr yur business shuld be dne respnsibly, and that means assessing the risks and then, fr yur rganizatin, deciding which risks are acceptable and which are nt. 3. Assess and understand yur device types and applicatin needs. Devices are nt necessarily gd fr all tasks: a. Devices that d nt include keybards, r ther rich input mechanisms, may be apprpriate fr sme types f data cnsumptin, but can be pr fr data creatin. b. Rich user interfaces n desktp cmputers and prtable cmputers, including full keybard and muse supprt, in additin t the use f tuch r pens n tuch-enabled cmputers and tablets, generally prvide the best envirnment fr data creatin and manipulatin tasks. Windws-based tablets and slates get the full Windws experience 3 Smart Wrkfrce Segmentatin Helps Yu Better Identify And Meet Wrker Needs, a cmmissined study cnducted by Frrester Cnsulting n behalf f Micrsft, February

8 (including Adbe Flash and Micrsft Silverlight ), custmizatin ptins, and manageability. 4. Define the criteria fr a successful slutin. Cnsider what benefits there will be, and hw these benefits will be measured. 5. Use enabling technlgies t implement yur slutin. Plan n prtecting sensitive data, enabling data access and sharing, prviding tls fr applicatin delivery and access, and prviding a centrally managed envirnment by using enabling technlgies such as clud-based applicatins and services, in additin t desktp virtualizatin. 6. Update yur rganizatinal plicies. Yur rganizatinal plicies shuld reflect yur slutin, requiring cllabratin beynd IT t include legal, HR, and finance cnsideratins. 7. Pilt yur slutin. Use vlunteer users t pilt yur slutin. They shuld be highly mtivated and keen t wrk and help create a cnsumerizatin strategy fr yur enterprise. D nt expect t pilt just a single device because such a device is unlikely t be right fr all yur users ne size des nt fit all. 8. Plan fr cntinuus imprvements. It is unlikely that the first iteratin f the prgram will be perfect. 9. Ensure that the prgram drives business value. The prgram shuld nt just be a way fr particular users t get cl stuff. Yu shuld identify yur user scenaris and prductivity needs, and ensure that the prgram meets these requirements and supprts yur business bjectives. 10. Prvide implementatin and develpment resurces. One thing t cnsider is t prvide sufficient resurces t supprt and develp the delivery f applicatins and data acrss multiple platfrms. The level f resurces that can be allcated will affect the likely csts and timescales fr successful implementatin f a cnsumerizatin prject. 11. Adpt the prgram. Rll it ut t all emplyees r t thse yu have identified as mst likely t benefit. 4 What Are the Enabling Technlgies? IT needs t adapt t the new device landscape. Users will increasingly demand mre chice in their wrk devices, which may be met by a persnal device r mre chice frm cmpany hardware. Cmpanies shuld evaluate new technlgies that can enable prductive and safe use f cnsumer devices in the wrkplace. Such technlgies shuld: Prtect sensitive data. Enable data access and sharing. Prvide tls fr applicatin delivery and access. Be capable f being centrally managed. 8

9 Fr mst enterprises, cnsumerizatin initiatives are unlikely t be realistic ptins unless mst r all f the abve requirements can be met. Fr example, if a user brings his r her wn persnal prtable cmputer t wrk, and mixes persnal and business applicatins and data n the same desktp instance, there is a high risk f incmpatibilities at best, and data lss and legal issues at wrst (such as malicius sftware r illegal dwnlads being brught int the wrkplace). 4.1 Clud-Based Applicatins and Services Clud cmputing includes Web-based applicatins r Web-hsted services, and centralized server farms and data centers, where data is accessed frm any type f netwrked device. A cmmn feature f clud-based cmputing is that endpints are theretically device-independent; by using the brwser n the device as a universal client, there is n need fr client sftware that is specific t a certain perating system fr each type f device that may access the applicatin. Hwever, fr cnsumer devices, there are several cnsideratins fr using clud applicatins fr crprate data access: Brwser requirements. A key requirement is that brwsers n users devices supprt the applicatins. Fr example, there may be requirements that dictate a particular set f supprting brwser versins. Screen size. There may be screen real-estate issues, particularly fr smaller frm-factr devices. This can be alleviated t sme extent by gd design, such as aviding fixed page sizes. Micrsft Office 365 and the Office Web Apps are gd examples f clud applicatins. Office 365 includes nline versins f Micrsft Exchange, SharePint, and Lync, and wrks with Windws-based PCs, Windws Phne 7, and Macintsh cmputers. Office 365 als includes sme functinality that is supprted by iphne, BlackBerry, Nkia, and Andrid devices. Sme phnes ffer mre cmplete supprt fr Office 365. Fr example, using Windws Phne 7, yu can synchrnize SharePint wrkspaces t yur phne and wrk with crprate Office dcuments ffline. Other examples f clud applicatins include Windws Live Mesh 2011 fr synchrnizing files acrss devices and fr remte access t PCs, Windws Live SkyDrive fr string and sharing dcuments and ther files, and Windws Intune fr clud-based PC management. 4.2 Desktp Virtualizatin VDI In a Virtual Desktp Infrastructure (VDI), Windws-based desktp envirnments are run and managed in virtual machines n a centralized server. The server then remtely presents the user s desktp t her client cmputer r ther device by using a prtcl such as Remte Desktp Prtcl (RDP). VDI enables the central management and deplyment f user desktps, 9

10 but adds the capability fr users t access their wn persnalized desktps, custmize their wn unique desktp settings, and have administratr rights if necessary (such as fr develpers). In cntrast t VDI, Sessin Virtualizatin enables users t share a single server-based desktp via sessins. Yu can use Sessin Virtualizatin t virtualize the presentatin f entire desktps, r just specific applicatins. Yu can use Remte Desktp Services, part f Windws Server 2008 R2, t deliver bth VDI and sessin-based desktps Flder Redirectin Flder redirectin is ne cmpnent f a strategy, smetimes referred t as user state virtualizatin, where user data and settings are stred securely in a central lcatin, and can be cached n the lcal desktp when users are ffline. The primary cpy f the data is n the netwrk, s it is easily restred in the case f a lst r stlen PC and the user s settings can be reapplied autmatically Applicatin Virtualizatin Virtualized applicatins run in a separate, prtected, virtualized space, and are nt installed in the traditinal sense. When rganizatins deply virtual applicatins, they reduce applicatin-tapplicatin cnflicts. The Micrsft implementatin f applicatin virtualizatin is Micrsft Applicatin Virtualizatin (App-V), which is available as part f the Micrsft Desktp Optimizatin Pack (MDOP). Yu can stream App-V applicatins t users n demand thrugh enterprise sftware distributin systems such as Micrsft System Center Cnfiguratin Manager r thrugh the Micrsft Deplyment Tlkit (MDT). Alternatively, yu can deply App-V applicatins by using stand-alne media. Yu can manage and service App-V applicatins centrally, enabling enterprises t update nce and assure cmpliance thrughut the rganizatin. Updates are delivered t users seamlessly. Citrix XenApp is a Micrsft Partner slutin that extends supprt fr traditinal and App-V virtual applicatins t a wide range f devices, including smartphnes and ther nn-windws-based devices. 4.3 Chsing the Right Technlgy When evaluating technlgies, there are three principal questins t ask: 1. What is the impact n the client device? A lw-impact technlgy requires n client installatin at all, r a lite agent nly. A high-impact technlgy requires ne r mre agents t be installed n the client. 2. What level f IT investment is needed? A lw-investment slutin uses r extends the current infrastructure, r makes use f clud technlgies. A high-investment slutin requires new infrastructure. 10

11 3. Hw much d yu need t cntrl? Yu need a lw level f cntrl where there are nly single applicatins, r where nly baseline security is enabled. Yu need a high level f cntrl where cmplete envirnments are supprted. Fr example, terminal server cmputing and VDI bth have a lw impact n the client, but VDI typically requires mre substantial IT investment and cntrl systems. Similarly, management technlgies have a high impact n the client, but yu can reduce csts by using clud-based management tls (Figure 1). Figure 1. Hw technlgies rate fr cst, cntrl, and client impact. The amunt f access that a device has t enterprise resurces, including , dcuments, and business applicatins, shuld depend n the degree t which the device meets rganizatinal criteria. The mre the rganizatin trusts the device, the greater the access. The level f access t infrmatin dictates hw prductive a user can be when wrking frm the device. Fr example, even unmanaged devices may be permitted access t and calendar applicatins, but prductivity will be limited unless users are als given access t dcuments and business applicatins (Figure 2). 11

12 Figure 2. Hw applicatin access affects prductivity fr managed and unmanaged devices. 5 Enabling a Diverse Set f Devices The pressures n IT t enable a diverse set f devices cme frm several cnsumerizatin scenaris. 5.1 Wrk Frm Hme PC r Bring Yur Own Cmputer Many rganizatins are nw frmalizing their supprt fr hme wrking, and enabling emplyees t use their hme cmputer fr wrk purpses. In a study f 150 cmpanies, which Micrsft cmmissined and Frrester Cnsulting cnducted, 37 percent f IT decisin-makers reprted that they supprt sme flavr f a Bring Yur Own Cmputer (BYOC) prgram and an additinal 26 percent had plans t d s 4. Such initiatives may als include financial supprt fr purchasing the cmputer. 4 IT Managers Selectively Embrace Cnsumerizatin, a cmmissined study cnducted by Frrester Cnsulting n behalf f Micrsft, February

13 Bring Yur Own (BYO) describes vluntary agreements whereby emplyees can use their wn cmputers r ther devices in the wrkplace. In sme cases, users are financially supprted thrugh a stipend, whereby an emplyee is prvided with a sum f mney t purchase a device, and supprt fr a perid such as three years. BYO can apply t any device such as any cmputer (BYOC) r any type f PC (BYOPC). IT shuld be cncerned abut the ptential cmplexity f BYO. In the Frrester Cnsulting study 5, 56 percent f IT decisin-makers respnded that they are targeting 2011 and 33 percent are targeting 2012 fr fully deplying a BYOC prgram. Hwever, mst IT managers have significant wrk ahead t determine which lines f business r wrkfrce segments shuld be allwed access t the BYOC prgram, hw the stipend will be extended t users, hw t determine crprate plicies and the rules f the BYOC prgram, and hw t lck dwn the security cntrls f crprate data, applicatins, and netwrk access. 5.2 Slates and Tablets: Windws-Based r Nn- Windws-Based Devices The increasing chice f frm factr fr bth Windws-based and nn-windws-based devices is als a significant cnsumerizatin driver, with a range f slates and tablets becming available. Users are demanding wider chice, even if IT will be supplying the hardware. Tablet cmputers typically include tuch screens, in additin t mre traditinal keybard and pinter interfaces, and the screen may swivel t hide the keybard as required. Specialist vendrs may prduce tablets fr specific markets such as industrial, medical, hspitality, and utdr applicatins. Slate cmputers are similar t tablets, but may nt have a dedicated physical keybard; slates may als have a smaller frm factr than tablets r mre traditinal prtable cmputers Windws-Based Laptps, Slates, and Tablets Windws 7 includes a range f new tuch features that supprt bth finger gestures n tuch screens, and stylus input fr mre accurate inputs such as handwriting recgnitin, signature capture, and data entry applicatins. In certain specialist devices, ther Windws-based perating systems may be in use, such as Windws Embedded n pint-f-sale (POS) devices and handheld line-f-business (LOB) devices fr fleet and warehusing applicatins. Hwever, yu can manage all Windws-based cmputers thrugh technlgies such as System Center Cnfiguratin Manager, and they can all be part f an Active Directry dmain. 5 IT Managers Selectively Embrace Cnsumerizatin, a cmmissined study cnducted by Frrester Cnsulting n behalf f Micrsft, February

14 5.2.2 Nn-Windws-Based Slates and Tablets Nn-Windws-based slates and tablets run a range f perating systems such as Apple ios, Andrid, Linux, and thers. Althugh there may be a shared rigin in Unix-like systems fr sme f these perating systems, they prvide different user interfaces, and different levels f security and manageability. There are multiple perating systems acrss this device sectr, s it is essential that enterprises adpt a systematic apprach t management, therwise security may be cmprmised. 5.3 Smartphnes Smartphnes are typically defined as mbile phnes that prvide sufficient cmputing pwer t run fairly pwerful mini-applicatins (r apps), and a user-friendly interface t enable interactin with these apps and the phne functinality itself. Smartphnes are available fr Windws-based and nn-windws-based perating systems. Windws Phne 7 is the latest Windws-based smartphne perating system. It supprts a rich tuchscreen user interface, in additin t a range f enterprise features such as built-in SharePint wrkspace supprt fr managing Office files, and supprt fr Exchange ActiveSync. Nn-Windws-based smartphnes include devices running Apple ios, Andrid, Symbian, and thers. Mst f these supprt tuchscreen interfaces and, depending n the vendr, specific enterprise management features. 6 What Are the Main Cnsideratins if Enterprises Are t Embrace Cnsumerizatin? Enterprises that are cnsidering their apprach t cnsumerizatin shuld review their current and anticipated devices acrss several key technlgy and plicy areas. 6.1 What Operating Systems and Hardware Need t Be Supprted? Given the wide range f devices that are nw available, enterprises shuld cnsider whether they are ging t be restrictive in their acceptance f cnsumer r BYO devices, and whether they shuld set guidelines r mre prescriptive rules. Similar cnsideratins will apply fr cmpanywned hardware. In all scenaris, enterprises shuld lk at their prpsed supprt plicy, hw devices will be updated, and the likely csts fr supprting these devices. 14

15 6.1.1 Supprt Plicy Cnsideratins when planning a supprt plicy include: Hw many platfrms will be supprted, and which versins f each platfrm will yu use? Which brwsers will yu supprt? Will yu enfrce a standard image? Are there methds fr applying standard images? Wh will be respnsible fr device supprt? Will yu enfrce a hardware refresh cycle? What peripherals will yu need t supprt? What happens when a device is lst r stlen? If the device breaks, will there be a backup machine? Hw d yu decmmissin the device at the end f its life? What will the minimum device specificatins be? Fr example, if emplyees are part f a BYOPC prgram that stipulates that a purchased laptp must include nsite warranty, yu will still need t cnsider what happens if that laptp has been sent back t the vendr fr repair, and the user is temprarily withut hardware Update Methds Cnsideratins when planning fr update management include: Hw will yu manage new versins f firmware r perating systems, r majr updates? Hw will yu manage security updates? Is updating likely t run int crss-vendr issues? In the case f phnes, d carriers have a vet n perating system updates? What is the typical perating system update prcess fr each platfrm? Wh prvides the updates: the vendr, the carrier, r smene else? What security mdels d they use? What is the cmmitment f the update supplier t timely updates? What is the mechanism fr delivering the updates? What if the hardware vendr stps supprt (fr example, parts are discntinued r backrdered)? Fr example, fr Windws-based cmputers, Micrsft is respnsible fr all feature and security updates fr the perating system and fr Micrsft applicatin sftware. Micrsft maintains 24/7 security issue mnitring and research, issues regular security issue disclsures n blgs and thrugh the Micrsft Security Respnse Center (MSRC) Web site, and releases security updates n the secnd Tuesday f each mnth. Fr nn-windws-based devices, it is imprtant that yu understand the update methds used by device vendrs and suppliers Csts Cnsideratins when assessing supprt budgets include: 15

16 What are the likely csts fr maintaining the perating system and hardware? D updates require payment r subscriptins? Fr example, updates t supprted Windws-based perating systems and applicatins are free, and this includes majr updates thrugh service packs. 6.2 Hw Will Regulatry Cmpliance Be Achieved? A majr risk fr any enterprise that permits the use f nnstandard devices in the wrkplace, r fr wrk purpses ut f the ffice, is hw t ensure and demnstrate regulatry cmpliance. This is a particular challenge fr mre regulated industries such as healthcare, pharmaceuticals, financial services, and gvernment agencies. Fr example, in the United States, the Sarbanes- Oxley Act (SOX) fr crprate gvernance can have significant cmpliance requirements. In cnsidering regulatry cmpliance, there are several key questins that shuld be asked: Where is the data? If data is ever stred n the lcal device (r cpied lcally), that data is at risk if the device is lst r stlen, r when emplyees leave the cmpany. Fr Windwsbased cmputers, tablets, and slates, yu can use BitLcker t create encrypted lcal data vaults. Yu can als use this apprach tgether with plicies t ensure that crprate data is nly cpied dwn t a lcal encrypted stre, r cannt be cpied dwn at all and is nly accessible thrugh remte access tls such as VDI. Are there lcal laws that need t be cnsidered? Fr devices such as smartphnes and nn-windws-based slates, it may be imprtant t be able t remtely wipe settings and data n that device if it is lst r stlen. Remtely swiping emplyees mbile devices may give rise t legal cncerns in sme jurisdictins, and enterprises shuld cnsult with their lawyers. Will yu need t keep a hardware inventry fr cmpliance? If yu need t knw exactly what devices are cnnecting t yur netwrk and cnsuming crprate data, yu will need a higher level f management, lgging, and inventry prcedures. Nt all types f device lend themselves t this apprach. 6.3 What Applicatins Will Be Used? When cnsidering hw t prvide users with the applicatins that they need, there are several key questins that shuld be asked: Hw will yu handle line-f-business applicatins? D all applicatins need t be available n all devices? Des the applicatin vendr supprt the device? There are three main appraches t prviding applicatins where there are multiple platfrms t supprt: 16

17 1. Use ff-the-shelf applicatins fr each type f device, and determine any applicatin cmpatibility issues as sn as pssible, because multiple devices and platfrms mean that multiple testing is required. 2. Use custm develpment t create r prt applicatins fr each type f device, such as creating Micrsft XNA r Silverlight 4 applicatins fr Windws Phne Use device-agnstic technlgies, such as VDI r the clud, where it des nt matter what type f endpint device is being used t access the applicatin, and there is n requirement fr applicatin supprt n multiple platfrms. Fr example, it may be pssible t use cmmn applicatins acrss all supprted devices, as lng as the applicatin vendr has a brad device supprt. Ppular applicatins such as Windws Live Messenger are available fr Windws-based desktps, laptps, tablets, slates, and smartphnes, and there are versins available fr sme ther platfrms. Hwever, many cmmn business applicatins are nt available fr all devices, r may have nly limited supprt. 6.4 Hw Will Applicatins Be Deplyed and Managed? When cnsidering hw t prvide users with access t the applicatins that they need, there are several key deplyment and management questins that shuld be asked: Hw will yu deliver applicatins t users? Will yu permit user-installed applicatins, r self-prvisining? Hw will yu knw what applicatins yu have? Will yu ensure versin cntrl? What is the update prcess and delivery mechanism fr typical applicatins n each platfrm that yu will supprt? Hw will yu manage the applicatin life cycle, including applicatin updates? Wh prvides updates t yur applicatins, and what security mdels d they use? What cmmitment d yur applicatin vendrs have t timely updates? Is there a way t remve applicatin access t users as rles change, r when users leave the cmpany? Hw will yu supprt audit and cmpliance reprting? Fr example, user-installed applicatins are a ptential prblem area unless all Micrsft Sftware License Terms and licenses are thrughly checked. Self-prvisining culd be manageable if enterprises run their wn app stres that nly ffer apprved applicatins, and with the list f available applicatins custmized t specific users. There are several mdels fr deplying applicatins, and nt all f them include management functinality: Public app stres and marketplaces. A majr issue, especially fr handheld devices, is the use f cnsumer apps, which may be available thrugh platfrm-specific applicatin marketplaces such as the Windws Phne 7 Marketplace. Sme f these applicatins 17

18 may actually be business fcused, but fr platfrm-specific reasns, may nly be available thrugh a public marketplace. Applicatin marketplaces present several challenges fr IT: Hw will an emplyee buy applicatins? What identity is used t buy applicatins: persnal r crprate? What is the currency and methd f payments? Hw will the applicatin be updated? Crprate internal app stres. Increasingly, there are demands fr marketplaces that crprate IT can manage. This culd be thrugh methds that enable IT t deply and manage applicatins within an existing glbal app marketplace, such as a private marketplace within a public marketplace, r by using a mre cntrlled internal-nly marketplace. Push deplyment tls. Yu can deply sftware, including applicatin updates and security htfixes, ver the netwrk by using technlgies such as System Center Cnfiguratin Manager 2007 R2. Applicatin whitelists. Whitelists are lists f apprved applicatins; if an applicatin is nt apprved, it will nt run. Being able t restrict the applicatins that can run n a device can help prevent the executin f ptentially malicius sftware, and ensure that nly tested and evaluated applicatins are available. 6.5 Hw Will Devices and Data Be Secured? When cnsidering hw t secure devices and data, key questins include: Hw d yu cntrl access t sensitive data? Hw d yu manage data backup and restre? Hw d yu prtect data n yur netwrk? Hw d yu secure data n the device? Fr example, unless yu can secure data n the device itself, all data shuld be prtected in the crprate data center, r clud, whatever device is being used. In this way, lst r stlen devices present minimal risk t the enterprise and its data. Therefre, users shuld be able t use nline access t data centers as much as pssible, but als be able t use ffline access (using secured lcal data) when they are using raming devices that cannt be always cnnected t the crprate netwrk. Depending n where the data is, and hw it is accessed, there are additinal specific cnsideratins Data n the Lcal Device If there are peratinal r ther reasns that dictate that sme data may be cached r therwise stred n the lcal device, it is essential that the full implicatins f this are critically assessed, 18

19 and prcedures put in place t mitigate any risk t the enterprise, such as in the event that the device is lst r stlen. Key issues t cnsider fr all devices that may stre sensitive data are: Can lcal data be encrypted? Are there prtected data strage areas n the device? Des the device supprt remvable strage devices such as SD cards r USB drives? If remvable strage is available, can access t this strage be disabled? What lcal data and settings shuld be backed up, and hw? Hw d yu prtect against malicius sftware? Fr example, using VDI fr accessing crprate resurces helps t keep a clear, prtective barrier between ptentially infected user devices, such as smartphnes r slates, and the enterprise. The virtual desktp itself is kept within the firewall, and as lng as the device s VDI client des nt permit lcal data t be cpied r transferred t the virtual desktp, any malicius sftware n the client cannt affect netwrk resurces. Effective strategies fr dealing with malicius sftware are particularly imprtant n devices that may hld lcal cpies f sensitive data r be running lcal applicatins that access crprate resurces. Fr example, there shuld be systems in place t deal with endpint security, such as antivirus and rtkit prtectin. Fr newer devices, there can be an initial perid when it appears that the device is nt a target fr malicius sftware. Hwever, as the number f such devices increases, the prevalence f malicius sftware inevitably als rises. Antivirus vendrs are reprting that mbile malicius sftware is becming an increasing prblem, due bth t the numbers f smartphnes and similar devices, and the fact that mst are nw cnnected t the Internet Data in the Clud r Crprate Data Center Only Wherever pssible, data shuld reside within prtected cluds r data centers. In this way, data shuld nt be expsed n the lcal device. Key issues t cnsider where data is stred in the clud r data center are: Hw will reliable netwrk access t this data be delivered? Are there specific netwrk requirements such as requirements fr firewalls? D access technlgies, such as Windws Media Digital Rights Management, need t be supprted? Fr example, if the device is using a clud-based applicatin, such as an Office Web App, all data can be kept in the clud strage. If the enterprise has implemented plicies, such as rights management, t cntrl wh can access and edit dcuments, fr example, these plicies can be applied in the clud applicatin and will be enfrced lcally at the client. One way f ding this is by using Office Web Apps thrugh a Web brwser, which will autmatically respect nline rights management plicies, regardless f the device being used. 19

20 6.5.3 Enabling Netwrk Access All BYO devices shuld be treated as untrusted devices when they are cnnected t crprate netwrks, in the same way as devices such as hme cmputers that are using remte access. One apprach is t cnfigure yur infrastructure s that such devices are nt able t cnnect t trusted resurces, even when they are used within the wrkplace. One way f ding this is by using switch-level prtectin t prevent untrusted devices frm being physically plugged int the crprate lcal area netwrk (LAN). Key issues t cnsider when planning fr enabling netwrk access are: What technlgies are in place fr enabling netwrk access? Can the netwrk infrastructure be cnfigured t permit untrusted devices? Are there any netwrk access limitatins n any prpsed devices? Fr example, fr mbile devices, there are several cmmn appraches fr prviding netwrk access t crprate resurces: Virtual private netwrks (VPNs). VPNs are ne way t access crprate resurces, thrugh a secure, private channel frm the endpint. Fr Windws-based cmputers, and fr ther platfrms such as Macintsh and Linux, the ability t supprt multiple VPNs is typically built in t the perating system. Hwever, fr smaller frm-factr devices, there may be limited supprt fr VPNs, r the ability t cnfigure nly a single VPN cnfiguratin. Reverse prxies. Reverse prxies are used as an alternative t direct cnnectins t endpints. They prvide an extra prtective layer between the crprate resurces, such as Exchange servers, and external devices. Reverse prxies enable Secure Sckets Layer (SSL) encryptin and acceleratin services t be ffladed frm the endpint service, and als prvide lad balancing where the reverse prxy server can distribute all f the traffic that is targeted fr a single URL t a grup f endpint servers Enfrcing Netwrk Security There are varius methds that can be used t restrict netwrk access t cmpliant devices nly. Withut such cntrls, it is difficult t ensure that a cmprmised device, such as a smartphne, des nt then als cmprmise the crprate netwrk when it is cnnected. Key issues t cnsider when planning fr netwrk security are: Des the device supprt any access prtectin technlgy? What mechanisms will there be fr users t get their wn devices int cmpliance? Fr example, n Windws-based cmputers, yu can use netwrk access prtectin (NAP) t cntrl access t netwrk resurces based n a client cmputer s identity and cmpliance with crprate gvernance plicy. If a client is nt cmpliant, NAP prvides a mechanism t autmatically bring the client back int cmpliance and then dynamically increase its level f netwrk access. Fr BYO devices, it is imprtant t cnsider whether tls, such as Web prtals, 20

21 can be prvided s that users can deal with perating system and plicy updates themselves if their device is identified as being ut f cmpliance User Authenticatin User authenticatin prcedures first cnfirm the identity f any user wh is trying t access prtected resurces, and then enable user access t permitted resurces. Key issues t cnsider when planning fr user authenticatin are: On cnsumer devices, hw will multiple identities be managed? Des the device supprt user names, persnal identificatin numbers (PINs), and passwrds? Des the device supprt smart cards r bimetric authenticatin methds? Is multifactr authenticatin supprted, such as user name and passwrd plus certificates? Fr example, a user s persnal identity, such as his Windws Live ID, and his wrk identity, such as his dmain lgn and crprate address, may affect which applicatins can be run if a persnal certificate is required. There is als the issue f persnal and crprate data that may cexist n the same device, but be subject t separate identities fr data access cntrls. Where VDI slutins are used t access server-hsted virtual desktps, yu can use Active Directry t identify active users n the netwrk, in the same way as fr dmain-jined regular cmputers. Devices, such as nn-windws-based slates, d nt supprt this unless using a VDI slutin. On larger frm-factr devices, such as Windws-based cmputers, yu can use smart cards t verify user identity befre any netwrk cnnectin can be made. Smaller devices may nt have the necessary hardware supprt fr smart cards r bimetric scanners. 6.6 Hw Will Devices Be Managed? The range f devices that cnsumerizatin may intrduce int the wrkplace presents IT with several management-related challenges. Fr crprately wned cmputers, a high level f device management can be achieved. In ther cases, nly limited management may be pssible. The key management issues include: What devices are in use, and wh is using each device? What applicatins are n each device, and are these applicatins supprted and licensed? Is each device up t date with updates, fixes, applicatins, and s n? In the event f security prblems, are mechanisms available fr rapidly clsing such breaches? Can security plicies, such as passwrd cmplexity, be easily enfrced? What supprt, r remte assistance, is required, and is this required 24/7? What tls are available fr devices that rarely cnnect t the crprate LAN? 21

22 Fr example, there are several types f technlgy that yu can use t impse sme frm f management n cnsumer devices: Crss-platfrm tls such as Exchange ActiveSync. Windws-based tls such as System Center Cnfiguratin Manager and Windws Intune. Nn-Windws-based tls such as the Apple iphne Cnfiguratin Utility and Mbile Device Management (MDM) applicatin prgramming interfaces (APIs). 6.7 Hw Will User Respnsibilities Be Managed? Successful management f cnsumerizatin is nt just abut technlgy; effective rganizatinal and emplyment plicies als have their place. Fr example, if BitLcker r ther third-party encryptin is required as part f a precnditin fr cnnecting a device t the crprate netwrk, the legal implicatins f encrypting data n a persnal system shuld first be fully investigated. It may be useful t include clauses in emplyment plicies n the use f emplyees wn devices, defining what rights the emplyee has and what rights the emplyer has. These plicies culd include: User agreement t accept device requirements such as passwrd enfrcement. Any rights the rganizatin has t wipe devices remtely, such as if the device is lst r the user leaves the cmpany. Any cmmitment the rganizatin has t supply temprary lan devices if a user s BYO device is brken. Even if a warranty is required, there will ften be a perid f unavailability. The enterprise shuld set ut clear rules s that nly when emplyees sign the relevant dcument r cntract d they get access t crprate resurces thrugh their supprted devices. 7 Slutins fr Managing Cnsumerizatin in the Enterprise This sectin describes several example slutins fr managing cnsumerizatin in the enterprise, within highly managed crprate envirnments and in mre dispersed rganizatins, and fr bth Windws-based and nn-windws-based devices. Figure 3 shws hw the key Micrsft technlgies in these slutins rate in terms f typical csts, level f required cntrl, and client impact. 22

23 Figure 3. Key Micrsft enabling technlgies rated fr csts, cntrl, and client impact. 7.1 PCs and Slates The best apprach fr managing BYO PCs, Macintshes, and slates in the enterprise depends n the types f device that IT is expected t manage Windws Optimized Desktp The Windws Optimized Desktp cmbines Micrsft slutins fr desktps thrugh t data center management acrss physical and virtual envirnments. At the base level is client infrastructure, including Windws 7 as the desktp perating system, Windws Internet Explrer 8 as the brwser, and MDOP. The infrastructure fr Windws 7 Enterprise and Windws Server 2008 R2 supprts client features such as BranchCache and DirectAccess. In additin, thrugh Hyper-V, it supprts VDI envirnments. Management tls in System Center and security technlgies in Micrsft Frefrnt supprt the client and server cmpnents. Management tls, such as System Center and MDOP, prvide the security, access, and applicatin ptimizatin tls fr lcally deplyed systems, and fr systems and applicatins that are hsted n-premises in the data center: Applicatin management. In Windws Optimized Desktp envirnments, yu can use a managed deplyment apprach, using sftware such as System Center Cnfiguratin Manager r Micrsft System Center Essentials, t deply Windws-based applicatins t Windws-based cmputers. Using this apprach, yu can deply applicatins t large 23

24 numbers f cmputers at the same time. Fr Windws-based PCs, slates, and tablets, the AppLcker feature in Windws 7 Enterprise enables administratrs t create a whitelist f apprved prgrams that can be selected individually by file hash, in grups by lcatin, r in grups by publisher (signed by the publisher's certificate). After Windws 7 clients using Grup Plicy have dwnladed AppLcker rules, nly the whitelisted applicatins are permitted t execute. Lcal data security. Fr Windws-based cmputers, BitLcker Drive Encryptin is a data prtectin feature that uses a prtected strage area at the vlume level. BitLcker is integrated with the perating system t address threats f data theft r unauthrized data access, primarily frm lst r stlen prtable cmputers. BitLcker is available in Windws 7 Ultimate and Windws 7 Enterprise. In mre managed envirnments, yu can use the Encrypting File System (EFS) t prtect specific files and flders n prtable cmputers, desktps, and servers. EFS encrypts the cntents f prtected dcuments and enables users t chse the dcuments that they want t encrypt. Remvable strage. In Windws 7 Enterprise, BitLcker T G extends BitLcker Drive Encryptin prtectin t USB remvable strage devices. Backups. Where data is stred and manipulated n the lcal device, it is essential fr this data t be prtected and backed up. Fr Windws-based tablets and slates, yu can use the built-in Windws 7 backup tls t back up data t USB and ther external devices. Where devices have regular access t crprate netwrks, yu can use technlgies such as Micrsft System Center Data Prtectin Manager 2010 fr rapid backups where nly blck-level changes are cpied. Fr mbile Windws-based cmputers, System Center Data Prtectin Manager 2010 can als take snapsht backups ffline that are autmatically synchrnized t central backup servers when they are next cnnected t the crprate LAN. Hwever, where, fr example, a prtable cmputer is used fr bth wrk and nn-wrk tasks, the challenge is hw t back up just enterprise data and nt t use crprate resurces t back up nn-wrk-related infrmatin. Netwrk access. Micrsft Frefrnt User Access Gateway (Frefrnt UAG) can prvide reverse prxy services fr Exchange and Internet Infrmatin Services (IIS) servers, in additin t ding s fr ther crprate services. Fr Windws Phne 7, fr example, data transmissin is encrypted by using 128-bit r 256-bit SSL encryptin, thrugh reverse prxies that are hsted by Frefrnt UAG. Netwrk security. On Windws-based cmputers, NAP prvides a range f enfrcement ptins: IPsec Enfrcement. Unless the cmputer is cmpliant, n IPsec cmmunicatins with ther cmputers are permitted X Enfrcement. Unless the cmputer is cmpliant, nly limited cmmunicatins acrss any 802.1X-authenticated netwrk cnnectin, such as t an authenticating Ethernet switch r an IEEE wireless access pint (AP), are permitted. 24

25 VPN Enfrcement. Unless the cmputer is cmpliant, nly limited cmmunicatins ver a VPN cnnectin are permitted. DHCP Enfrcement. Unless the cmputer is cmpliant, nly a restricted IPv4 address will be leased t the cmputer. Such an address nly permits access t a restricted netwrk. Fr mre infrmatin abut NAP, see the Netwrk Access Prtectin page at Other appraches t ensuring cmpliance include management tls such as System Center Cnfiguratin Manager, which yu can use t identify devices that have n r limited encryptin, n antivirus, r d nt have up-t-date perating system r applicatin updates. User authenticatin. All Windws-based cmputers use user names and passwrds. Fr Windws-based cmputers, yu can use lcal r dmain plicies t set required passwrd cmplexity and passwrd renewal perids Windws with Windws Intune Fr rganizatins that d nt have the resurces r infrastructure t supprt the cmplete Windws Optimized Desktp strategy, Windws Intune can help deliver the management and security essentials. Windws Intune is a clud-based management slutin that brings tgether Micrsft clud services fr PC management and endpint prtectin with upgrade rights t Windws 7 Enterprise and future versins f Windws. Using Windws Intune, IT can give wrkers the best Windws experience with the latest Windws-based perating systems and keep thse PCs current and prtected with the Windws Intune clud service. Windws Intune delivers management and prtectin thrugh an easy-t-use, Web-based cnsle. IT gets immediate insight int the user s PC envirnment and can view the status f updates and malicius sftware, alerts, security plicies, hardware and sftware inventry, and mre. All that is needed is an Internet cnnectin and the Windws Intune client installed n each managed PC. Windws Intune can help t deliver the essentials f management and prtectin updates, endpint prtectin, and asset inventry t unmanaged and lightly managed devices. Windws Intune des nt require Windws-based cmputers t be part f an Active Directry dmain. Fr Windws-based prtable cmputers, slates, r tablets, Windws Intune prvides an effective, clud-based management and prtectin slutin. Fr users wh are part f a BYOPC prgram, Windws Intune includes rights t deply Windws 7 Enterprise n that PC in additin t managing and prtecting that PC with the clud service. The underlying license requirement t purchase and deply Windws Intune is Windws 7 Prfessinal, Windws 7 Business, r higher editins. Windws Intune supprts PCs nly, and the fllwing versins f Windws editins: Windws 7 Enterprise, Ultimate, and Prfessinal Windws Vista Enterprise, Ultimate, and Business Windws XP Prfessinal with Service Pack 2 (SP2) r later (SP3 is recmmended) 25