Stress-free mobility A mobile framework for the extended enterprise. April 29, 2015

Transcription

1 Stress-free mobility A mobile framework for the extended enterprise April 29, 2015

2 Presenter: Tony Winston Senior Manager EY Advisory Digital & Enabling Technology More than 25 years of experience in information technology (IT) innovation and strategic architecture initiatives in large enterprises Twelve years of specialized experience in strategic mobility initiatives; excels as a trusted advisor to C-level and enterprise mobility managers, helping to guide their decisions on enabling mobile IT Page 2

3 Today s objectives Define an enterprise context of mobile users, apps and devices Evaluate enterprise mobility management (EMM) components of an unmanaged device solution Propose a pattern to securely support unmanaged devices Demonstrate a multi-vendor solution Q&A Page 3

4 Expected takeaway for you An understanding of an architectural pattern that mobility managers can use to empower secured mobile access to enterprise data on mobile devices Page 4

5 The enterprise app market is growing at 2 to 3 times the rate of EMM adoption Corporate mobile app market Enterprises don t have adequate security and management platforms to support the demand EMM Mobile enterprise app market acceleration Page 5

6 You need a mobile strategy to enable the extended enterprise Effective mobile strategy Page 6

7 Page 7 The enterprise mobile scenarios

8 Scenario 1 Effective mobile strategy Company-provided devices are managed, secured and audited with enterprise tools Challenges Employees enroll devices to mobile device management (MDM) and mobile application management (MAM) to gain access to internal app stores and apps. Security is maintained at the device level. MDM/MAM checks for jailbroken devices, and MDM provides limited white/black lists. The UX is poor. If personal use is allowed, it exposes a number of security risks of rogue apps that can trace history and view personal data. The device can expose the complete enterprise network when it is remotely connected via Wi-Fi or virtual private network (VPN). MDM monitors security, enforces policy and wipes devices. Page 8

9 Scenario 2 Effective mobile strategy BYO devices can sometimes be unmanaged, using security containers to enable access Challenges MAM is used to manage user access and push apps to devices. The use-case consists of , and simple apps are provided through independent security containers. You have limited control over what employees put on their personal devices. Employees devices could be jailbroken or contain risky apps, games or viruses. There are limited collaboration features, and apps exist as separate secured sandboxes. Your apps are in a hostile environment. Page 9

10 Scenario 3 Effective mobile strategy Extended workforce members are provided managed devices, locked down with extensive controls Challenges In many cases contractors are still being given Blackberries or fully managed smartphones. You probably trust extended users even less than you trust your employees with BYO. They are allowed limited access to and ticket systems for support and service management. We have not yet identified the partner access model with the wide variety of mobile devices and the lack of identity for users. Locked down smartphones lose usability, and app developers are not providing enough support for Blackberries. There are more security concerns connecting partner and contractor devices to the protected network. Page 10

11 The fact is, today s workforce expects a native experience on mobile devices Employees treat corporate mobile devices as if they were their own. They want to install apps, play games, take photos, record videos and use social networks; if not, employees barely use the corporate device. This creates a silent abandonment of company mobile devices Page 11

12 The usage gap for connected enterprise mobile apps and device usability In an app-centric world, organizations are failing to enjoy mobility s benefits. Driven by the lack of a delightful user experience balanced with simple enterprise integration. Employees abandon corporate 43% 26% mobile apps Employees using corporate mobile apps report a loss of productivity Mobiquity Commissioned Survey, Oct. 2013, Employee Mobile App Satisfaction Report Page 12

13 What is needed? A way to enable all mobile users on approved devices to securely download corporate apps and connect to the workforce A way to enable the IT security principles, providing as good or better security for mobile devices than what is used for desktops, laptops and other managed devices Active controls to regularly check the device for known risk vectors and be able to self-protect from known risks An ecosystem of apps that inter-operate and provide a desktop-like experience on mobile devices Page 13

14 Architecture for EMM Page 14

15 The representative solution architecture You need a holistic approach to EMM Enterprise integration (Certificate services, identity, logging, directories, notification) Operations/support MDM MAM Remote access Service desk Support desk Security desk Policies, access control, identity Audit/analytics/monitoring Security Page 15

16 Managed device Unmanaged device Security MDM MAM Enterprise integration (Certificate services, identity, logging, directories, notification) Operations/support Remote access Service Support Security desk desk desk Policies, access control, identity Audit/analytics/monitoring Security The same security controls applied to managed devices are needed for unmanaged devices Remote access (secured VPN) Data loss protection Malware protection/ Self-defense self-defense Authentication (two-factor, credential/certificate-based) Encryption Management (provisioning, analytics, audit, etc.) Technology stack The difference is that the controls must be implemented in a different layer of the technology stack Page 16

17 MDM and MAM MDM MAM Enterprise integration (Certificate services, identity, logging, directories, notification) Operations/support Remote access Service Support Security desk desk desk Policies, access control, identity Audit/analytics/monitoring Security MDM MAM Remote configuration and provisioning App delivery Security Asset tracking and management Remote lock and wipe Device provisioning Software installation App delivery Security Reporting and tracking Policy enforcement Access control list Geo-fencing You need to track devices, manage the app life cycle and balance the use of MDM and MAM Page 17

18 Remote access MDM MAM Enterprise integration (Certificate services, identity, logging, directories, notification) Operations/support Remote access Service Support Security desk desk desk Policies, access control, identity Audit/analytics/monitoring Security The next-generation remote access for mobile use-cases must be purpose-built from the ground up. Requires multi-factor authentication Scaling and high performance to support the volume of extended enterprise user base Enforces contextual policy at the edge of the protected network Appliance-based, hardened with high availability and reliability Uses the demilitarized zone as the enterprise endpoint Page 18

19 Enterprise integration MDM MAM Enterprise integration (Certificate services, identity, logging, directories, notification) Operations/support Remote access Service Support Security desk desk desk Policies, access control, identity Audit/analytics/monitoring Security Having an effective strategy for integrating mobile devices with existing security mechanisms is a key design decision in our blueprint. Certificate services Necessary for two-factor authorization and authentication User access Access to the network and applications should be validated against an authorized identity store Event services Needed for compliance management and auditing Page 19

20 IT wants to support Corporate devices, Employee-owned devices, Devices being used by our extended partners All with the same architecture and the same security approach Page 20

21 Page 21 How can you support the scenarios?

22 There are key decisions that IT must make before supporting unmanaged devices Mobile devices should be treated as compromised and at-risk; therefore, should never connect to your protected network domain You must take network, device, management, policy and support steps to keep the devices from directly connecting to your environment Recognize this is an enterprise solution and must build on what is already in place, i.e., network, Infosec, HR and identity teams active in this effort Page 22

23 Move your security context into the application layer Take the device out of the equation Secure apps using a container Use a container which is secure, resilient and can provide remote access to your network Enable two-factor security mechanisms for authorizations Allow secured collaboration between apps App 1 App federation Page 23

24 Use the technologies in your EMM framework to make it happen Use MDM/MAM where appropriate for your environment Enable remote access through your application layer Enable security controls for authorization and authentication There are some key device-centric policies you may need that MAM can t help you with, so you may need both Use a VPN session within the app Use an enterprise grade remote access/security appliance at the edge of your network; minimum two-factor authentication Provide two-factor authentication, with a set of enterprise credentials to be able to identify users Authenticate to the network with a high degree of trust and then use that to authenticate to your apps Enable the entire EMM framework Auditing, analytics and support are table stakes when deploying any technology Page 24

25 The approach is designed to preserve the native user experience Devices look like the out-of-the-box platform Enterprise apps deployed and work like general apps The security controls embedded within the app federation protect You ve got to start with the customer experience and work back toward the technology not the other way around. Steve Jobs Page 25

26 Summary Mobile devices are consumer technology that you are trying to bring into the enterprise. If you are a security-sensitive organization, an architecture of this sort is a prerequisite for the mainstream mobilization of your infrastructure. The approach can be applied across mobility in general; if properly designed, you can seamlessly support your extended enterprise. Complexities exist because there isn t a single technology solution that can implement the complete pattern, so you may need an experienced partner for assistance. Page 26

27 EY provides industry-leading mobile services IT digital strategy IT digital operating model Enterprise architecture Our IT Digital Strategy service offering helps organizations quickly identify how digital technologies can fuel high performance by partnering with business and IT leaders to plan and deploy digital technologies to enable differentiation and drive a competitive advantage. This service offering helps companies access and respond to increasing business demands and develop actionable roadmaps to keep pace with a rapidly evolving digital technology landscape. Our IT Digital Operating Model service offering focuses on helping clients achieve the ability to prioritize, develop, manage and support digital solutions. We focus on helping IT to establish the ideal organizational structure, governance forums and operational processes required to manage digital solutions. This may include establishing a Digital Center of Excellence (COE) to help incubate new capabilities or provide a central point of access to specialized skill sets for the organization. Our Enterprise Architecture service offering helps organizations establish and implement architectural strategies and standards that promote the development of integrated, scalable, extensible and reusable digital solutions. Working with both the business and IT and leveraging industry best-leading practices, we help define agile and flexible digital standards and principles that can adapt to rapidly changing technology landscapes and business environments while maintaining a secure well structured environment. Platform architecture Our Platform Architecture service offering focuses on identifying and establishing technology platforms that accelerate the development and simplify the management of digital solutions. Our frameworks and accelerators enable IT to meet rapidly rising expectation around development time, interoperability and user experience. Solution architecture Our Solution Architecture service offering focuses on working within the business and IT to develop digital solutions and cost estimates leveraging selected digital information system or applications to meet both functional and nonfunctional requirements as well as align to standard architectural principles. Page 27

28 Thank you We welcome your inquiries Greg Jenko Americas Lead Digital & Enabling Technology Paul Chabot Enterprise Mobility Strategy Lead Digital & Enabling Technology Tony Winston Senior Manager and Mobile Strategist Digital & Enabling Technology Digital & Enabling Technology Page 28

29 Demonstration Page 29

30 EY Assurance Tax Transactions Advisory About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organization and may refer to one or more of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com EYGM Limited. All Rights Reserved This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax, or other professional advice. Please refer to your advisors for specific advice. ey.com