The BYOD Gap: Trends, Stra t egy, and t h e Sta t e of M obile Device M a n age m en t

Transcription

1 The BYOD Gap: Trends, Stra t egy, and t h e Sta t e of M obile Device M a n age m en t Trends, strategy, and the state of m obile device management Reference Code: IT Publication Da te: 2 5 Oct Author: Richard Absalom SUMMARY Catalyst The marketing strategies of the two dominant players in the smartphone market are favoring the consumer distribution channel over the enterprise distribution channel. Apple, and now Android, have driven huge growth in the consumer market, but they do not have a direct sales channel into t he enterprise. Enterprises have not been able to keep pace with innovations in terms of providing devices for their employees, and are now dealing with a growing demand to use personal devices at work. This trend towards BYOD (bring your own device) in the enterprise is still at an immature phase and is not certain to become a long-term phenomenon, but supply-side vendors are certainly very bullish about it: Cisco predicts that 94% of organizations will have a BYOD policy in place by BYOD has spawned a huge market opportunity for vendors further down the value chain. Mobile device management (MDM) platform vendors have seen extraordinary growth over the last 12 months, as they offer support to enterprises needing to cope with an influx of new platforms and devices on to the corporate network. Ovum view The BYOD gap: enterprises are behind t he consu mer curve in mobile device innovation The BYOD trend is a function of Apple s above-the-line marketing strategy, creating demand in the consumer market but not servicing the enterprise. Other players, notably Ovum. Unauthorized reproduction prohibited Page 1

2 Android, have followed Apple s strategy, compounding the issue. Apart from BlackBerry, the most popular consumer OS providers do not focus on selling to the enterprise. Adoption of popular technologies and mobile devices generally follows an S-curve: early adopters test them and make the case for widespread adoption, the device then takes hold in the mass market and adoption rates soar, and finally the S-curve levels out as demand is met and the market meets saturation point. In the past, enterprises have driven mass adoption of devices by entering the curve after the early adopters but before the early majority. However, the popularity of ios and Android devices, which have been targeted at consumers rather than businesses from the start, means that enterprises are now only entering the curve after these devices have reached mass market adoption. The high growth period on the curve between the enterprise's normal and actual points of entry can be called the "BYOD gap." The enterprise faces device and data security and managemen t challenges As companies try to plug this gap by rolling out BYOD policies, they face challenges over device and data security and management, and the resultant increasing costs at the service desk level. IT departments require competencies across a range of devices and platforms, and man hours are extended in order to support them all. Furthermore, solutions that manage corporate data access and maintain data security differ from provider to provider, and are expensive to imple men t. Businesses are meeting these challenges in a variety of ways, with policies differing between companies based on: specific data security requirements, employee demand, which devices enhance productivity and value, and which devices best suit the tasks in hand. Any policy needs to have buy-in from employees if their personal devices are liable to be remotely accessed, wiped, or requisitioned by the company, they need to understand the terms and have given consent. MDM platform vendors make the most of BYOD The major beneficiaries of the BYOD phenomenon are mobile device management (MDM) platform vendors. With organizations of all kinds facing device and data security and management challenges, MDM vendors are providing third-party support to enable IT departments to cope with the influx of different devices and platforms. Because the ramifications of a major data loss or leakage incident through usage of personal devices are so huge, enterprises are flocking towards MDM vendors and view their costs as a price worth paying to maintain security. Ovum. Unauthorized reproduction prohibited Page 2

3 Consequently, mobile device management is a bubble market. There are many players, including specifically focused start-ups, and they are going through a period of extraordinary growth as more and more businesses roll out BYOD schemes. While this growth period may continue for another three or four years, the immaturity of the vendor landscape means that there will be a shake-out during the same period. There are also a variety of IT service management (ITSM) companies and security providers in the space, and the first movers are at a strategic advantage. With first movers having already built up a strong brand presence and customer base, it will be tough for new entrants to succeed especially start-ups that cannot exploit the kind of brand and customer base that a major ITSM provider will have. BYOD is here to stay as long as Apple and Google maintain current strategies Apple and Google s model of selling only to consumers means that the distribution channel for mobile devices into the enterprise is shifting away from the "traditional" model of selling in bulk through the IT department. With the two companies driving BYOD, the individual consu mer will increasingly be the pri mary channel into the enterprise. The constant stream of new mobile devices pushed by manufacturers to consumers means that BYOD is here to stay, at least in the medium term. Consumers are willing and able to replace their mobile phone or tablet at a quicker rate than their employer can afford to, and they expect to be able to use their latest gadget to improve productivity in the workplace. Apple currently dominates when it comes to the type of consumer-owned device being brought into work, and its periodic releases of new iphones, ipads and ios make it relatively easy for organizations to keep these employee-owned devices manageable and secure. However, Android is quickly gaining market share among consumers and is being seen more and more in the enterprise, while Windows Phone is set for a major marketing push and could see increased penetration in the workplace. These operating systems are dispersed across an ever-increasing number of new devices, and each new device or platform that is brought into the workplace provides another data security and management challenge. This rate of innovation means that MDM vendors are also here to stay. It is unrealistic for most IT departments to keep up with every device, platform, and API update needed to keep their data secure, whereas MDM vendors make this their full time occupation. So while growth in the MDM market will flatten out eventually, vendor services will still be required and enterprises will need to maintain relationships with the m. Ovum. Unauthorized reproduction prohibited Page 3

4 Key messages BYOD and the consumerization of IT are here to stay, at least in the medium term. As long as Apple and Google maintain their consumer-focused sales strategies, the distribution channel for mobile devices into the enterprise will shift further towards the individual consumer and away from the IT department. Maintaining data security is critical for any organization, and the challenges in maintaining security across a wide range of devices has led to a huge opportunity for MDM, security software, enterprise application, and ITSM vendors. In the BYOD environment, it is far easier for the enterprise to entrust its mobile device management to a specialist than to keep it in-house. The independent software vendor (ISV) landscape supporting BYOD remains im mature. The large number of companies rolling out some kind of BYOD scheme means that the mobile device management ecosystem is going through a period of extraordinary growth which may last for another three or four years, but the huge number of vendors will lead to an inevitable shake-out. This market im maturity means that there is an opportunity for first movers to gain a strategic advantage. With so many MDM vendors and other service providers already in the space, any new joiners will face a struggle to gain market share. Likely winners in the market shake-out will be specialist MDM vendors which have already built up a strong marketing model and customer base, and big ITSM vendors taking advantage of their brand and existing clientele to move in to the space. WHAT IS THE BYOD GAP? Enterprises have not kept pace with innovations in consumer devices Driven by the popularity of the iphone and the competing Android platform, the consumer mobile device market has shown enormous growth over the past few years. Enterprises have not been able to keep pace with innovations in providing devices for their employees, and this has led to the "BYOD gap." Where mass device adoption was once driven by businesses before filtering into the consumer market, enterprises are now only starting to adopt devices once the devices have seen mass consu mer uptake. Adoption of popular technologies and mobile devices generally follows an S-curve, as outlined in Figure 1: early adopters test them and make the case for widespread adoption the device then takes hold in the mass market and adoption rates soar finally, the S-curve levels out as demand is met and the market meets saturation point. Ovum. Unauthorized reproduction prohibited Page 4

5 In the past, enterprises have driven mass adoption of devices by entering the "curve" after the early adopters but before the early majority. BlackBerry is a good example of this: designed for, and driven by, the enterprise, due to its "killer app" of providing secure access to , the device took hold in the business world first before it started to appeal to consumers as well. However, the popularity of ios and Android devices, which have been targeted at consumers rather than businesses from the start, means that enterprises are now only entering the curve once these devices have already reached mass market adoption. The high-growth period on the curve between the enterprise's normal and actual points of entry can be called the "BYOD gap." Mobile device adoption framework the BYOD Gap Source: Ovum What the BYOD gap means for enterprises Consumer (and therefore employee) lifestyles, rather than the business needs of the enterprise, have driven the BYOD trend. While there has always been a small number of Ovum. Unauthorized reproduction prohibited Page 5

6 early adopters who choose to use their own devices at work regardless of existing policy, managers now find themselves in a position where a much larger proportion of employees are setting the agenda on what devices they feel they should be able to use at work. C- suite executives are consumers as well, of course, and are often the major drivers behind the rollout of a comprehensive BYOD policy within their organization. After all, when the CEO wants to hook up their latest toy to the corporate network, it is hard for the CIO to say no. Increasing costs around device and data security In schemes driven from the board level, organizations are adapting their own policies and strategies in order to satisfy employees but are encountering issues around security, cost, and manage ment. For IT departments, the primary challenge posed by a BYOD policy concerns systems administration. Most companies are set up to support one particular mobile device (normally BlackBerry), and adding numerous extra supportable devices increases both resource requirements and costs. Given that system administrators will have been hired and trained based on expertise around one particular device or set of devices, there is also a likelihood that they will not have the required competencies to deal with the influx of new platfor ms. Personally owned devices in the enterprise can also create problems around data and device security and management. It is much harder for IT departments to control what data can be accessed and sent from a personally owned device, and implementing data leakage prevention solutions that control which employees have access to what data can be very costly. The ability to wipe data remotely from lost or stolen devices, or from that of an exemployee, is critical for organizations in vertical markets which place extremely high importance on data security. While data-wiping is easy to justify on company-owned devices, it is a harder proposition to convince employees to allow it on their own. Solutions that can differentiate between what is work-related and what is personal on any given device, and wipe accordingly, can be expensive to implement. Similarly, security requirements in certain markets demand a high level of encryption, and any supported handsets must mee t these require ments. The different capabilities and functionalities offered by different mobile platforms also present problems for companies trying to manage a BYOD policy. While data-wiping and encryption, not to mention specific applications, may be available on some platforms, they will not be available on others. If not managing the whole scheme internally, companies Ovum. Unauthorized reproduction prohibited Page 6

7 also need to be careful when selecting MDM vendors. Different MDM vendors cater for different platforms the management tools that they provide for one may not be available on another. Finding a solution that is able to manage the required range of devices is going to add extra cost. IT policies and employee management Implementing and enforcing a mobile device policy for all employees is vital for any organization running any kind of BYOD scheme. Of course, this is going to be different for every organization as it needs to take into account several factors: specific data security requirements employee demand/expectation which devices enhance productivity and value which devices best suit the tasks in hand. Whatever the policy, employees must be aware of their obligations and the risks involved in using personally owned devices for work applications. For example, Unisys requires employees to turn their devices over to the company in cases of litigation, and Tellabs employees must sign an ethics policy agreement and allow security features to be installed on their phones before being allowed to bring them into work. If data on personal devices may be wiped by the company, employees need to know about it and agree to it. A BYOD policy, then, cannot just be driven from the IT department. It needs every part of the organization in which it will be implemented to buy into it, and it needs to be driven from board-level down. BYOD creates work for the CIO but requires attitudinal change There has been speculation that BYOD, together with BYOC (bring your own computer), SaaS, enterprise application stores, open access to public data sources, and other aspects of IT consumerization, will spell a reduction in the CIO s job role, with employees and workgroups procuring IT services directly and accessing them via their own devices. However, it is not as simple as that. While a BYOD policy is driven from the top down and requires buy-in from everyone that it affects, the CIO has to be responsible for managing it centrally. A BYOD policy is not simply a case of careful planning and implementation although that is a large and difficult project in itself. Rather, a BYOD policy requires constant monitoring and updating to accom modate new devices, operating systems, applications, and specific corporate requirements. CIOs need to determine which devices and applications are allowed, and keep employees informed of any updates. Ovum. Unauthorized reproduction prohibited Page 7

8 So, the job of managing all these devices may actually create a lot of work for the CIO. The CIO will always need to be aware of what devices should be allowed on the network and be able to dictate and monitor which data and applications different employees are allowed to use, and on which devices. This workload can be managed more easily if working with a MDM vendor, but there will always be the need for someone within the organization to take overall responsibility for e mployee-owned device usage at work t he CIO. However, BYOD requires a certain amount of attitudinal change for the CIO. Whereas it has been the CIO s role to lock down and control the devices and data on the corporate network, limiting the number of platforms as much as possible, there has now been a reversal. BYOD means that the CIO needs to make the network open to as many platforms and devices as possible. And instead of making an independent decision on which platforms to support, the CIO now has to consider employee desires. Julie Palen, senior vice president of MDM technology at Tangoe, compares this shift in relationship between IT and employees from that of a parent and child to more of an equal partnership. Whereas employees used to look to the IT department for support, guidance, and authority, they now have more independence and a voice in how things are run. BYOD IS A REACTION TO APPLE'S LACK OF INTEREST IN SELLING TO THE ENTERPRISE Apple has no need to sell directly to businesses, but businesses want Apple Apple seems to be going backwards in terms of enterprise sales, with secondary resellers going out of business due to the growing number of physical Apple stores and the growth of its online store. Whereas Apple previously supported creative agencies, the hardware business has now gone online and the Mac software business is dying due to the growth of applications. Apple relies on the high margins provided by selling devices to individual consumers, and is not interested in cutting those margins by selling in bulk to the enterprise through mobile operators and other resellers. However, even if Apple is not interested in selling to the enterprise, enterprises are growing keener to provide Apple products for their employees albeit slowly. Ovum survey data from over 600 CIO respondents worldwide showed that in early 2011, around 13% of all company-owned smartphones were manufactured by Apple. This share is set to grow to 15% by The Ovum survey data also predicts that BlackBerry s 43% share in 2011 will decline to 39% by It will still be the dominant platform but is seeing its share reduced by uptake of Apple and Android, the latter of which is expected to account for 9% of corporate devices in 2013 (up from 4% in 2011). Ovum. Unauthorized reproduction prohibited Page 8

9 When it comes to tablets, Apple has a hold on the corporate market as strong as its hold on the consumer segment. Survey data from US-based enterprise mobility services provider ipass indicates that the ipad and ipad 2 have 72% of the global tablet share among mobile workers, and this dominance is expected to continue over the next couple of years. And these mobile workers want to (and do) use their tablets at work, even if they are personally owned only 12% do not use their device at work at all. Video conferencing (66% of users) and taking notes in meetings (48%) are the productivity applications that mobile workers most want to use tablets for. Prosumers want to bring their Apple and Android devices into the office The BYOD trend is a function of Apple s above-the-line marketing strategy, creating demand in the consumer market but not servicing the enterprise. Other players (notably Android) have followed Apple s strategy, compounding the issue apart from BlackBerry, the most popular consumer OS providers do not also cater for the enterprise. Consumers who buy into Apple devices do so for the "lifestyle" element. Apple's "there's an app for that" slogan targets middle-class workers and aims to provide applications that enhance their daily lives. Apple customers buy into the idea of having a device that they are able to use in all aspects of their social life, and do not see why they should not be able to use it at work as well. iphones and ipads are also seen as must-have status symbols by more fashion-conscious consumers. Google's Android OS is tapping into this lifestyle trend, providing similar functionality to ios devices, but at a lower cost and without the same status appeal. Although Android has a higher overall market share among consumers than ios, feedback from enterprises and MDM vendors shows that more ios devices are being brought into the workplace than Android about a 60-40% split between the two, in Apple s favor. BlackBerry devices still dominate in most companies, but there is trouble brewing for RIM, as its devices are increasingly being replaced with ios or Android at the end of their lifecycles. BlackBerry devices are not being removed from the enterprise en masse, but they are not being renewed. Windows Mobile, Windows Phone 7, Symbian, Palm, and Web OS devices currently have very little workplace share between them, and only Windows Phone seems to have a realistic chance of clawing some away from its competitors. There are a couple of reasons behind Apple s dominance in the BYOD space. Primarily, the iphone and ipad are the devices of choice for executives and information workers for whom spending a lot of money on high-end consumer products is not a problem and these are the people whose job roles mean that they are driving the BYOD trend. A CEO is more likely to have an iphone and an ipad than one of their Android rivals, a result of Apple s strong brand image and marketing efforts. Secondly, ios devices are seen to be more Ovum. Unauthorized reproduction prohibited Page 9

10 enterprise-friendly than Android. Apple devices are more predictable to IT, and more importantly allow for on-device encryption. Some IT service providers simply forbid use of Android on corporate networks for this reason, even if the MDM platforms that they use do cater for Android deployments. As the Android OS matures, along with the BYOD trend itself, there is likely to be shift in balance: more secure Android devices will be more readily accepted on to the corporate network by CIOs, and Android s higher consumer market share will convert into higher enterprise share as more and more employees (not just those in the C-suite who can afford iphones) bring their devices into work. Enterprises find different ways to plug the BYOD gap Enterprises across various vertical markets are finding ways to cope with and exploit the BYOD trend. Networking giant Cisco and multinational bank Standard Chartered provide contrasting examples of how to implement mobility policies that cope with the emergence of consumer devices in the enterprise. While Cisco aims to support as many types of device as possible in a full-on attempt to embrace BYOD, Standard Chartered is centrally rolling out what appears to be the most popular consumer device among business users the iphone. Case study: Cisco makes good use of telco relationships When it comes to implementing its internal BYOD policy, Cisco has a real advantage over other companies that are doing so. Counting most major telecoms operators throughout the world as clients, Cisco is able to take advantage of these relationships to negotiate good mobile plan deals for employees who bring their personal devices into work. In every country in which it operates, Cisco employees can save money on their tariffs by signing up to a subsidized deal. In developed markets, they normally have a choice between two to four operators. By encouraging employees to take up these personal plans and use personal devices at work, Cisco saves money by no longer paying anything for devices. The company claims that between May 2010 and May 2011, overall mobile spend was flat year-on-year, even though the total number of mobile users had increased by 32%. Cisco puts this down to very small growth in the number of corporate devices and its "spend optimization" with operators. Cisco aims to support as many platforms and devices as possible and is continually increasing its number of "trusted devices." To be classed as trusted, a device must meet certain standards in terms of architecture and execution. Required architectural principles include: Ovum. Unauthorized reproduction prohibited Page 10

11 device security posture assurance (the ability to identify any device when it connects to the corporate network and link it to a specific user, and to control its security posture) user authentication and authorization secure storage of corporate data at rest. Required execution ele ments include: policy enforcement (local access control, device encryption, remote wipe, and inventory tracking) asset management (device registration and identification, user audit trail, forensic capabilities). To push policy and manage assets on these individually owned devices, Cisco uses three technologies: encryption via the OS, a device management and certificate delivery solution, and Cisco's AnyConnect VPN Client. Depending on the degree to which various devices meet the trusted device requirements, they are able to access different types of services on the Cisco network. Selected Android, Symbian, and Windows Phone devices, as well as ios devices, have access to mail, calendar, contacts, and WebEx (and all are subject to remote wipe, four-digit PIN and 10-minute timeout), while devices such as BlackBerry and Cius, which are deemed to be more secure, have access to a wider range of services inside the Cisco firewall. Cisco's aim is to enable more and more devices to access services inside the firewall. The trend at Cisco supports the theory that it is primarily Apple devices that employees want to bring into work. Between May 2010 and May 2011, the iphone displaced the BlackBerry as the most widely used mobile device at the company, more than doubling its share to 39%. BlackBerry's share fell from 57% to 34%, with its share also eroded by the emergence of the ipad and Android, which a year earlier had next to no share. With Cisco planning to widen the array of services which ios and Android platforms will be able to access, BlackBerry's drop in share looks set to continue. If it looks bad for BlackBerry at Cisco, it is worse for Windows Phone. The market share of platforms other than ios, Android, and BlackBerry fell dramatically from 29% to 7% between May 2010 and May 2011, and with Symbian and WebOS on their way out of the market, Windows is the last major player left in this quickly shrinking pool. Cisco internal mobile device landscape, May May 2011 % of to t al devices May-1 0 M ay-1 1 iphone 14% 39% BlackBerry 57% 34% Ovum. Unauthorized reproduction prohibited Page 11

12 ipad < 1% 11% Android < 1% 8% Cisco Cius (trials) 0% 1% Others 29% 7% Source: Cisco When it started to roll out mobility services to various devices, Cisco initially did not support the iphone. However, this did not stop some employees from using their iphone for work applications anyway, and these employees had to learn to self-support. By tracking the issues that these users had, Cisco learned some lessons about helping employees to self-support. The company claims that it registered 20% fewer mobile IT support requests year-on-year from May 2010 to May 2011, which is helping to reduce costs. Case study: Standard Chartered turns to ios Multinational bank Standard Chartered has employed an alternative model in adopting popular consumer devices. Rather than running a full BYOD policy and allowing employees to choose their own device, it has identified the iphone as not only the most popular device among employees, but also the one most suited to its enterprise mobility requirements. Therefore, the bank centrally distributes corporate iphones in a scheme launched in May 2010 that is designed to replace the bank s fleet of BlackBerry devices in the long term. While there appears to be widespread usage of corporate on ios devices in other banking institutions, Standard Chartered is the first to use them for much more in-depth productivity purposes. Todd Schofield, global head of enterprise mobility, stated that the company wanted to move from an platform that does apps to an app platform that does an indication that while BlackBerry is a strong platform on which to use while on the move, the range of possibilities offered by iphone applications makes it a more desirable platform for businesses aiming to make more productivity applications available to mobile workers. Under Standard Chartered s plan, employees considered to have mobile job functions are equipped with a corporate iphone. Job roles considered to be "mobile" are highly varied, but include employees in client service roles, trading, and IT. The bank employs over 80,000 people, of which 10,000 currently use a corporate iphone. This number is expected to increase the bank targeted 15,000 when initially announcing the program in May 2010 although a small percentage of mobile employees still prefer to use their BlackBerry devices. The bank also runs a very selective BYOD scheme: those employees who are eligible for a corporate iphone are also allowed to bring in their personally owned ipads and connect them to the corporate network. Although this creates the possibility that more than 20,000 ios devices will be operating on the corporate network (approximately 2,000 Ovum. Unauthorized reproduction prohibited Page 12

13 personally owned ipads are currently registered), Standard Chartered claims that it is not a big strain on resources as both the iphone and ipad operate on the same infrastructure and use the same set of applications. Catering for multiple OSs including Android, for instance, would lead to a higher strain on, and increased costs for, the IT department. The bank runs an internal application store from which employees can download the specific applications that they need. Applications are not pushed to devices only devices running on the corporate network can access and use them, and specific internal permissions and sign-in details are required so that only the correct employees have access. The primary application in use is corporate , but there are 12 applications available on the internal application store, covering various functions and parts of the business. Such applications include: Straight2Bank: gives corporate treasurers control over transactions TradePort: lets trade finance relationship managers securely perform and monitor trades ineeds: allows relationship managers to organize customers through customized profiles FX Rates: a realtime tool that shows Standard Chartered's own internal rates and ratios between currencies. Taking into account the consumer trend towards smart mobile devices, Standard Chartered also provides a mobile banking application for customers, called Breeze, which has versions available for iphone and Android, and is also opti mized for ipad. Standard Chartered emphasizes that data security is its highest priority when it comes to this program, and because of the levels of encryption on offer, it doesn t view ios as any less secure a platform than BlackBerry. In an industry that is highly conscious of data security, the bank has to deal with different and stringent regulation in each country in which it operates. It therefore took its existing policies concerning BlackBerry devices and laptops as the basis for its current policy, ensuring that ios meets the same standards. Whatever policies t hese other devices were expected to meet, Apple devices m ust too. Employees can only access sensitive corporate data and applications on their iphones and ipads when connected to the corporate network through the VPN, which is provided by Cisco (Cisco s VPN client is available as standard on Apple ios). The bank uses singletunneling VPN, so that when a device is connected to the corporate network, all other connections are blocked off. Also, sensitive data is not replicated locally, ensuring that it never leaves the network. However, Standard Chartered does not completely lock down corporate iphones, and employees are able to use them for personal activity. When not connected to the corporate network, and thus not posing any security risk, users have far more freedom to choose and access features. The bank recognizes the soft benefits of Ovum. Unauthorized reproduction prohibited Page 13