MOBILE APP MANAGEMENT: 10 REQUIREMENTS FROM REAL CUSTOMER DEPLOYMENTS

Transcription

1 EVALUATION GUIDE MOBILE APP MANAGEMENT: 10 REQUIREMENTS FROM REAL CUSTOMER DEPLOYMENTS Mobile Device Management (MDM) has ushered in on-the-go access to enterprise data, but that convenience has only whetted the appetite of enterprise users. Today s employees now want access to the whole universe of enterprise applications, network resources and collaboration tools on demand, on their devices of choice. More apps, more data, more convenience, these expectations add up to a requirement for more creative enterprise enablement within the necessary boundaries of IT control. Good Technology has been helping enterprises and security-conscious organizations enable secure mobility for more than 17 years. Our work with customers shows the importance of planning beyond the immediate desire for device and application support to the longer-term benefits of flexibility, manageability and scalability. We are leading the transformation from only, to an any app, any workflow, any time enterprise mobile experience. By any workflow, we mean the ability to enable multiple apps to share data securely in a sequence that creates a business process. One example would be allowing a claims adjustor to process an insurance claim at an accident site using just a mobile device. Another would be enabling an assembly line worker and an engineer to jointly fix a manufacturing defect in real time using their personal mobile phones. Since multiple vendors now offer Mobile Application Management (MAM) solutions, this guide characterizes the success factors that Good Technology has noted into 10 distinguishing features. Beyond a checklist, these attributes represent the difference between a strategic long-term, transformational mobile application program and a short-term, tactical stopgap approach. THE MOBILITY MARKET IS EVOLVING TO APPLICATION AND DATA MANAGEMENT Many companies use MDM to extend access and other basic services like VPN and Wi-Fi access, while at the same time bringing devices under some measure of IT control. For example, MDM can wipe the entire device, including both corporate and personal data; when an employee leaves the company or loses a device, MDM can restrict device functions that may leak proprietary corporate data, such as the camera and even blacklist apps that put enterprise data at risk not ideal for BYOD devices. Risky apps might include apps with cloud connectors to file storage or file synchronization services. The reality is MDM offers many ways to restrict users on their personal devices, but few ways to enable users to access the apps and workflows needed to be productive on personal devices. And, when IT has to employ restrictive controls on personal devices in the name of productivity, neither users nor IT is comfortable. Further, lines of business are increasingly leveraging mobile apps as a new communications platform with important non-employees, including external business partners, consultants and customers. MAM permits control over apps and data without overriding the employee s personal content and device experience. Enterprises can support a diverse and fast-evolving set of devices, while respecting the private lives of employees.

2 In these cases, IT does not have the option of controlling these non-employee devices via MDM. As enterprise mobile apps increasingly move beyond employees to the extended enterprise to speed business and improve relationships, the ability to provide secure and manageable mobile apps to their broader business constituency is becoming an enterprise mobility strategy requirement. In response, many organizations are turning to Mobile Application Management (MAM) solutions, which companies deploy to either co-exist with or replace MDM as their primary mobile enablement solution. For some, MDM remains beneficial for basic service enablement and reporting functions, but MAM introduces app-focused security and policy controls to enable managed access to and collaboration using selected, approved enterprise resources. MAM tools manage enterprise-approved apps and data on the device without having to take control of the entire device. MAM alleviates the need to restrict insecure device functions and blacklist apps that may leak data, introduce vulnerabilities or create compliance violations. With MAM, IT can provide employees and business partners the application and data access their roles require on their preferred and personally-owned devices, without having to take restrictive control of these devices to meet security and regulatory requirements. Importantly, MAM policies and technologies can limit data deletion to selective wiping of specific enterprise apps and their data, leaving the rest of the device s personal content intact. Mobility can be used as a true business enabler without compromising the user s whole device experience for the sake of corporate data security. IT S ALL ABOUT BUSINESS TRANSFORMATION THROUGH MOBILITY The fine-grained controls and flexibility that come with MAM encourage enterprises to enable the business. You have the freedom to embrace mobile application usage as a true business enabler in ways that could not be done previously. With the security that MAM brings, custom mobile apps can enhance a customer experience, speed sales cycles, streamline supply chain management and expedite approval workflows for distributed teams. MAM provides a safety net to ensure these new mobile applications achieve their business objectives without jeopardizing core enterprise governance processes and compliance standards. MAM lets you deploy exactly the right apps for the business requirement, along with the requisite app security to enable usage on devices IT doesn t control especially those carried by regulated employees, critical partners and customers. In addition to managing apps and data in a way that works well for modern workforces, MAM provides much-needed visibility into app usage, while driving down operational cost through process efficiencies. App analytics reveal the apps that deliver the most business value so you can direct license, support and maintenance resources to the services that are working for your business. This clarity makes it easier to justify investments or reallocation of resources to meet increasing demand you may be able to retire apps that no one is using. LOOK AT THE APPLICATION LIFECYCLE While MAM is a software solution, its successful implementation goes beyond deployment to a complete and thoughtful strategy. The MAM software should provide a secure and manageable framework for the entire application lifecycle, reflecting: App procurement (both third-party and inhouse developed apps) App provisioning and deployment App security and policy management App usage and user feedback App decommissioning and selective data wipe

3 #1 CONTAINERIZATION OF CORPORATE APPS: PROTECT CORPORATE DATA ON DEVICE Native ios and Android provide device authentication and, in most cases, device level encryption. Once someone logs into the device, all apps are available and any app can access data from any other app via native services like Open In or cut/copy/paste. Essentially, the device password unlocks the encryption of each app s sandbox and makes all personal and corporate data available. The preferred approach materializing in the enterprise mobility market includes both containerizing individual corporate apps with app-level encryption that is separate from the device s encryption and also requiring app-level authentication that is distinct from the device passcode. Since the app data is encrypted with a different encryption algorithm than the device s, the data in the app container is protected from view even if a user gains access to the file system (often by plugging the device into a laptop via USB). In addition, even if the device password is compromised, access to the app requires additional authentication. Containerized apps provide IT with fine-grained control by segregating each app and its data in its own dedicated, encrypted file store. Each app container can have its own usage rules or policies and be protected and wiped independently. Personal apps installed by the device owner such as Dropbox and other cloud sharing services can reside safely alongside corporate-approved third-party ISV apps or custom-built apps that instantiate the intellectual property of the enterprise. The personal apps are isolated from the corporate apps: they can be restricted from accessing the data in the corporate app containers via native services such as copy and paste. Yet users can still arrange both corporate and personal apps side-by-side or in any springboard configuration they desire. #2 WRAPPING OR SDKS: FAST SECURITY VERSUS ACCESS TO NEW CAPABILITIES There are two primary methods of employing containerization to individual apps: app wrapping and Software Development Kits ( SDKs ). App wrapping technology embeds security policy controls into already compiled apps for which you may not have source code. This is done by analyzing the app to identify native calls being made, intercepting those calls and redirecting to the wrapper s security libraries. Wrapping is a very fast process, essentially taking just minutes to secure an app and since it does not require source code, developers are not required. IT or even LOB managers can easily secure mobile apps. An alternative to wrapping compiled apps is using an SDK to integrate security libraries directly into the app source code before compilation. While this method of containerization requires source code access and developers to do the coding, SDKs can potentially provide productivity benefits to developers. SDKs that offer Shared Services frameworks can enable developers to integrate new app features beyond just security capabilities into an app. These may be application services that an enterprise development organization has already written for previous projects and wants to publish for other developers to re-use, providing productivity gains across the development organization. Or, application services may be provided by the containerization vendor or its Independent Software Vendor ( ISV ) app partners, already published in the Service Framework and ready to use. For example, an instant messaging app vendor may publish a real-time presence service so that other apps can offer real-time user lookup without requiring developers to write the service themselves. When looking at containerization solutions, some requirements to consider include: App-level encryption separate from the device encryption solutions that do not provide a secondary app-level of encryption and instead rely on MDM to invoke device encryption or leverage native APIs have limited value in that container access is tied to the device passcode. If a simple 4-digit PIN is employed and cracked, the wrapped app data can be at risk. Encryption should be FIPS validated the app level encryption libraries utilized by the MAM vendor should be FIPS validated, especially for regulated organizations. Authentication options ensure wrapping or SDKs can enable app-level authentication, but can also support other enterprise grade authentication options as necessary (e.g., Kerberos). Individual apps, not multiple apps in a single container some solutions require all apps reside in a single corporate container, rather than containerizing each app. This method creates a dual persona separate corporate workspace, which can be restrictive to the user s preferred experience. SDK Maturity - When looking at a vendor claiming to have an SDK, ensure the SDK is robust and reference implementations are included to make the code integration process easier.

4 THE REALITY OF APP WRAPPING App wrapping is a great solution to quickly provide security to apps. However, with the influx of new wrapping solutions, customers need to understand some of the limits and issues with wrapping. Commercial ISV apps cannot simply be downloaded off of an app store, wrapped and distributed to employees. For example, this violates the ISV s developer license agreement with Apple and circumvents Apple s monetization process in the Apple App Store SM. If your organization has an aggressive mobile app program including many apps on multiple platforms, ensure your MAM vendor has the resources and experience to provide support if compatibility issues arise between the app, the OS and the wrapper. While wrappers put security restrictions on app functionality, some app security SDKs can enable secure services sharing providing greater functionality and developer productivity. Both approaches are valuable; ensure your MAM vendor can provide either. Ensure that your MAM vendor supports native apps, hybrid apps and web apps so that your organization is covered no matter which directions different internal development teams may take, now and in the future. #3 SECURE NETWORK CONNECTIVITY: BEWARE OF FREE SOLUTIONS Reliable device connectivity requires planning for both security and scalability. As usage increases more devices, more apps, more users your architecture will reveal any shortcomings in either or both dimensions. Most companies that have deployed Mobile Device Management solutions first enable simple VPN access to corporate networks. Individual devices use a 1:1 VPN connection ratio. While it is easy to deploy, the VPN model has shortcomings. Not only does the rapid influx of newly connected mobile devices burden VPN resources, often requiring additional networking infrastructure or hardware upgrades and new device licenses, this approach allows a connected device and all its apps to gain potentially unrestricted access to corporate assets, which increases the chance of a security issue. Once you move to secure each app and its container with MAM, some solutions offer micro-vpns or more sophisticated (e.g., reverse proxy) technologies for specific app-to-app connectivity to the enterprise infrastructure. Each app connects to a specific back-end system IP address, creating multiple secure connections from a given device through the firewall into the enterprise. This alternative, while limiting the whole device s access to the entire network, creates significant firewall change control requirements, opens multiple 2-way ports and increases security risk. Further, many of these proxy-based solutions were meant to be simple Exchange ActiveSync proxies when originally designed. With increasingly sophisticated connectivity needs for mobile users, including file share and document repository access or enterprise application access, these solutions can fall down. This lack of scalability brings down essential mobile services. Or, the services fail open, where services remain active without the expected security controls being enforced. The alternative to these approaches is to plan scalability and security into your network connection design. Use these requirements to filter through available solutions. You will likely immediately find that purportedly free solutions can t demonstrate an ability to scale. If your design appears scalable, consider the security side. How is encryption done and where? How does the traffic get through the firewall? Your approach must include an efficient and streamlined infrastructure for establishing and managing secure connections between apps on the devices and the back-end enterprise systems they want to access.

5 #4 APP-LEVEL POLICIES: CONTROL ACCESS TO CORPORATE DATA The apps making these connections will also need controls that constrain the behavior of each app, within a defined set of policy parameters. In particular, MAM solutions are easiest for IT to manage if they provide a centralized policy environment that allows both common and app-specific policies. Your decision factors should include: Support for policies that you consider critical to your business The usability of the environment provided for managing these policies How the application management solution deals with changes to policies How the policies affect your end users and their productivity Business-critical policies might include blocking jailbroken or out of compliance devices from accessing apps, requiring a minimum password strength and rules for container-to-container interactions to minimize risk to corporate data. In addition, there should be options to manage app-specific policies that govern app-specific features or behaviors. For example, you might want rules for disabling features of an app that may leak data, such as connectors to popular cloud services or the option to synchronize data to another device or desktop. Finally, you should expect that your policies will need to change as the use of apps and mobility in your organization matures. Dynamic policy updates from the management console should be possible. The goal is to have an efficient way to update a policy over the air, without requiring re-development or re-distribution of a new version of the app simply to update policies. MAM solutions that have static policy management will require much greater IT time and resources to ensure users update their apps so that new policy can be enforced. Each app connects to a specific back-end system IP address, creating multiple secure connections from a given device through the firewall into the enterprise. This alternative, while limiting the whole device s access to the entire network, creates significant firewall change control requirements, opens multiple 2-way ports and increases security risk. #5 CONVENIENT APP DISTRIBUTION: TO THE ENTERPRISE AND BEYOND The basic app catalog functionality of MDM simplifies distribution of IT approved apps. This model works fine for short lists of apps, but breaks down if you have a long list of approved apps that users require. It also underwhelms users expecting a polished and personalized commercial app store experience compatible with their sophisticated devices. Additionally, with lines of business increasingly desiring the ability to distribute apps to important external business partners, IT may struggle to provide such support as these devices are not under IT control via MDM. Therefore, an alternative distribution method is required for external business partners. MAM solutions meet these diverse needs with an enterprise app store that goes far beyond simple lists of available apps. Your custom enterprise apps, developed in-house or contracted out to third parties, can be offered along side corporate approved consumer apps curated from public app stores such as the Apple App Store SM or Google Play TM. Additionally, for enterprises developing custom apps, developers and line of business leaders can leverage functions like app ratings and reviews to determine new app requirements to improve user experience and increase user productivity. IT may likewise leverage user reviews on productivity apps curated from a public app store to determine which external apps warrant additional investment as well. Store features like user ratings, reviews and recommendations can help improve user trust and app uptake and provide a direct feedback mechanism to enterprise developers. Lastly, because enterprise apps stores may be public facing to external business partners and even customers, Marketing Departments and lines of business may see app stores as an opportunity to reinforce their brand with their external constituents. The capability to custom brand an app store is becoming an increasingly desired feature of MAM solutions. The on-device app store mobile app of your MAM solution should also be secured by your app wrapping or SDK solution. Once the user has securely authenticated into the app store, the approved and current versions of apps for his role should be readily available.

6 #6 SINGLE SIGN ON TO CORPORATE APPS: A MUST HAVE FOR USER PRODUCTIVITY Just as with traditional single sign on to PC-based or corporate web apps on a corporate network, users don t want the irritation of multiple or repeated logins for each app on the device. Your MAM solutions should be able to enable single sign on policies across selected corporate apps to improve the overall user experience and encourage app adoption and usage. Anything that negatively impacts user experience, particularly requiring separate password authentication to each corporate mobile app, will endanger the success of a progressive mobile app program. Also, not enabling single sign on also poses a security risk as the network credentials get stored on the device. #7 SUPER-APPS: SECURE WORKFLOWS DRIVING BUSINESS TRANSFORMATION Containerization is a starting point for security, but there s more to it than building walls around each corporate app. What if you WANT an app and its data to have access to another app and its data? Workflows and collaborations increasingly necessitate use of multiple apps as part of a more sophisticated workflow. The ideal approach enables apps to securely share data in an efficient multi-app workflow. Facilitating these productivity-enhancing workflows, an effective container solution will have a clear model for transparent, yet secure access and interactions between apps and their data. These elements require options such as encryption of communications between containers and control over data sharing permissions. Just as on traditional endpoints, you want to limit the potential for data loss due to malware infection or user error, so you don t want unauthorized data transfer or malicious memory access as data passes between containers. #8 USAGE METRICS: BEYOND INVENTORY WHICH APPS ARE YOUR USERS ACTUALLY USING? MDM will tell you what apps are installed on each device. With so much effort and cost going into mobility, wouldn t it be nice to know which apps are getting used on these devices? With MAM, IT can offer useful guidance to line of business and senior management, as well as in-house developers, through quantified data on actual app usage. Key usage metrics would include: App installation - including both enterprise and personal apps and by device OS App usage - including peak times, top users and usage trending App non-usage users consuming licenses but not using provisioned apps App connectivity - to behind the firewall applications App comparisons side by side comparisons of usage of different apps App analytics tell you what users really do. They should not only let you track the apps that have been provisioned and deployed, but also summarize usage. Heavily used apps are probably worth their support and maintenance costs. Seldom or never used apps could be redesigned, removed or replaced. Usage metrics help developers improve usability and let management trim unnecessary software licensing and training expenses.

7 #9 A VISION FOR GROWTH: FUTURE PROOFING WITH ENTERPRISE-WIDE SCALABILITY Successful apps will be in high demand enterprise-wide. The app that did fine in a pilot for hundreds of users needs to be just as useful and manageable scaled to the thousands. Ask your MAM vendor how they will help you simplify management of apps to support an enterprise-wide deployment. User role, for example, provides a consistent attribute for determining and managing policies and app access. A MAM solution that works with your Active Directory groups would let you provision apps and entitlements instantly according to existing user communities. Adding a new user to the group should automatically bring the right mobile app privileges and policies. This model means no extra effort for each user, even if you have a high volume of apps or specialized roles. If your user community includes business partners who aren t in your employee directory, those users should be accounted for as well. This versatility will allow you to make full use of the apps and collaborative workflows we discussed earlier to support your extended enterprise, enabling workflows for complex groups such as supply chains, agent networks and customers. One model for scaling IT management is to take IT out of app management where appropriate. Some MAM solutions offer delegated administration, so line of business (LOB) managers can manage their constituency s app access. IT can define the policies and roles and enable the app in the app store, leaving the LOB to perform day-to-day user and app provisioning and deactivation. Availability under pressure will be the other test of your success. As mobile apps become business-critical and enterprise-wide, they should have the same enterprise-class attributes as enterprise resource planning and customer relationship management systems. Built-in clustering for failover ensures business continuity and high availability to support tens of thousands of users and will facilitate your company going mobile first. Vendors tested in the fires of large enterprises will have evidence of their customers success with these high-availability designs. #10 ISV PARTNER SUPPORT: WHY BUILD AN APP WHEN YOU DON T HAVE TO? A strong indicator of whether a MAM vendor is a viable long-term partner is whether or not leading mobile app ISVs are building apps on their containerization platform. If the platform provides for secure app interaction as defined previously, then these ISV apps can easily plug into your environment subject to existing policies enabled from the management console. Horizontal apps like document editors and annotation tools are must haves since many workflows are document driven. Accordingly, apps that access corporate file shares and document management solutions, as well as file synchronization, are in high demand as well. Finally, apps that securely provide business intelligence and reporting from enterprise applications and data stores can extend business critical workflows to users that need access to maximize their productivity. For example, sales leaders want to enable users to access customer relationship management solutions to speed sales cycles, provide faster customer responsiveness and gain immediate insight into pipeline. Secured ISV apps on a MAM platform should be able to leverage dynamic policies from the MAM console so IT can change default policies to match their own and should be easily distributable without having to circumvent app store Digital Rights Management (DRM) policies or violate developer certification programs. MAM vendors that have viable ISV programs have these issues well thought out so customers do not have to deal with ISVs directly but can simply leverage existing app store volume purchase programs or even purchase secure ISV apps from the MAM vendor directly, consolidating purchases and vendors.

8 TIME TO TRANSFORM These 10 requirements provide a backbone for a secure, scalable and manageable mobile application program. It s clear that both MDM and MAM are valid technologies. MDM lets IT dictate device-level security practices and control access to corporate network services like WiFi and VPN access. MAM allows you to focus on app-level security, using a lighter device touch better suited to BYOD programs. You can protect and control sensitive apps and data on your employees and partner devices, without invading privacy or taking responsibility for everything on their devices. The best approach for your business will be determined by your risk posture and business philosophy. However, whatever choice you make needs to be flexible and capable of evolving because mobile devices and apps are nothing if not synonymous with rapid change. Use these recommendations to give your IT team the most open and adaptable platform for success. If your user community includes business partners who aren t in your employee directory, those users should be accounted for as well. This versatility will allow you to make full use of the apps and collaborative workflows we discussed earlier to support your extended enterprise, enabling workflows such as complex supply chains, agent networks and customer groups. MOBILE APPLICATION MANAGEMENT EVALUATION GUIDE MUST HAVE FEATURE VENDOR 1 VENDOR 2 VENDOR 3 #1 Containerization of apps and data Containerization of each corporate app to encrypt app data Validated app-level encryption (e.g., FIPS) Require authentication to access containerized apps and encrypted data Restrict personal apps from accessing containerized data Selective wipe of apps and data User-defined springboard configuration for optimal user experience #2 Containerization options App wrapping for compiled apps SDK for integrating security capabilities directly into code Support for native apps, hybrid apps and web apps SDK Maturity reference implementations are available #3 Secure network connectivity Scalable access model Strong encryption over the air (OTA) No impact on firewall (no open inbound ports through which devices authenticate or request direct access) No upgrade to existing network or VPN infrastructure #4 App-specific policies, centrally managed Password/authentication policies Restrict/allow Open in and Copy/Paste between applications Jailbreak/root detection check on app access Compliance policies for device and app configuration/versions Automated actions based on compliance status

9 Allow offline access Dynamic policies changeable from central console Lock and wipe of app container #5 Convenient app distribution Role-based access to relevant apps Unified view of commercial and in-house developed apps App reviews and recommendations Entitlement based on group membership Support for non-employees in the extended enterprise #6 Single sign on (SSO) to corporate apps Single login across approved app containers Definition of which apps may participate in SSO authentication #7 Secure workflows Service interaction model to connect apps Authentication to permit single sign on across multiple apps in multi-app workflows Secured communication between apps and other apps or shared services #8 App deployment and usage metrics Tracking and reporting on app entitlements and apps downloaded Tracking and reporting on actual app usage Compare apps side by side #9 A vision for growth Enterprise directory integration Cluster support Support for high availability and fault tolerant configurations Delegated administration and management #10 ISV Support for platform ISV program with app security verification Availability of integrated ISV apps on public apps stores Document editing/annotation File access / synchronization Business intelligence

10 ABOUT THE GOOD SECURE MOBILITY SOLUTION Comprised of the Good Dynamics Secure Mobility Platform, the Good Collaboration Suite and a rich ecosystem of 3rd-party and custom mobile apps, the Good Secure Mobility Solution provides the market s first comprehensive solution for secure enterprisewide mobility, supporting users demands for robust and interoperable enterprise-grade mobile apps while giving IT the data security, service visibility and infrastructure control needed to meet both regulatory requirements and service level agreements. The Good Secure Mobility Solution provides the security and application services enterprise developers need to build transformative mobile apps run on the most extensive, integrated framework for protecting and managing apps, data and devices, while enabling business productivity, collaboration and workflow transformation. ABOUT GOOD TECHNOLOGY Good Technology is the leader in secure mobility, providing the leading secure mobility solution for enterprises and governments worldwide, across all stages of the mobility lifecycle. Good s comprehensive, end-to-end secure mobility solutions portfolio consists of a suite of collaboration applications, a secure mobility platform, mobile device management, unified monitoring, management and analytics and a third-party application and partner ecosystem. Good has more than 5,000 customers in 184 countries, including more than 50 of the FORTUNE 100 companies. Learn more at Global Headquarters (main) BE GOOD (sales) EMEA Headquarters +44 (0) Asia / Pacific Headquarters BE GOOD 2014 Good Technology Corporation and its related entities. All use is subject to license terms posted at All rights reserved. GOOD, GOOD TECHNOLOGY, the GOOD logo, GOOD FOR ENTERPRISE, GOOD FOR GOVERNMENT, GOOD FOR YOU, GOOD DYNAMICS, SECURED BY GOOD, GOOD MOBILE MANAGER, GOOD CONNECT, GOOD SHARE, GOOD VAULT and GOOD DYNAMICS APPKINETICS are trademarks of Good Technology Corporation and its related entities. All third-party trademarks, trade names, or service marks may be claimed as the property of their respective owners. Good s technology and products are protected by issued and pending U.S. and foreign patents. 07/14 Rev