WHITE PAPER Secure Enterprise Data in a BYOD World IDC OPINION IN THIS WHITE PAPER. Sponsored by: Excitor. Jason Andersson January 2013

Transcription

1 WHITE PAPER Secure Enterprise Data in a BYOD World Sponsored by: Excitor Jason Andersson January 2013 IDC OPINION As consumerization trends continue to accelerate in the enterprise, there is growing interest in solutions that provide mobile workers with the freedom to choose their device while maintaining secure access to corporate information. When it comes to combining corporate and personal use of devices, securing corporate data becomes more important than control of the device. A bring your own device policy is necessary for enterprises that want to support mobile working on multiple mobile operating systems without restricting the personal device characteristics. IDC Sweden Upplandsgatan Stockholm +46-(0) (0) Virtualization technologies have made it possible to use different ways to access enterprise data on devices not completely in the control of IT organizations. Client virtualization technologies create a range of benefits among which one of the major improvements is extending client virtualization accessibility to mobile devices. Containerization is a perfect blend of securing application data and allowing users to own and control their private device. Consumerization of IT and the BYOD trend is not supported fully when using other types of virtualization solutions. Security can be improved by using client virtualization technologies on mobile devices, for example by creating a virtual partition between the corporate and personal data on a mobile device. Companies are looking to simplify matters for users by supporting a single sign-in to the corporate infrastructure on their device including , corporate applications, and intranet all from one corporate front end. Containerization appeals to all sizes of enterprises that allow employees to bring their own device and use it for work. The growing convergence between mobile device management (MDM) and mobile application management (MAM) is creating a new market called mobile enterprise management (MEM). Globally, the MEM market is growing at a CAGR of 31.8% between 2011 and IN THIS WHITE PAPER Enterprises using client virtualization technologies on their computers have found several benefits of supporting desktop workloads. These benefits include improved IT management efficiencies, improved price efficiencies, and improved capabilities. One of the improved capabilities is extending accessibility to mobile devices, giving workers the ability to have a viable network connection wherever they are, making them much more productive regardless of their physical location. Security on these devices is also improved because the data is not downloaded to the local access

2 devices and IT organizations can rest assured that in the event of loss or theft, sensitive information is not compromised. Mobile Container Mobile container solutions come with their own set of benefits and potential challenges for the enterprise. One of the most important characteristics of a container solution is that typically the container is an application that can be downloaded to a device. The fact that they can typically be downloaded to the majority of BYOD devices in the enterprise today is a big benefit for enterprises that do not want to deal with the challenges of maintaining an approved device list. As more and more enterprises adopted BYOD as a standard practice, a new type of solution began to emerge that focused on managing the corporate footprint of information on the device as opposed to being able to manage the entire device platform. Called mobile application management (MAM), this segment of the market has brought with it a slew of new companies focused on this space. However, many of the companies that got started in the MDM space have also added MAM capabilities to their products. There are multiple models for managing corporate data on mobile devices. At first, solutions controlled the entire platform, but with consumerization of IT and the growing number of alternative devices, the model has evolved into device control through configuration using mobile device management. The BYOD trend has made it more critical to focus on securing corporate data rather than controlling the whole device, hence calling it a containerized approach. A third way is to provide online access only, but this solution has both access and performance limitations. Containerized solutions already have traction in the market. For example, Excitor's DME solution combines device management, , and PIM with secure access to corporate applications, corporate app stores, and intranets, within a single secure container. It is accessible through a single sign on, with granular control of access where only authorized applications are accessible by individuals. DME gives users the right access to the right applications. Although containers offer the benefits of device choice and easy deployment, they also have some limitations. From a security perspective, if the device OS is compromised, the container app may also be compromised, but by monitoring usage against mobile device management (MDM) policies, maintained with, for example, Excitor DME, enterprises would be able to recognize this breach and remove access to the enterprise information or wipe the app if necessary and thereby minimize the risk that inherently insecure operating systems can present. SITUATION OVERVIEW The mobile enterprise management software market will include products that offer standalone MDM, standalone MAM, or combined MDM-MAM functionality. The benefit of a combined MDM and MAM solution, such as Excitor's DME, is that they provide a secure solution. A mobile device management solution includes many of the standard features included in PC management solutions in addition to functionality that addresses the unique needs of mobile devices. 2 #IDCWP01V 2013 IDC

3 Some of the key features of a mobile device management solution are: Device provisioning and managing configuration settings Inventory/asset management Software distribution (applications, operating systems [OSs], firmware updates) Remote wipe/lock, remote control for systems diagnostics Policy/compliance management (encryption management, device posture, etc.) Authentication and certificate management Real-time device monitoring, location information, GPS breadcrumbing Reporting and analytics on devices Mobile application management (MAM) refers to a solution by which specific mobile applications can be managed, secured, and distributed by IT organizations and typically allow for enhanced policies to be applied to individual applications. Mobile application management solutions can either supplement MDM functionality or stand alone and typically include some combination of the following features: Management of the application life cycle: Granular application distribution capabilities by group or policy (often through a mobile enterprise application store) Granular security management and corporate policy control of applications and content A Brief History of the MEM Market Over the past several years, the mobile enterprise management market has quickly become a very crowded space in which to play. Today's MEM vendor ecosystem is diverse, with participation from myriad companies across the IT spectrum. The following is a brief history of how the market has evolved: In the early days, the MDM market was dominated by large systems management companies such as IBM, Microsoft, BMC, HP, and a few companies that focused specifically on the management of rugged devices, such as Wavelink and SOTI. These companies primarily provided management of Windows Mobile and perhaps some Palm devices. The other mobile devices in the enterprise were typically BlackBerrys (BBs), managed by the BlackBerry Enterprise Service (BES). Excitor was founded in 2001 as an early innovator in the market. As ios devices entered into the enterprise in , they realized that they were going to need additional solutions to manage a multiplatform enterprise. These solutions needed to be able to manage corporate-owned devices as well as their BYOD devices. Besides remote wipe/lock, security took a backseat to things like inventory management, configuration management, and other typical management functionality that was normal in a solution for PC device 2013 IDC #IDCWP01V 3

4 management. But once the BYOD device flooded the enterprise, security became much more important and a new type of MDM solution was needed. In , the market was flooded with new entrants. Pureplay MDM vendors such as AirWatch and MobileIron became well-known entities. Companies that had previously been focused on adjacent mobility spaces such as Fiberlink, BoxTone, and Zenprise turned their focus to this market. Security vendors such as Symantec, Trend Micro, and McAfee began to offer standalone MDM offerings in addition to their other mobile security products. Systems management players began to reengage and offer new cross-platform management solutions. By 2012, the demand was becoming prevalent to have more than MDM and , such as access to corporate app stores and Intranets within a secure container. In April, Excitor acquired Giritech A/S to further enhance its technology by leveraging Giritech's secure browser and secure connectivity solutions in order to add enterprise applications and portals to its secure container, enabling customers to create their own, secure, corporate appstore. ESSENTIAL GUIDANCE IDC believes that the idea of containerization is one that appeals to companies of all sizes with BYOD strategies in place. Many companies have already deployed mobile containers for access and are now looking for solutions that allow them to extend that secure environment to other applications as well. There is no one-size-fits-all, so here follows a list of considerations that IT should reflect on when it comes to choosing a mobile container/virtualization solution: Pay attention to the end-user experience. If the users don't like it, they will be less likely to leverage the solution you've invested in, thus lowering ROI. Enduser experience includes everything from performance of the app to single sign in, to the entire 'Corporate Container' and all the apps inside it, including swipe functions, to increase acceptability. What kind of devices do you need a solution for? Make sure the solution you choose is applicable to your whole BYOD device population. How do you want to deploy the solution? Does the provider you are evaluating offer both on-premises and cloud solutions? Again, consider integration plans when evaluating deployment methods. Who do you want to buy this from? These solutions are available from software companies, mobile operators, and other key mobile ecosystem providers such as mobile SIs. In addition to being able to offer broad enterprise mobility suites, these providers may also have the ability to host the solution for you. They can also typically provide consulting services around which type of solution is the right one for you and help you develop broader enterprise mobility strategies. 4 #IDCWP01V 2013 IDC

5 CONCLUSION Mobile devices are most commonly utilized to access content, not create it, and so presenting a creation-centric virtual desktop solution is likely to be inefficient and redundant. However, media tablets and new hybrid PCs are becoming more standard all the time and leading to new ways of becoming productivity devices. The importance of user experience in mobile solutions cannot be overstated. At the same time, IT needs to deploy a solution that will meet the needs of the entire BYOD population and provide access to all the applications and data that those users need to do their jobs in a secure manner. Mobile container solutions can be an important piece of this puzzle, but will often be used in conjunction with other mobility products as well. About Excitor Excitor is a Denmark-based enterprise mobility company with approximately 40 employees. The company is privately held and was founded in It has a global reach through a partner network comprising of security resellers, systems integrators, and telecom operators. Excitor offers a product called DME, which is comprised of three components: DME Mobile & PIM, which enables mobile synchronization of ; DME Mobile Device Manager, a solution that offers security of corporate data and DME AppBox, which allows enterprises to deliver corporate app stores to their users and provision mobile intranet access to corporate portals. With G/On from its Giritech acquisition it is possible to expand the solution to any type of remote connection from any device, from anywhere across any network giving users secure access to their applications, computer, virtual desktop, or servers. Excitor's DME offers a secure container approach, meaning security and control policies for personal and corporate data are separated. This feature also allows a company to wipe only the corporate data of a device if it has been lost or stolen. Excitor's April 2012 acquisition of Giritech A/S allowed Excitor to further enhance its technology by leveraging Giritech's secure browser and secure connectivity solutions to the enterprise. DME AppBox is an enterprise application mobilization framework that allows business to manage and deploy business Web-based applications, using DME Secure Browser technology. All corporate data is encrypted within the DME secure container, which prevents data from leaking to third-party private applications on the device. By providing two-factor authentication and 256-bit AES-encrypted communication between the client and the server, DME allows access to multiple Web applications each in a single discrete browser instance. DME AppBox isolates applications and data from a non-appbox browser (e.g., Excitor advocates the cross platform benefits of HTML5 to deliver native-like applications in its secure container on the device) IDC #IDCWP01V 5

6 Copyright Notice External Publication of IDC Information and Data Any IDC information that is to be used in advertising, press releases, or promotional materials requires prior written approval from the appropriate IDC Vice President or Country Manager. A draft of the proposed document should accompany any such request. IDC reserves the right to deny approval of external usage for any reason. Copyright 2013 IDC. Reproduction without written permission is completely forbidden. 6 #IDCWP01V 2013 IDC