How To Write A Byod

Transcription

1 Limitatins f the Walled Garden This is the secnd part in a series designed t help rganizatins develp their BYOD (bring-yur-wn-device) strategies fr persnally-wned smartphnes and tablets in the enterprise. Chapter 1 f the series, Building Bring Yur Own Device Strategies, intrduced cre cmpnents f a BYOD prgram. This chapter cmpares tw technical appraches t BYOD: the walled garden vs. the enterprise wrkspace. Summary The enterprise wrkspace apprach t BYOD is secure, cst-effective, extends t apps, and drives user satisfactin. It allws IT t cnfigure, mnitr, and cntrl enterprise data and access acrss the mbile device withut cmprmising the native user experience. This is the apprach MbileIrn takes t BYOD. We will describe this apprach in detail in Chapter 3 f this series. The walled garden, r cntainer, apprach t BYOD fcuses heavily n security, but cmprmises the user experience which is the fundatin f a BYOD prgram. End-users are nt allwed t use the native , PIM, r brwser experience f the device and must, instead, dwnlad a separate app that tries t replicate thse capabilities. This is the apprach Gd Technlgy takes t BYOD and it can have several limitatins: Lw user satisfactin because it frces use f an app the end-user desn t want Limited incremental risk management, especially after Apple s ios 5 release Limited ability t supprt mbile apps High cst f wnership due t upgrade, scale, and maintenance verhead Walled gardens can be attractive in the early generatins f a mbile perating system befre the native experience is fully secured and befre the mbile device is being used fr apps. Hwever, the security capabilities f mbile perating systems like ios 5 have evlved rapidly. As a result, a BYOD prgram built arund a walled garden experience is neither required nr sustainable fr mst enterprises. User Satisfactin The underlying principle f BYOD is that prfessinals are mre prductive n technlgies f their wn chsing. Allwing emplyees t bring their persnal devices t wrk, but frcing them t use a different app r brwser than the ne they want, puts the entire prgram at risk. But user experience is subjective, s we recmmend testing with a pilt grup f users: Give half the grup the native experience with ActiveSync and MbileIrn. Give the ther half the walled garden experience. Let them run fr ne week then have them switch t the ther apprach. Survey them n: 2011 MbileIrn P a g e 1

2 Overall satisfactin Quality f and PIM interface Speed f delivery, especially dwnlad Integratin with ther n-device services, like vice cmmands Walled gardens like Gd cmpete head-n with Apple, Ggle, Andrid device manufacturers, and Micrsft, wh are all building integrated native experiences fr their devices. These cmpanies, especially Apple, invest heavily in design. Third-party prviders have difficulty cmpeting with Apple n user experience, and the native experience inevitably becmes the end-user s preferred ptin. User experience is the litmus test fr the sustainability f a BYOD prgram. If cntrl trumps user experience, adptin will suffer. Risk Management Crprate security prgrams leverage technlgy and educatin t drive apprpriate behavir and reduce the risk f crprate data lss. BYOD prgrams intrduce new variables fr IT and, therefre, new types f risk. Traditinally, the primary selling pint f the walled garden has been t minimize this risk by putting all enterprise data int a single cntainer n the device. But des that actually reduce risk? There are several security requirements t cnsider: Encryptin Identity Walled gardens encrypt . But in 2009, Apple encrypted all new ios devices and, in 2010, added even an extra layer f data prtectin fr ios native cntent. Apple has als submitted their encryptin fr FIPS certificatin. Nte that sme walled gardens d nt use the hardware-based cryptgraphy f ios, s the nly factr used fr encryptin is the PIN cde f the app itself. Such appraches cannt get the same strength f encryptin as ios native , which can use bth hardware cryptgraphy and the device PIN. The nly ptin fr increasing strength in this case is t frce the user t an unsustainable, extremely lng PIN (20+ characters). Andrid als nw ffers encryptin, starting with versin 3.0 f the perating system fr tablets and with versin 4.0 fr smartphnes. MbileIrn mnitrs all these encryptin states and enfrces actin if the device is nncmpliant. Walled gardens can set passwrds fr the client. But because the device has capabilities beynd as well, a passwrd als needs t be set at the device level. Having tw passwrds is a pr user experience MbileIrn P a g e 2

3 MbileIrn enfrces passwrd plicy at the device level, plus secures identity fr native , Wi-Fi, and VPN services thrugh the use f digital certificates. MbileIrn s lifecycle management f certificates frm enrllment thrugh renewal is a fundatinal capability necessary fr bth app security and user experience. Selective wipe f crprate data Privacy Walled gardens wipe crprate in their wn app but have n cntrl ver the native n the device But MbileIrn can wipe crprate in the native app withut tuching the persnal in the same app. S users get the native experience they want, and IT still gets the data separatin it needs. MbileIrn als manages the enterprise apps and cnnectivity (Wi-Fi, VPN) f the device. As a result, the entire enterprise wrkspace n that device can be wiped at nce, even thugh it is nt lcated in ne specific cntainer. This is the cre value f the enterprise wrkspace: It preserves the native experience and can be secured and managed thrugh MbileIrn withut frcing end-users t use apps they dn t want. The walled garden apprach t privacy is: If it s nt in the cntainer, I dn t have t wrry abut it. The assumptin is that there will be n ther apps n the device used fr business purpses. Hwever the reality is mre cmplex and there will actually be multiple apps used fr business purpses n the same device. As a result, IT needs t be able t mnitr the device bradly but, at the same time, fcus that mnitring n nly thse aspects f the device that truly impact security. MbileIrn s granular privacy plicy gives IT the ability t mnitr selectively. Fr example, IT may decide t track the lcatin f crprate devices, but never d s fr persnal devices. IT can set MbileIrn privacy plicy t match cmpany cmpliance requirements. Mail frwarding Walled gardens prevent the frwarding f crprate frm a persnal accunt. But MbileIrn als prevents the frwarding f crprate frm a persnal accunt. The advantage is that MbileIrn des this using the native experience. MbileIrn als prevents mving acrss inbxes and triggering an frm a thirdparty app. These data lss preventin functins are available starting in ios MbileIrn P a g e 3

4 Saved attachments: Walled gardens prevent users frm string attachments n the device. This restrictin is nt yet available within native clients, thugh given Apple s investments in enterprise security ver the last tw versins f ios, it culd well be added t future releases. MbileIrn s cmpensating cntrl is t mnitr apps that might access attachments and take autmated actin t blck flw if the risk is deemed t high. Nte als that all t the device flws first thrugh MbileIrn (specifically, the MbileIrn Sentry inline prxy) fr enfrcement f access cntrl. As a result, future versins f Sentry culd include plicy-based cntent filtering as well as integratin with existing Data Lss Preventin (DLP) systems fr risk assessment. Malicius actin: There are a handful f ther pssible ways t misapprpriate cntent, like cpy/paste. Hwever these are generally acts f the malicius, nt well-intentined, user and in mst rganizatins this infrmatin can als be accessed frm the desktp r web. Mbile isn t the nly ptential surce f such data leaks, thugh this is an area that will reslve ver time. User cperatin When yu put a persn in a straitjacket, they try t get ut. An unfrtunate side effect f the walled garden is that well-intentined users try t g arund the system t get the experience they want. They actively undermine the BYOD security prgram, nt because f any malicius intent, but because they just want t get their wrk dne efficiently. In every release f ios, Apple has cnsistently imprved the security f the native experience n iphnes and ipads. We expect this t cntinue. We see this same mvement in Andrid, as well. As native security increases, the additinal risk management value f the walled garden diminishes, while the cst t the rganizatin remains cnstant: lw user satisfactin, limited apps expansin, and high peratinal verhead. Mving t Apps is the first mbile functin, after vice, that mst rganizatins deply. But as Frrester says, Crprate app stres will becme the intranet f the future. (frm Frrester Research s Mbile Management Takes a 180-Degree Turn August 2011). In ther wrds, the true value f mbile as a cmputing platfrm will be realized as cmpanies mve beynd t apps. Mbile apps, whether native r web, will becme the emplyee s windw int his r her cmpany s business prcesses. Walled gardens limit an rganizatin s ability t use mbile apps because these apps almst always fall utside the bundaries f that walled garden. The strnger the business demand fr apps, the faster an rganizatin mves away frm a walled garden tward an apprach that can include enterprise app stre and security capabilities fr bth internal and public apps MbileIrn P a g e 4

5 Cst f Ownership Walled gardens, especially Gd Technlgy, have a high ttal cst f wnership. Upgradeability Scalability Cre changes in the underlying perating system can break the Gd security slutin and require a re-registratin f every deplyed device. When ios 5 was released in Fall 2011, custmers f Gd Technlgy faced a serius helpdesk and user issue: Every mbile device using Gd Technlgy s app had t be reregistered. In ther wrds, each end-user had t manually delete and reinstall Gd Technlgy s app. The burden f this upgrade fell directly n the helpdesk and the end-user cmmunity. This indicates a basic architectural issue with the prduct that increases the ttal cst f wnership with every majr perating system upgrade. The native ios experience, n the ther hand, has n interruptin in service and n incremental perating cst when the mbile perating system is upgraded. Our custmers tell us that each Gd Technlgy server can nly supprt devices, and even fewer (600) if using the Gd brwser. Therefre, large deplyments incur substantial infrastructure and nging peratinal csts, primarily excess staff. MbileIrn, n the ther hand, supprts 20,000+ devices per server. Our custmers have als tld us that peratinal csts fr nging management f Gd are three times thse fr nging management f MbileIrn plus ActiveSync. Single pint f failure Gd Technlgy has the same external NOC-based architecture as RIM. Therefre, perfrmance and availability is dependent n Gd s infrastructure and is utside the cntrl f IT. Maintaining service levels will require additinal mnitring f the Gd infrastructure and investment in the tls t d s. Legacy technlgy Gd des nt use ActiveSync, which is the de fact standard fr mbilizatin f . Third-party apps with prprietary prtcls are expensive fr the vendr t maintain and custmers t buy, while native apps are free MbileIrn P a g e 5

6 Device supprt Because is a cmplex app, each new device make and mdel needs t be certified by the third-party vendr. If yu are cnsidering a walled garden app, check the devices supprted and the histrical time lag between device intrductin and app certificatin. Fr example, there was a seven mnth lag between the U.S. launch f the riginal ipad in April 2010 and first availability f Gd Technlgy s ipad-ptimized app that Nvember. In a BYOD wrld, device diversity grws ver time. Users becme frustrated when they cannt get crprate because the walled garden app des nt yet supprt the make and mdel f their mbile devices. This is nt an issue fr the native experience, because it is always certified by the manufacturer befre device launch. Cnclusin We cncluded Chapter 1 f this series with the statement BYOD seems simple, but it s ften nt. That is the case with the walled garden apprach fr BYOD, as well. At first, it seems like a gd fit fr the security needs f an rganizatin. Hwever, any incremental risk management the walled garden may ffer fr BYOD is cuntered by the lw user satisfactin, limited apps expansin, and high peratinal verhead that results MbileIrn P a g e 6