From BlackBerry to BYOD, CYOD or COPE

Transcription

1 White Paper From BlackBerry to BYOD, CYOD or COPE Learn how Citrix XenMobile can empower your organization to move from traditional corporate issued BlackBerry consumer devices without sacrificing security.

2 Thanks to the popularity of Apple ios and Google Android platforms along with the consumerization of IT, enterprises have been steadily replacing their Blackberry devices for bring your own (BYOD), company-owned personally enabled (COPE) or choose your own (CYOD) devices. How do organizations shift from a BlackBerry-for-all approach to true mobile device diversity while maintaining the control, management, security and compliance they were used to? What can they use to provide secure connectivity to enterprise networks, , contacts, calendars and applications? What is the best way to protect proprietary information on the device and the enterprise network from hackers and mobile, web and personal application-based malware? Finally, how can mobile device users be prevented from sending sensitive information in a personal or posting it to a social network site? The good news is that there are mobile device management (MDM) tools and other solutions available for just these purposes. BlackBerry Limited (formerly Research in Motion) through its own enterprise mobility management platform BlackBerry Enterprise Server (BES) which allows IT to manage and secure ios and Android devices in addition to its BlackBerry smartphone devices for BYOD, CYOD or COPE programs. However, only Citrix provides a comprehensive enterprise mobility management (EMM) solution that goes beyond MDM and offers users secure access to mobile, Windows desktop, SaaS, and Web applications while providing IT with robust mobile device management and mobile application management (MAM) capabilities. BlackBerry vs. Android and ios In evaluating the challenges of migrating from BlackBerry to ios and Android devices, it s important to understand the management and security options offered by each mobile device platform. BlackBerry has always been enterprise focused with its own enterprise mobility platform, BES. Both Android and ios started as consumer-focused mobile platforms, but over the past few years Google and Apple have increased their built-in management and security features and made them available to third-party enterprise mobility management solutions for centralized management from a single console. In addition, Google and Apple have robust partner programs with Enterprise Mobility Management solution providers such as Citrix that enhance security and management capabilities delivered by Google and Apple. Data Protection on the Device With mobile users connecting to the enterprise network for and enterprise applications, taking and sharing enterprise files and data on the road and mixing personal and enterprise applications and data on the same BYO device or on COPE or CYOD that allow workers to use their own apps, enterprise mobile data protection has become vitally important. BlackBerry has always been the gold standard for enterprise security and data protection, and remains one of the only platforms with Federal Information Processing (FIPS) certification, which means it s approved for government use. However, while BlackBerry security and management were once head and shoulders above those of the competition, this is no longer the case. Android and ios security 2

3 and management features have been upgraded over the years to the point where they are usually acceptable for all but the most securityconscious enterprise environments. BlackBerry protects content stored on the BlackBerry 10 smartphones with FIPS certified device data encryption using the highly secure AES 256 standard, allowing enterprises to encrypt all data on the device if necessary. With BlackBerry Balance, any data sent to the BlackBerry workspace is inaccessible to personal applications. Users cannot cut and paste work information into personal applications or messages. Highly granular policies for further data loss protection can be set up as well, either alerting users when they are about to send confidential enterprise information to personal contacts or social media or preventing them outright from doing so. In the event the BlackBerry device is stolen or an employee leaves the organization, IT can wipe all information and applications from the device remotely, or just wipe work-related information to prevent sensitive information from getting into the wrong hands. For ios and Android devices, BlackBerry offer Secure Workspace, an application wrapping, containerization and connectivity function similar to BlackBerry Balance, which separates work and personal domains, applications and data. Application data in the Secure Workspace is encrypted. Apple has been adding similar enterprise security features with every ios upgrade. ios 7 introduced AES 256 device encryption for all data and applications by default. It also includes a new feature called Managed Open that allows IT to define managed apps and unmanaged apps and create a containerized work space that restricts managed apps from sending data to unmanaged and vice versa. However, even with the latest version of ios, ios 8, IT cannot restrict interactions among managed apps. Another feature, Managed Accounts, lets IT configure a Microsoft Exchange account so that files can be opened only in designated managed applications. However, if a managed application supports sharing in social media, such sharing cannot be restricted. In addition, ios 8 does not provide IT with the ability to block or allow the use of location services, camera, SMS, , icloud or the device microphone, which can introduce risk and user privacy, challenges. Google has also been making security and management improvements to its operating system Android. Recently, Google introduced Android for Work - a program of device, application and management partners. Android for Work not only introduces additional security controls but also helps to unify the different flavors of Android versions and devices brought about due to the large number of different Android device manufacturers. Android for Work (AfW) also introduces new technology including a dualpersona container that allows for the separation of corporate and personal data on Android devices that are AfW enabled. Applications in the AfW container are encrypted and can be remotely wiped. IT also has the ability to whitelist apps and prevent installation of applications for unknown sources. Citrix is an Android for Work partner and Citrix XenMobile is able to manage Android for Work enabled devices. Data Protection over the Wire As with its device encryption, the BlackBerry platform protects enterprise data sent over the airways with AES 256 encryption. The BlackBerry platform is also famous for its network operations center (NOC) architecture, which adds a layer of security that tunnels to the NOC and then to the BES server using encryption and compression. However, some customers may be 3

4 concerned about possible NOC outages and some critics argue that the NOC architecture is not necessary now that wireless IP connections are so much faster and more reliable than they once were. For ios and Android devices, BES provides secure access to behind-the-firewall application servers for apps deployed to the Secure Work Space. In addition, no separate VPN infrastructure is required. The Citrix solution for BYOD, COPE or CYOD Enterprises seeking a comprehensive, seasoned MDM and EMM platform for their BYOD, COPE, or CYOD program as they transition from BlackBerry to ios and Android devices, should take a close look at XenMobile. XenMobile offers a raft of powerful features, such as scalable MDM, granular MAM, business optimized and secure productivity apps including , browser, document editing, file share and sync, notetaking and remote desktop access With ios 7, Apple introduced per-app VPNs that allow IT to assign VPNs to individual applications, rather than across the system, so the enterprise is not exposed to all the applications and personal data on the device every time it connects. Prior to Android for Work, VPN management could not be enabled on a per app basis. However, Android for Work combined with MDM tools such as XenMobile can enable VPN management on a per app basis. Application Delivery Aside from the aforementioned workspace, BES offers a built-in enterprise app store, BlackBerry World for Work, which can be used by IT to push and install mandatory enterprise applications remotely and list recommended and approved apps for download as well. BES also provides the ability to set policies for whitelisting mobile applications. The ios Developer Enterprise program enables companies to publish enterprise app stores of approved applications for internal use. Enterprises can also control which applications become managed apps. With Android for Work, IT can now deploy any Google Play app or internally developed apps via Google Play for Work and purchase paid licenses in bulk. XenMobile discovers and manages all mobile devices on the network, including ios, Android and BlackBerry devices. Administrators can configure its mobile management servers via a web-based administrative console and import user group accounts from Microsoft Active Directory. Once policies are configured, mobile staff can self-enroll devices, which are then configured automatically with granular IT policies and designated applications. XenMobile also offers an enterprise app store that provides access to additional suggested and approved applications. In contrast to most competing EMM solutions, the app store serves as a central point of access to approved SaaS and Windows applications as well. XenMobile is one of the few that lets ios and Android devices access enterprise Windows applications virtually using the market-leading Citrix XenApp and Citrix XenDesktop software. XenApp and XenDesktop provide unmatched performance over wireless networks, even over lowbandwidth or inconsistent connections. There s even the option of offline access to Windows applications via a secure, encrypted virtual machine on the device subject to powerful policy enforcement. Also, XenApp and XenDesktop are excellent solutions for the most security conscious organizations looking to provide access without storing anything at all on the mobile device. Citrix Receiver provides tools to create a more mobile 4

5 friendly Windows experience adjusted for tablet and smartphone displays, with features such as touch, pinch and zoom. For organizations that don t want to spend a lot of resources porting or rewriting Windows applications to each device platform, XenDesktop and XenApp are costeffective alternatives. In addition, the Citrix MDX ToolKit allows IT to add mobile policy enforcement to enterprise and third-party line-of-business applications with as little as one line of code. The WorxApp Gallery is an online marketplace of hundreds of third-party Worx-enabled mobile applications providing scores of useful mobile functions. With XenMobile, IT can configure devices with role-based authentication and access and implement policies that prevent enterprise mobile applications from sharing sensitive data or interacting with personal applications on the device. Citrix ShareFile, which is included with XenMobile Enterprise, is a powerful alternative to consumer file-sharing services such as DropBox. ShareFile encrypts all data and retains it within the enterprise, subject to stringent IT policies. The XenMobile s productivity apps, WorxApps, provide Android and ios devices with secure mobile applications for , calendars, web browsing, note-taking and remote desktop. The user experience is very similar to that of native ios and Android productivity apps enhanced with business optimized features such as the ability to add a file attachment to a meeting invitation. WorxApps also offer a greater level of security. For example, users can be prevented from forwarding sensitive information or cutting and pasting confidential company information into other documents. IT can enforce secure remote connectivity via a micro VPN and can disallow attachments in outgoing s, forcing users to provide ShareFile links for downloading instead. Finally, Citrix NetScaler, an application delivery appliance, gives mobile users secure, remote access to corporate web-based and virtual applications using highly granular, IT-configured access control. In addition to robust authentication and an application-level firewall, NetScaler acts as an application load balancer to provide reliable, high performance for enterprise and web applications during peak use periods. All web application components, including OWA, are deployed behind the enterprise firewall, rather than in the less-secure DMZ. Only Citrix provides an application delivery appliance as part of its EMM offering. Conclusion Organizations looking to migrate from a BlackBerry to ios or Android devices for BYOD, COPE or COPE environments have more options than ever before. Both Apple and Android now provide a host of enterprisefriendly management and security features that can be accessed and managed through third party EMM solutions such as XenMobile. XenMobile provides the most complete EMM solution for making the migration speedy and successful. 5

6 Corporate Headquarters Fort Lauderdale, FL, USA Silicon Valley Headquarters Santa Clara, CA, USA EMEA Headquarters Schaffhausen, Switzerland India Development Center Bangalore, India Online Division Headquarters Santa Barbara, CA, USA Pacific Headquarters Hong Kong, China Latin America Headquarters Coral Gables, FL, USA UK Development Center Chalfont, United Kingdom About Citrix Citrix (NASDAQ:CTXS) is leading the transition to software-defining the workplace, uniting virtualization, mobility management, networking and SaaS solutions to enable new ways for businesses and people to work better. Citrix solutions power business mobility through secure, mobile workspaces that provide people with instant access to apps, desktops, data and communications on any device, over any network and cloud. With annual revenue in 2014 of $3.14 billion, Citrix solutions are in use at more than 330,000 organizations and by over 100 million users globally. Learn more at www. Copyright 2015 Citrix Systems, Inc. All rights reserved. Citrix, XenMobile, Citrix Receiver, XenDesktop, XenApp, ShareFile and NetScaler are trademarks of Citrix Systems, Inc. and/or one of its subsidiaries, and may be registered in the U.S. and other countries. Other product and company names mentioned herein may be trademarks of their respective companies. 0415/PDF 6