I D C M A R K E T S P O T L I G H T. T h e E vo l u t i o n of Enterprise Mobility

Transcription

1 I D C M A R K E T S P O T L I G H T T h e E vo l u t i o n of Enterprise Mobility M a nagement: Protection Enables Productivi t y October 2014 Adapted from Worldwide Mobile Enterprise Management Software Forecast and Analysis and 2012 Vendor Shares, IDC # Sponsored by Symantec Enterprises around the globe are progressing to the next generation of technology innovation. While the collective power of cloud, social, and mobile technology offers many benefits, one of the most difficult challenges enterprises must deal with is the consumerization of IT. When solutions to securely access and work with content on mobile devices aren't provided by IT, the end user often finds insecure workarounds. IT is tasked with the difficult job of finding solutions that marry top-notch management and security architectures with inspired end-user experiences. Companies that deploy enterprise mobility management (EMM) and security solutions can enable employee productivity in a secure and user-friendly fashion, meet compliance mandates, avoid data loss, and enhance data protection. EMM can also prevent compromised devices from accessing corporate networks and provide granular role-based access to information and ensure that users are held to the same level of security practices across all their devices. This Market Spotlight examines these trends and how savvy organizations can embrace these changes by realizing the benefits of new EMM technology. Introduction For the past 30 years, the majority of enterprise IT environments have been operating under the client/server computing paradigm. In this model, IT had a broad level of visibility over the entire technology environment and employees carried out the majority of their work tasks via IT-managed and IT-secured applications and devices. While IT administrators were faced with many security challenges from external sources, they had some level of comfort with their ability to control the internal environment. While client/server computing still plays a significant role in the enterprise IT landscape, we are rapidly transitioning into the era of what IDC calls the 3rd Platform. This foundation is composed of four key pillars of technology: mobile, cloud, social, and big data. While each component holds significant benefit on its own, IDC believes the collective power of this platform is what will truly drive enterprise transformation. Over time, each major paradigm shift in computing has advanced the enterprise's ability to be nimble and customer focused. At the same time, such abrupt changes can be extremely disruptive to the status quo. While most companies want to empower their end users to be able to work at any time, from anywhere, and on any device, the practical realities of doing so have proven to be tremendously challenging. In this new model, one of the most difficult changes enterprises must deal with is the consumerization of IT. While IT used to hold all the decision-making power for devices and applications, end users now bring their own personal technology into the enterprise and expect IT to support it. While we are no longer in the early days of this trend, its popularity is still on the rise. For example, BYOD smartphones accounted for 52% of all business-use smartphones shipped in This percentage is set to rise to 68% by IDC 1793

2 Most enterprises today are supporting a broad range of mobile device types. According to IDC's 2014 Enterprise Mobile Device Survey, 77.1% of enterprises in the United States and the United Kingdom support Android, followed by 68.9% of enterprises that support ios, 65.7% that support Windows Phone/Windows Mobile, and 31.1% that support BlackBerry OS. Each OS is tied to myriad device models and has a unique upgrade cycle, resulting in a management nightmare for IT (see Figure 1). F i g u r e 1 OS Platforms Supported Today Android ios Windows Phone/Windows Mobile BlackBerry OS Other (% of respondents) n = 402 Source: IDC's Enterprise Mobile Device Survey, 2014 The myriad device types in the enterprise are the most tangible indicator of the complexity driven by mobile. Because each device hosts a mix of business and consumer applications, their impact goes well beyond the hardware itself. With that said, there is an interesting paradox in the number of mobile devices present in the enterprise and the number of applications organizations claim to have mobilized. According to IDC's 2014 Mobile Enterprise Software Survey, the largest percentage of respondents (38%) have mobilized more than three applications. On the other hand, the second largest group of respondents (21%) are currently piloting their first mobile application. While there is a perception that the "appification" of the enterprise is in full swing, these findings suggest there is still a high level of variance in relative mobile maturity. End users also expect their IT departments to provide them with consumer-like application experiences. This begins with the initial application delivery mechanism, where employees expect to be able to download their corporate apps from an app store. IDC finds that today, 55% of enterprises that provide mobile apps to employees are leveraging private enterprise application stores for application delivery, while 38% deploy these apps via public app stores such as Google Play or the Apple App Store. In 2013, the split was more even, suggesting that over time, more companies are looking to provide apps to employees through a private app store. Beyond applications, employees need to be able to easily access the content required to do their jobs from anywhere at any time. When solutions to securely access and work with content on mobile devices aren't provided by IT, the end user often finds insecure workarounds. A common instance is IDC

3 the employee who innocently saves corporate documents into his/her personal cloud storage service, unaware of the potential security risks of doing so. IDC finds that increasingly, businesses understand the criticality of providing an IT-approved solution for these capabilities, as 48% of respondents replied that they have provided mobile access for file access and sharing. While it is clear that end users hold more influence over the corporate technology environment than ever before, IT is still held responsible for minimizing organizational risk. Therefore, IT is tasked with the difficult job of finding solutions that marry top-notch management and security architectures with inspired end-user experiences. When seeking such a solution, IT must perform due diligence on the scope of the potential risks mobile computing brings into the enterprise as well as end-user expectations. IT Considerations Devices and operating systems. As mentioned earlier, the complexity of device types and OS versions creates a major management headache for IT organizations. Beyond the additional workload, the associated reduction in visibility presents another significant challenge. Today, many companies do not have an automated method to keep track of which devices are accessing corporate resources. If the organization lacks insight into what devices are accessing corporate information, it has no visibility into where that information could end up once it leaves the company perimeter. Another issue is the fact that each device and OS version presents unique vulnerabilities. If IT does not possess a solution to keep track of the security vulnerabilities in each device and OS, it is poorly positioned to guard against the inherent risk these devices present. In addition to the potential OS-level vulnerabilities, end users may also take actions to lower the security of devices, such as rooting or jailbreaking. Therefore, IT also needs a way to track and remediate noncompliant devices. Managing and securing data. While the devices themselves are one concern, the data flowing back and forth between the devices, the corporate network, and the cloud is another major issue. Even if IT has a handle on which devices are accessing the network and their risk postures, controlling what information the device accesses and what happens to that information once it leaves the enterprise network can be very tricky. Consider the following common scenario: An employee opens an attachment from his/her corporate box and chooses to save it to a personal cloud storage service, such as icloud or Dropbox. When employees transfer enterprise data into public cloud services, IT usually loses its ability to manage the data from that point forward. Another potential issue is employees forwarding or sending sensitive information from mobile devices to parties that should not have access to that information. This may happen via or through a cloud storage and collaboration service. In either case, IT needs some way to manage what employees can and cannot do with content accessed on mobile devices. Managing risks from apps. Apps themselves present a risk. It has been well documented that the prevalence of Android malware has spiked right along with the popularity of the platform. This is less of a problem on ios devices because of the closed nature of the Apple ecosystem, but it's not a nonexistent issue. When employees download consumer applications to their personal devices, enterprises have no way of knowing the risk profile of that application. An app could be full of malware which could then corrupt the entire device OS, putting the information on all the other apps at risk and it could also be asking for information that a company would prefer it didn't have access to, such as contacts. Understanding the risk profile of various applications is an important step to safeguarding the overall health of the device IDC 3

4 End-User Requirements Privacy expectations. End users have an expectation of privacy when they leverage their personal devices for work. The reality is that various models of mobile management come with various levels of trade-off in terms of IT control versus end-user privacy. Nonetheless, IT needs to be transparent with end users regarding the level of control it deems necessary and how end users can avoid remediation that impacts their personal data on the device. Education about and respect for end-user privacy are important to a successful BYOD program. Optimal user experience. End users often make device choices based on their enjoyment of the native experience of that device. Mobile management and security solutions that take the user too far out of that experience will be less well received than those that provide a native look and feel. In addition, user experience is impacted by the number of clicks and gestures required to work with apps on a device. Mobile security solutions that enable streamlined and secured workflows are best positioned to meet the needs of end users and IT. Mobility is complex and requires management and security solutions that take a number of requirements into consideration. We see enterprises starting to settle on ios and Android as their preferred mobile operating systems, but trends around wearable technology and the Internet of Things (IoT) ensure that the environment will only grow in complexity over time. In addition, laptops and desktops will continue to be a mainstay for many years to come. Successful solutions will need to address security in a streamlined, consistent way across any device. Basic Definitions The enterprise mobility management (EMM) software market represents a merger of mobile device management (MDM) enterprise software and mobile application management (MAM) software markets and includes products that offer standalone MDM, standalone MAM, or combined MDM, MAM, and mobile content management (MCM) functionality. An MDM solution consists of many of the standard features included in PC management solutions but also includes additional functionality that addresses the unique needs of mobile devices such as smartphones and media tablets and, increasingly, other areas. MDM functionality typically includes device provisioning and managing configuration settings, inventory/asset management, software distribution, remote wipe/lock, remote control for systems diagnostics, policy management, authentication and certificate management, real-time device monitoring, location information, GPS breadcrumbing, and reporting and analytics. MAM refers to a solution by which specific mobile applications can be managed, secured, and distributed by IT organizations and typically allows for enhanced policies to be applied to individual applications. MAM solutions can either supplement MDM functionality or stand alone and typically include some combination of management of the application life cycle and granular security management and corporate policy control of applications and content. The ability to discover and remediate risky applications can be considered within this context as well. MCM solutions are often offered as a core component of EMM solutions. Mobile enterprise content access and collaboration solutions offer IT a secure way to provide access to files/content/data sitting in various data stores to mobile devices. Such solutions may also provide mechanisms to collaborate on this content as well. These products allow IT to manage who gets access to what information and may tie in with other back-end or mobile-specific policy systems. Preventing data loss is a key goal of these products, and they do so by providing IT with a mechanism to control data flow in and out of the secured app. These solutions assist with compliance and governance by offering reporting on user activity with mobile content IDC

5 Another key mobile enterprise security component complementary to EMM is mobile threat management, which includes anti-malware, anti-spam, intrusion prevention, and firewall technology for mobile devices. The Benefits of an Effective EMM Strategy Companies that deploy enterprise mobility management and security solutions can gain the following benefits: Enable employee productivity in a secure and user-friendly fashion Meet compliance mandates Avoid data loss and enhance data protection by providing separation between personal and corporate information on the device Prevent malicious and risky apps from getting access to sensitive data on devices or corporate networks Prevent compromised devices from accessing corporate networks Provide granular role-based access to information and ensure that users are held to the same level of security practices across all of their devices Enable single sign-on across mobile applications Set different levels of security/policy by app type Provide a centralized method to manage device and application inventories, life cycles, and policies Integrate security/compliance policies with file/document management access Key Trends The following trends have been identified in IDC research: Increased market maturity. From 2009 to 2013, mobile management and security markets experienced rapid expansion and consolidation. This activity, coupled with the fast pace of change at the endpoint, created an atmosphere of uncertainty for the IT buyer. Today, however, enterprises realize that mobile is too prevalent across the organization to stand still. In concert, the solutions have matured enough so that companies have stable options to choose from. Instead of thinking about device management versus containers, enterprises should seek holistic mobile security strategies that look across operating systems, applications, data, and networks. User centricity. Consumerization has moved the focus of the market from the device to the user. As devices, applications, and data grow in complexity and volume, the idea that identity can provide a stable source of trust becomes more salient. As organizations rely more heavily on identity for centralized policy management, we expect to see a broader interest in biometrics and multifactor authentication. In addition, as the number of devices per user increases, buyers will increasingly seek solutions that offer per-user pricing instead of per-device pricing. Secure application life-cycle management (ALM). New application development, discovery, and deployment paradigms change the way enterprises think about managing and securing apps/data. IDC recommends that organizations build security into the application development process to ensure that all applications are being secured before deployment in a consistent manner. Most organizations will deploy a mix of custom, packaged, and third-party applications as well as various application architectures and will therefore require flexible solutions IDC 5

6 Ongoing importance of . Although organizations are starting to deploy a range of vertically and horizontally focused apps, is still considered the killer app for mobile. Offering employees a native or native-like experience for corporate is key to ensuring end-user compliance and lowering the risk of potential data loss. The ability to integrate mobile with a back-end data loss prevention (DLP) solution will add another layer of security for this important app. The amplified imperative for IT/LOB alignment. Mobility has heightened the need for business agility, and it is not unusual for newly empowered lines of business (LOBs) to chart their own course. IDC has observed LOBs rushing off to build mobile applications without IT governance or support, which can lead to major security gaps. Organizations need a way to open the lines of communication between IT and LOB to ensure the correct balance between security and agility is achieved. Other Considerations IDC has observed that customers are struggling with mobility purchasing decisions for several reasons, including the required people and process change management, the fast-moving pace of the technology itself, and the complexity of the vendor landscape. We offer the following considerations to companies seeking mobile security and management solutions: Strategic approach to vendor selection. Customers are presented with mobile management solutions from a range of vendors with which they have existing relationships as well as net-new companies. Included in this mix of vendors are their security providers, desktop management and/or client virtualization infrastructure vendors, and pure-play mobility management companies. Adding to the complexity are the varied approaches these vendors offer. Due to the pervasive nature of mobility, companies should partner with the vendor that best aligns with their vision of how IT will deliver value to the organization in the future. Simplicity lowers risk. Although all organizations should implement layered approaches to security, the reality is that each company has a distinctive back-end infrastructure, as well as a unique tolerance for risk. In general, IDC recommends that organizations seek solutions that simplify their infrastructure. Complexity lessens the efficacy of security measures. Flexibility and future proofing. Mobility is a fast-moving market an organization's requirements may look quite different within a 6- to 12-month time frame. For this reason, customers need to ensure not only that the vendor they partner with can meet the needs of the organization today but also that this vendor has enough foresight and agility to be in front of tomorrow's trends. In addition to vetting the future orientation and flexibility in mobile product design, organizations need to more heavily scrutinize the broader vision of the vendor they do business with. As mobility becomes more and more interwoven into the fabric of IT, it is critical to do business with vendors with the ability to execute on their vision for growth. Conclusion Today, enterprises around the globe are slowly progressing from the computing platforms of yesterday to the next generation of technology innovation. While the collective power of cloud, social, and mobile technology will enable businesses to transform from their current state to the next level of customer centricity, such major paradigm shifts do not come without new concerns. One such challenge for the enterprise is the ongoing consumerization of technology. While this trend is easily observed by the large range of devices that IT is now required to support, the myriad risks that these new device types present to corporate security are much less visible. Despite all of the complexity mobility brings into the IT environment, savvy organizations realize change is inevitable, and the potential benefits of embracing new technology can far outweigh the risks IDC

7 Capitalizing on this opportunity requires a shift in thinking. IT and the business must see security as an enabler of rather than a barrier to business productivity. When IT departments procure security solutions, the end-user experience must be at the forefront of the purchasing decision instead of an afterthought. In addition to a thorough vetting of the user experience, consideration must be given to each step in the end-user workflow. If companies do not take the time to understand the ways in which mobile employees work on their devices, they could be missing potential sources of vulnerability. Of equal importance is the efficacy of the user experience for IT. Solutions that tie in with existing security infrastructure and offer a streamlined process to manage devices, apps, and data across users are more efficient and secure than cobbling together a patchwork solution from various point products. While striking this elusive balance between end-user enjoyment and protection can be a challenge, companies that succeed at this task will find the resulting business outcomes are worth the journey to get there. A B O U T T H I S P U B L I C A T I ON This publication was produced by IDC Custom Solutions. The opinion, analysis, and research results presented herein are drawn from more detailed research and analysis independently conducted and published by IDC, unless specific vendor sponsorship is noted. IDC Custom Solutions makes IDC content available in a wide range of formats for distribution by various companies. A license to distribute IDC content does not imply endorsement of or opinion about the licensee. C O P Y R I G H T A N D R E S T R I C T I O N S Any IDC information or reference to IDC that is to be used in advertising, press releases, or promotional materials requires prior written approval from IDC. For permission requests, contact the IDC Custom Solutions information line at or gms@idc.com. Translation and/or localization of this document requires an additional license from IDC. For more information on IDC, visit For more information on IDC Custom Solutions, visit Global Headquarters: 5 Speen Street Framingham, MA USA P F IDC 7