t I. Mobile Device Management: 2014 Vendors and Comparison Guide 1. MDM Considerations By Kasia Lorenc, Fritz Nelson, JUNE 10, :30 AM

Transcription

1 t I. Mobile Device Management: 2014 Vendors and Comparison Guide By Kasia Lorenc, Fritz Nelson, JUNE 10, :30 AM 1. MDM Considerations Making sense of the different mobile device management solutions can be tough. On the surface, the MDM tools seem very much the same, but each has its strengths and weaknesses. This comparison guide will introduce you to 14 MDM vendors and their mobile management solutions. The growing BYOD trend along with consumerization of IT has transformed the way enterprises deal with data security. Mobility is being embraced by end users and business leaders alike, and IT departments are left with the balancing act of securing corporate data and ensuring productivity. Within the next five years, 65 percent of enterprises will adopt a mobile device management (MDM) solution, according to IT research firm Gartner. The key will be choosing a solution your business can grow with; one that will be able to meet your corporate data governance and compliance needs as well as end user expectations. Today, IT administrators have a lot of choices when it comes to enterprise mobility management (EMM) and many businesses are opting for MDM solutions that offer more control than mobile application management (MAM) or mobile content management (MCM). [Read How to Evaluate Mobile Management Solutions for a good review of the differences between MDM, MAM and MCM and when to choose one over the others.] Most MDM solutions can support both corporate-owned and personal devices, including smartphones and tablets, and many cater to a variety of mobile operating systems. However, each solution is unique, offering different levels of support, integration, management and usability; additionally, each MDM tool handles data security and privacy differently. When choosing an appropriate mobile device management solution, IT administrators should evaluate not only their organization's compliance and security requirements, but also their end users' needs and how the solution fits within their current IT infrastructure. To help IT admins make sense of what the enterprise mobile device management solutions have to offer and how they should approach their purchasing decisions, we came up with a list of five main evaluation considerations and asked a number of MDM vendors to tell us about their solutions. The vendors we reached out to include leaders, visionaries as well as some of the niche players in the MDM space. Here are the five considerations we asked vendors to respond to: Integration and compatibility, Capabilities and key features, Management and usability, Security and privacy, Pricing model MDM Vendor Comparison In the pages that follow, each vendor (presented alphabetically) shares the most important details of their MDM solution as they pertain to these five considerations. Our hope is that this information will help you get started with evaluating enterprise MDM solutions to figure out which one is right for your business. Note that some of the vendors on our list go beyond MDM to offer a much broader EMM solution, incorporating MAM, MCM as well as other security features, functionalities and integrations. The answers are presented in the words the vendors provided us, edited slightly for clarity, and heavily for brevity. We originally asked that each company stick to a word limit and most of them failed at the task, primarily because it's nearly impossible to get across everything the products accomplish in a reasonable amount of space. Needless to say, each company has more details, more explanations, more points of comparison and differentiation to share. We've provided merely the highlights and you can visit the websites and talk to the representatives of each of these companies to get more. Update: June 2014 In this latest update, we've added responses from Amtel, CA Technologies and Dell to the list. We also asked each vendor to update their page with new features, capabilities, integrations

2 and and anything else that has changed their platforms in the past six months. You'll notice some vendors included upcoming features as well. The enterprise mobility space is changing rapidly and you'll see it shifting even more as companies are bought and sold and solutions merge with others. Recently AirWatch was acquired by VMware, BoxTone was acquired by Good Technology, and Fiberlink was acquired by IBM. The next time we update this guide the pool of available solutions might get smaller instead of bigger, but that's how things are. So away we go... More by Kasia Lorenc Twitter Google+ LinkedIn 2. AirWatch by VMware AirWatch offers one of the more comprehensive enterprise mobile management solutions that scales across cloud and on-premises deployments. The platform supports containerization through it's Workspace feature along with a "dual-persona" option that separates the personal and corporate resources on the devices. AirWatch was recently acquired by VMware and identified as a leader in the enterprise mobility management space in Gartner's magic quadrant. AirWatch integrates with AD/LDAP, Certificate Authorities, Public Key Infrastructures, infrastructures and other enterprise systems both in cloud and on-premises deployments. For cloud deployments, the AirWatch Enterprise Integration Service (EIS) server connects cloud instances to on-premises services through a secure, self-service process. For on-premises environments deployed in tiered network models, the EIS server enables AirWatch to communicate to various corporate services across network layers. AirWatch also provides manufacturer-specific API integration, including full support for all publically available ios and Android APIs (including Samsung SAFE and KNOX). In addition, AirWatch offers a large collection of SOAP and REST APIs that allow external programs to use product functionality and data for business purposes. AirWatch offers a mobile platform that has the ability to scale, enabling customers to create an ecosystem of resources within their own organizations. The management platform is able to extend integration with other resources, such as content repositories, workflow systems, telecom controls and more. AirWatch supports the following mobile operating systems and platforms: Apple ios 4+, 5+, 6+ and 7+ Android 2.2+, 3.0+ and 4.0+ Windows Phone 7+ and 8+ Windows 8, 8.1, RT and RT 8.1 BlackBerry 4, 5, 6, 7 and 10 Symbian S60 and ^3 Windows Mobile 5.x and 6.x Windows CE 4, 5 and 6 Apple Mac OS X 10.7 (Lion) and higher AirWatch offers a fully integrated comprehensive platform with built-in components for bring your own device (BYOD), containerization, application management (including SDK and App Wrapping), workspace management, secure , content management, secure browser, multi-user management and reporting. Some of the key features include: Enterprise Integration -- AirWatch partners with mobile technology providers (including certificate authorities, device manufacturers, application developers, network access control, telecom expense management, VPN, web security) to bring simplified mobility management. Enterprise Architecture -- AirWatch MDM scales to support deployments of hundreds of thousands devices through a robust architecture that is fully configurable. Built on industrystandard technology, the solution minimizes management concerns with existing enterprise applications and infrastructure and can be deployed into a highly available environment, fully supporting disaster recovery configurations. Flexible Delivery -- AirWatch delivers the exact same solutions and scaling capabilities regardless of whether your deployment is SaaS or on-premises. Customers can migrate from one deployment type to the other. AirWatch architecture is highly scalable for on-premises, appliance and cloud deployments that meet strict requirements for high availability and redundancy. AirWatch uses industry standard development platforms, including.net, MS SQL and HTML 5. The company provides advanced reporting, alerting, monitoring and workflow with a data mart support for easy export of data to third-party business intelligence solutions. Additionally, AirWatch offers a software development kit (SDK) and App Wrapping frameworks, and it can incorporate additional device management capabilities into internal applications for advanced security, authentication and data loss prevention. AirWatch scales with built-in multi-tenancy, allowing administrators to delegate role-based access and capabilities to both user groups and specific device groups.

3 AirWatch provides a variety of management solutions and tools including: Mobile Device Management -- Enroll corporate-owned, shared and BYOD devices into enterprise environments quickly, configure and update device settings over-the-air, secure mobile devices and manage devices from a central, Web-based console. Mobile Application Management -- Acquire, distribute, secure and track public, internal and purchased applications through native app stores, the AirWatch App Catalog or by integrating with purchasing systems such as Apple's Volume Purchase Program, in addition to enhancing applications which the AirWatch SDK and App Wrapping technologies. Mobile Content Management -- Secure document distribution, collaboration, mobile access to enterprise document repositories and protection for sensitive information using the Secure Content Locker. Mobile Management -- Deliver comprehensive security for enterprise infrastructures, including personalized settings and data loss protection for native clients and with the AirWatch Inbox. Mobile Browsing Management -- Define and enforce secure browsing policies, including whitelisting, using the AirWatch Browser. AirWatch customers can enable secure access to mobile corporate resources through standalone application containers or by using the AirWatch Workspace option for a dual-persona user experience separating corporate and personal information. Both approaches enable administrators to configure authentication options, single sign-on and define security settings to prevent leakage or corruption of corporate data. AirWatch container solutions include the AirWatch Workspace, as well as standalone applications to secure (through the AirWatch Inbox), applications (through SDK and App Wrapping), content (through the Secure Content Locker) and browsing (through the AirWatch Browser). AirWatch provides a variety of tools that allow administrators to quickly access, export and take action on information regarding the device fleet. AirWatch Dashboards give administrators a quick view into real-time deployment information. Available dashboards include Asset Management, Device Compliance, Management, Telecom Usage and more. The on-demand Self-Service Portal also allows end-users to remotely monitor and manage their mobile devices. AirWatch provides end-to-end security that extends to the user, device, application, content, data and network levels. Key security features include: Multifactor user authentication; Enforcing consistent security policies; Encrypting sensitive corporate data ; Supporting internal PKI and third party certificates; Managing user access to corporate resources; Integrating with Network Access Control (NAC) systems; Enforcing compliance rules and actions; Remotely wiping enterprise data; Protecting privacy through configurable settings, such as application inventory and physical location tracking, for BYOD deployments.

4 The AirWatch Agent application uses a proprietary algorithm to detect for jailbroken or rooted devices and takes immediate automated action to protect corporate information using the built-in Compliance Engine. If a device is compromised, AirWatch can enforce compliance rules and actions or remotely wipe enterprise data. AirWatch Application Reputation Scanning for Android allows IT to identify common application risks, such as access to privacy settings, insecure network connections, malicious code and more. With AirWatch, administrators can run application scans, view the results and take action. The comprehensive AirWatch-enabled mobile ecosystem includes leading application risk management providers to deliver advanced application risk management functions integrated with AirWatch. Pricing starts with a $51 one year subscription fee, which includes standard hosting. Additional pricing information can be found at air-watch.com/pricing. 3. Amtel MDM Amtel is a new addition to our MDM guide this quarter, offering quite a number of features including mobile expense management. The cloud-based service is able to deliver real-time device usage information for expense control and offers ERP integration, which is not a common enterprise mobility feature. It's worth to note that Amtel does not support Windows mobile devices at this time. Amtel MDM supports the following mobile operating environments: Apple ios 4 and up, including ios 7.1 Android 2.x and up, including Android 4.4 Samsung SAFE and KNOX BlackBerry 4 and later versions Mac OS X More an an MDM, Amtel delivers a mobile lifecycle management portfolio in a single integrated cloud based platform that also includes mobile expense management (MEM/TEM) and mobile application management (MAM) including an enterprise apps store management. Amtel's cloud based solution is integrated with Microsoft's Active Directory, Exchange Active Sync and Office 365. Amtel also helps customers with single sign-on and self-enrollment options using secure credentials. Amtel's TEM is integrated with enterprise financial ERP systems for automated cost allocations. Amtel works closely with mobile device manufacturers, such as Apple and Samsung, on API integration. Samsung SAFE and KNOX and Apple ios 7 security enhancements are supported. Amtel's Web services APIs allow partners and enterprises to integrate the solution with enterprise systems and business processes. Amtel offers additional enhanced and ancillary services via third-party partnerships, including: BYOD global handset logistics support using managed providers; enterprise apps creation and integration into Amtel's platform using APIs and SDK by third-party mobile app developers; third-party Wi-Fi vendors' integration with Amtel's platform; and third-party file management solutions integration using APIs. Amtel's MDM is pre-integrated with Amtel's TEM, resulting in real-time usage monitoring and restriction, call management and alerts for expense control. Amtel includes "geofencing," with capabilities to automatically activate or deactivate device features and access to apps and corporate data, based on GPS location of enrolled mobile devices, relative to geofence boundaries. Geofencing helps simplify mobility for users with automatic Wi-Fi and server access configuration, as devices move in and out of geofence boundaries. Security policies can be defined to restrict access to sensitive corporate apps within geofenced work locations, block market app access in the area and also disable camera and other device settings to protect sensitive corporate information. Amtel's Mobile Lifecycle Management architecture is scalable to tens of thousands of devices and users, and the multi-tenant software as a service is designed for cloud based deployments. It provides customers with a secure, customized multi-tenant application via a private dedicated cloud, which means fast deployments, instant software updates and always-on accessibility. Additionally, Amtel's solution spans the entire mobile lifecycle from activation and user onboarding to ongoing management, support and eventual retirement of devices. Core product functionality is provided security and expense control with a comprehensive feature set. Amtel MDM is deployed on a secure private cloud with reliable SSAE 16 Type II compliant hosting. Admins can centrally register and configure corporate liable and BYOD devices. Users can be authenticated with Active Directory or secure system generated credentials. Self-enrollment option is easy to deploy by pushing a link via , SMS, URL or QR Code. Amtel's cloud based console provides visibility into corporate liable and BYOD devices across the organization, enabling rapid mass enrollment. Admins can centrally manage user profiles and devices with anytime, anywhere access. Real-time alerts and notifications can be set up for both admins and users for taking remedial actions. Administrators can view status of users and the fleet of devices on customized dashboards, drill down into details, query devices and remotely push required device settings and actions such as remote lock and wipe and extensive reports that provide actionable information. Available dashboards include Asset Management, Device Compliance, Management, Telecom Usage and more. Administrators can also utilize the unified console for mobile device security, apps, content and expense management. Authentication and access control are simplified with Active Directory or LDAP integration and role-based administration of departments and groups. With Amtel's Mobile App Management, companies can manage mobile app delivery through the entire lifecycle from purchasing and remotely provisioning to the various tasks needed to manage them, including configuration, distribution, updates, version control and removal. Enterprise app store features enable companies to create their in-house apps and push them to the corporate devices without having to put them on App Store or Google Play. Organizations can take control over public mobile apps with blacklist and whitelist policies and flexible time and location based access restrictions, including what apps can be run and what apps cannot be run within the boundaries. Administrators can set up and manage mobile security policies to help protect sensitive information, minimize risks, and meet regulatory compliance requirements. With the ability to detect and quarantine compromised devices and block jailbreak (ios) or rooted (Android) devices from corporate access, BYOD access in the enterprise can be secured. Capabilities to help protect enterprise data include the ability to remotely lock and unlock lost or stolen devices, and full or selective wipe of content as well as policy settings to restrict mobile device features such as camera or NFC at sensitive locations.

5 By centralizing device configuration, server, Wi-Fi, VPN, LDAP and CalDAV settings are easily rolled out. Self-enrollment option for quarantine mode helps secure onboarding of BYOD users. Settings for enterprise access, including encryption and VPN can be centrally configured and pushed out. User or admin alerts and reports help manage BYOD with monitoring and audit trail. Containerization helps protect corporate content by sharing only in secure containers. Admins can set policy to automatically disable access and wipe container if a device is compromised, non-compliant or when users leave the company. They can push content updates centrally to container as well as restrict access based on time of day or location of mobile device. Corporate data is kept safe and secure with 256-bit SSL encryption and content can be automatically removed upon exit from enterprise apps. With Amtel's Secure Workspace for Android, administrators can control how users' home screens look and operate, restrict what apps can be accessed by a user and automatically hide any of the installed widgets and apps. Browsing can be restricted to selected URLs to control Web surfing. Amtel's Mobile Lifecycle Management is a cloud based service, offered as a monthly subscription, renewed annually. Customers can choose Mobile Device Management that includes security and apps management or Telecom Expense Management that includes both mobile and telecom expense control. While pricing is separate, the two solutions are delivered on a single, integrated cloud based console. Pricing for each solution is a fixed monthly subscription fee, which includes unlimited support and updates. List price is $5 per device per month, with discounts available for volume purchases. Because Amtel offers a private cloud based solution, there is no separate charge for hosting. Also, there are no onboarding or support fees. 4. BlackBerry BES10 BlackBerry's BES10 enterprise mobility management suite is not just for BlackBerry devices; the MDM offers support for Android, ios and soon Windows Phone 8 devices as well. A cloudbased version of the service, BES10 Cloud, is currently in preview and is expected to launch in Where BES10 stands out is in government approval, recently obtaining full operational capability from the US Defense Information Systems Agency. BlackBerry Enterprise Service 10 (BES10) provides multi-platform device management, application management, content management and security for ios, Android and BlackBerry devices. BES10 allows administrators to integrate with all major messaging platforms such as Microsoft Exchange, Office 365 and Lotus Domino and can also configure Nitrodesk Touchdown for Android devices. With the introduction of BlackBerry Enterprise Service 12 (BES12) later this year, the company will also support Windows Phone 8 devices. BES10 is flexible, cost effective, secure and scalable, and builds on more than a decade of enterprise mobility management and security expertise. BlackBerry is a trusted mobility partner to global government agencies and enterprises offering a low total cost of ownership. Security, productivity, communications and collaboration are the key differentiators of BlackBerry's MDM platform. BlackBerry's Secure Work Space for ios and Android containerization solution (PDF data sheet) enables a single device to be used for both work and personal use, and extends BlackBerry's secure management to ios and Android devices. Secure Work Space is a containerization, application-wrapping and secure connectivity option that delivers a higher level of control and security to ios and Android devices, all managed through the BES10 administration console. Managed applications are secured and separated from personal apps and data, providing integrated , calendar and contacts apps, an enterprise-level secure browser and secure attachment viewing and editing with Documents To Go. With a growing eco-system of Secure Work Space productivity apps from third parties (available on the App Store and Google Play), customers can deploy these popular apps easily from BES10 with the same level of confidence and built-in security. BES10 enables secure connectivity to the enterprise through a number of different channels. In addition to the standard AES-256 encrypted connection through the BlackBerry Secure Infrastructure, BES10 supports direct connections over VPN and ActiveSync. This connectivity provides a flexible way of connecting to the enterprise while protecting the integrity of the enterprise firewall. BES10 provides a seamless way for administrators to configure security, networking and application access on employees' mobile devices, whether the devices are corporate owned or BYOD. Administrators can configure network access through VPN and Wi-Fi connectivity or use the built-in connectivity provided by the platform that leverages the BlackBerry Secure Infrastructure. Administrators can also configure access to applications on the device via Work application catalogs that allow end-users access to the applications they require to be productive. Additionally, BlackBerry Web Services allows administrators to extend the functionality of BES10 by integrating their EMM with back-end systems such as HR, payroll and ERP. End-users also have access to the powerful BES10 self-service portal, which allows them to perform simple security management tasks safely, reducing the load on their helpdesk. Delivered through a single end-to-end platform, BES10 provides proven security controls over and above standard ActiveSync capabilities. BES10 enables the separation of work and personal content to satisfy both user and corporate needs without compromising on end-user and corporate needs. End-user Needs: BlackBerry Balance is designed from the ground up with user experience at the forefront, creating a seamless experience on BlackBerry 10 devices that allows data to be merged at the UX layer and separated within the OS. BlackBerry Hub lets users read and respond to work and personal messages in a single view without needing to switch apps. For ios and Android users, the Secure Work Space for ios and Android option provides a native experience for secure access to , PIM, content, apps and also includes Documents to Go for full secure viewing and editing of Microsoft Office documents and PDFs. Corporate Needs: The BES10 Gold-level EMM option for managing BlackBerry 10 devices provides enterprises with full management including logging control over the entire device, allowing security-conscious customers in regulated industries (such as government, finance and health care) to deploy bring your own device (BYOD), corporate owned, business only (COBO), and corporate owned, personally enabled (COPE) solutions. Comprehensive application deployment, management and security provides the ability to push and install mandatory apps and publish recommended apps to users through a corporate app storefront to the Work Space, without impacting their ability to access and use personal apps and content in their Personal Space. Application Security: In order to provide a stringent level of protection for customers against malicious applications, BlackBerry's multi-layered strategy focuses on innovative scanning techniques, internal analysis and working with industry-leading third-party anti-malware vendors (BlackBerry has partnered with Trend Micro to leverage their mobile scanning and detection capabilities). Moreover, BES10 delivers full multi-os device and app management for ios, Android and BlackBerry where in-house enterprise apps can be easily developed, secured and deployed to the Work Space. Secure Connectivity: BES10 enables secure connectivity to the enterprise through a number of different channels. In addition to the standard AES-256 encrypted connection through the BlackBerry Infrastructure, BES10 supports direct connections over VPN as well as ActiveSync. Certificate Support: BES10 allows for tight integration with Certificate Authorities to secure wireless connectivity and enterprise communication. BES10 allows an administrator to configure a Secure Certificate Enrolment Profile (SCEP) for WiFi, VPN and ActiveSync authentication. This allows a device to securely authenticate with the service, using certificate based authentication.

6 BES10 also allows an administrator to configure integration with corporate and/or public LDAP directories, allowing devices to automatically retrieve S/MIME public certificates Over The Air (OTA) as required. In addition, the administrator can specify an Online Certificate Status Protocol (OCSP) profile which will allow a device to automatically validate a certificate's status against a Certificate Revocation List (CRL). BlackBerry offers three licensing levels: Silver licenses ($19 per year, per device) include comprehensive multi-platform device, application, and security management for BlackBerry, ios and Android devices. Silver licenses include the unique BlackBerry Balance containerization feature for BlackBerry 10 devices. Gold BlackBerry licenses ($60 per user, per year) include Silver features plus additional features to enable compliance for government, financial services, regulated and other highsecurity environments. Gold Secure Work Space licenses ($60 per user, per year) include Silver features plus additional controls and full containerization to separate work and personal data on ios and Android devices. BlackBerry has recently introduced the BlackBerry EZ Pass Migration Program, which provides free license migration and support for BlackBerry customers to move from BES5 and other MDM platforms to BES CA Technologies MDM CA Technologies' Mobile Device Management suite, announced at the Mobile World Congress 2014 conference in Barcelona, is a newcomer in the enterprise mobility space offering both a cloud-based and on-premises deployment option. CA MDM supports Android, ios, BlackBerry and Windows devices and allows for a separation of end-user and corporate profiles through CA's Smart Containerization technology. CA Technologies Mobile Device Management (CA MDM) supports a wide variety of mobile devices and environments, including ios, Android, and BlackBerry devices. In addition, a common interface and workflow is preserved between all mobile platforms as well as traditional Windows desktop endpoints to allow seamless transitions. Supported devices include: Android 3, 4 Apple ios 4, 5, 6, 7.x BlackBerry 5, 6, 7 Windows Phone 8 (including app management) Windows XP, Vista, Windows 7, Windows 8 CA MDM offers policy-based enrollment to configure and access enterprise resources from BYOD devices. CA MDM allows administrators to securely manage enterprise content and functions on BYOD devices independently of personal content and functions, and an optional end-user function allows the removal of CA MDM control. These security features can be enabled with absolute minimal IT involvement within 90 seconds and last through the entire life of the device. The enterprise app store allows total control of application life cycle management and integration with out-of-the-box support for key enterprise resource solutions for Microsoft Exchange, Active Directory and certification authority. Extended analytics features like real-time analytics for telecom expense management help control costs. CA MDM comes equipped with enterprise integration support and directory integration through Lightweight Directory Access Protocol (LDAP). It also provides Active Directory and native new technology (NT) domain support, certification authority, as well as backup and restore management tools. To help reduce the need for staff intervention, a self-service portal streamlines the enrollment and provisioning of each device. To bolster core infrastructure security and facilitate ease of network deployment, CA MDM uses a relay server in a demilitarized zone (DMZ). It also provides comprehensive add-on security options that can secure both internal and external communications within enterprises. In the case of loss or theft, end-users can remotely locate, lock and wipe a lost device, reset the passcode, remove enterprise controls and unregister a device through the use of an easy-to-use admin/self-service portal. The pricing model for CA MDM is on a per user basis to enable the user irrespective of the type or number of devices they choose to use. Pricing starts at $1.75 USD per user per month. CA also provides a SaaS pricing model. For example, an organization with 10,000-30,000 users will find CA MDM costs them $2.11 per user, per month for a three year contract. 6. Citrix XenMobile Citrix XenMobile includes a suite of solutions that facilitate mobile device, application and content management. Combining ShareFile, NetScaler, XenApp and XenDesktop, the EMM solution is comprehensive, albeit a bit difficult to manage. Citrix is working on integrating the different administration consoles into a single pane of glass experience, which will be available later this year, and is available for both cloud-based and onpremises deployments. With Citrix XenMobile users can choose any device including ios, Android (Samsung, Samsung Knox, or Android variants, including Amazon Kindle, smart displays and smart drives)

7 Windows Phone 8, Windows 8 devices, BlackBerry and Symbian, while IT can ensure compliance of corporate assets and secure corporate content on these devices. XenMobile includes several out-of-the-box integrations with back-end IT infrastructure. The solution integrates with Microsoft Active Directory/LDAP, PKI, Microsoft Exchange and Office 365 or Lotus Domino, Cisco ISE, Microsoft SharePoint, NAC, Secure Web Gateways, SIEM and perimeter DLP systems. Citrix offers a complete mobile workspace technology for the secure delivery and management of mobile, web, SaaS and Windows apps, including and collaboration, data and devices, over any network from any cloud. What's unique about XenMobile is the solution's ability to go beyond device management, to combine the best of MDM, MAM, secure , secure browsing, secure data collaboration and management (Citrix ShareFile, Microsoft SharePoint integration and DLP integrations), mobile network control and performance (NetScaler Gateway), access to Windows and data center apps on mobile devices (XenDesktop and XenApp), federated identity and SSO, and mobile collaboration and productivity capabilities (Citrix GoToMeeting, Citrix GoToAssist and Citrix Podio). The figure below illustrates the breadth of the mobility offerings from Citrix. XenMobile's security capabilities include a highly secure and scalable architecture, real-time integration with Active Directory, continuous compliance and enforcement, jailbreak/rooting checks prior to device enrollment, as well as nearly 60 different policy options for app security using Citrix MDX technology. XenMobile utilizes Micro VPNs (dedicated application specific VPN connections), secure sandboxed client for ios and Android, and unique data collaboration and management with Citrix ShareFile across mobile platforms, PCs and Macs. ShareFile is storage agnostic, meaning data can be in the cloud, or on-premises (on SharePoint or network drives), and allows document editing on mobile devices and full desktop (Windows and Mac) syncing capabilities. Additionally, XenMobile provides data leakage prevention with the ability to restrict open-in capabilities to secure apps and block copy/paste or print. XenMobile provides single sign-on (SSO) capabilities to all app allowing IT to proxy users into SaaS apps like Salesforce.com instead of using login credentials. The XenMobile secure solution, WorxMail, offers a better than native user experience on the device, with features like the ability to join online meetings via GoToMeeting, Webex or Microsoft Lync, in one click, and automatic dial-in of the phone number and access code for audio conferences. WorxMail's integration with ShareFile also makes it simple for users to collaborate and share documents. Citrix recently previewed new workflow-driven mobile productivity apps including WorxNotes for secure note taking, WorxEdit for content editing on mobile devices and WorxDesktop for remote access to physical desktops. The new workflow-driven mobile productivity apps offer secure integrations between the apps that result in seamless workflows with simple and intuitive user experiences. For example, end users can join a meeting directly from their calendars, take notes, tag notes to a meeting and distribute them to all participants in a single workflow. Application Management: Citrix XenMobile makes it possible for enterprises to deploy native mobile, Windows, SaaS or web apps to mobile devices through Citrix Unified App Store. With the Worx App SDK and 60 different policies, enterprises can Worx-enable any mobile app in a matter of minutes either through app wrapping or embedding one line of code in the app. Citrix has partnered with ISVs to create a large, secure, enterprise-ready app ecosystem, the Citrix Worx App Gallery.

8 Content Management: XenMobile includes ShareFile, which is an enterprise level file sync and share solution. ShareFile provides "follow-me" data and desktop sync capabilities across mobile devices, PCs, and Macs, mobile content annotation and editing, support for shared folders, integrations with network file stores and Microsoft SharePoint as well as integration with WorxMail and Microsoft Outlook for secure and seamless attachment handling. Network Management: XenMobile application and data protection capabilities also extend to the network management layer. For example, Citrix can ensure that specific high security apps can't connect to the corporate network from an unsecure WiFi network in a coffee shop, or conversely that an app can only work when the device is connected to a specific secure WiFi SSID. Service Management: XenMobile includes integration with Citrix GoToAssist for enterprises to manage support and help desk calls and tickets. End users can be supported directly on their devices and can initiate support requests from the device with the ability to chat with help desk technicians via IM or by sharing device screens for certain types of devices. XenMobile provides extensive reporting capabilities and integrates with security information and event management (SIEM) solutions. For end-users, XenMobile provides simple self-service enrollment capabilities with auto discovery of the MDM server and provisioning of enterprise apps not just for smartphones and tablets, but also for PCs and Macs. Citrix XenMobile delivers role-based management, configuration, security and compliance for corporate and employee-owned devices. Users enroll their devices with a single agent on the device, and the same agent is used to provide all device and app management functions on the device. XenMobile is architected from the ground-up with security in mind and takes a layered approach with security at the device, data, app and network tiers. XenMobile's enhanced security capabilities secure data in motion and at rest on mobile devices with cross-platform FIPS compliance, including ios and Android devices and third party penetration testing. At the device level, XenMobile provides complete policy based management and control of mobile devices by supporting the MDM APIs provided by the mobile OS. XenMobile can geo-fence devices by defining a "safe" operating region for devices. It uses a combination of several device and app level mechanisms to detect jailbroken or rooted devices. XenMobile provides continuous compliance checks together with real-time integration with Active Directory so that IT can simply leverage the work done by helpdesk personnel in changing user/group permissions or removing users from Active Directory to automatically affect changes in the mobile device status and access. At the network tier, XenMobile enterprise mobility architecture has built-in capabilities to protect corporate LANs. Scenario based access controls and optimization provided by NetScaler Gateway protect the corporate network. Citrix offers both per user and per device licensing. The Citrix perpetual pricing for core MDM is $50 per device or $65 per user (for an unlimited number of devices per user). 7. Dell EMM Dell recently introduced its enterprise mobility management solution leveraging existing technologies, including Wyse and Kace, to create a secure workspace container that works with a number of endpoints. The container separates the corporate from personal apps and data, utilizing a self-service portal for end users. Dell EMM is a mobile enablement solution that securely manages endpoints and containers for corporate and bring your own devices. The integrated, end-to-end solution enables customers to manage smartphones, tablets, cloud clients, laptops and desktops. The solution is compatible with Windows, Mac OSX, Linux, ios, and Android and will soon include Windows Phone support. The solution also integrates with ActiveSync, Active Directory, LDAP and Microsoft Exchange. For full device management, it supports Microsoft Exchange with ActiveSync policies for ios and Android. 2. Capabilities and Key Features Dell EMM secures enterprise data, helps manage complexity and increases workforce productivity. It provides secure access to enterprise data with certificate based session security and tunneling for enterprise mail, apps, documents and web traffic. The solution utilizes inventory management and discovery, patch management, remote software distribution, IT security audit and enforcement, service desk management, power management, configuration and policy management, administrative/end-user alerts, and extensive dashboards and reporting capabilities. Dell's EMM solution also includes secure containers for smartphones, tablets and laptops.dell Mobile Workspace utilizes encrypted, DLP protected containers with built in secure remote access. Dell Mobile Workspace is an application download from the most popular application stores and enables IT policies from the SaaS based mobile management console. The business productivity applications in Dell Mobile Workspace includes mail, calendar, contacts, secure browser and file manager. Data in the workspace is protected at rest with AES 256 encryption without requiring policies to the user's personal device or data. Dell Mobile Workspace supports both online or offline operation. Dell's Desktop Workspace for PC and Mac is a type 2 hypervisor that runs locally on the personally-owned device enabling encryption, DLP, secure remote access and policy management. Policy controls can be set as desired to prohibit file transfers to media via drag/drop or copy/paste. The management console also controls encryption level, antivirus enablement, and data swap. The workspace separates enterprise apps and data from personal apps and data while protecting corporate IP and user privacy. Dell Desktop Workspace supports both online or offline operation. Dell EMM provides integrated, centralized management of all devices, applications and policies across the end user community from any device with an internet browser. You can focus on critical issues with real-time, exceptions-based alerts and empower users with extensive self-provisioning, management and reporting tools. You can define end user rights and permissions for self-service based on individual or group membership with a policy-driven self-service portal. IT administrators can manage asset inventory across the entire end user community including all devices and workspaces from a single pane of glass. Key features include: View current devices and register new devices. Reset passwords. Locate, lock and wipe devices.

9 View individual/group policies. Real-time reporting (inventory, asset location, groups/users and related policies). Receive granular events, contextually summarized events and policy compliance alerts. Obtain detailed audit trails for user and admin functions. Distribute applications per user group. To enhance productivity and user adoption on smartphones and tablets, Dell Mobile Workspace is easily downloaded from app stores as a single, secure corporate application with built-in productivity tools including corporate , calendar, contacts, secure browser and secure content folder. Similarly, Dell Desktop Workspace runs as an application on the end users' desktops providing a full corporate imaged environment. Both Dell Mobile Management and Dell Mobile Workspace enable IT to apply granular policies. With Mobile Management, IT has full control over the device, user settings, network access, and applications. Dell Mobile Workspace enables control over the container for PIN, password attempts, failed login action, inactivity logout, auto-kill check-in expiration, copy/paste enable/disable, and disallow or allow jail-broken or rooted devices. IT can allow or disallow jail-broken or rooted devices for a single user or for a group as a policy in both Dell Mobile Management and Dell Mobile Workspace. Additionally, Dell Mobile Workspace encapsulates corporate applications into an AES 256 encrypted container with secure remote access and data loss protection (DLP). Within Dell Desktop Workspace, granular policies by user, group or institution can be applied to manage upgrades, software, antivirus, secure remote access, encryption and password for the container. Additionally, IT can wipe the encrypted container in case of lost or stolen devices either by sending a signal from the Management Console or by setting a time bomb for offline operation. Dell EMM licenses are sold by annual contract. 8. Good Technology MDM Good Technology's enterprise mobility solution focuses on application and content management, taking a less invasive approach to EMM than other vendors. With the recent acquisition of BoxTone, Good's MDM capabilities also include mobile service management, which offers a 'single pane of glass' visibility and management for IT administrators. Good Technology's MDM solution supports ios, Android, Windows Mobile and Phone, supporting 3LM and BlackBerry OS via BoxTone. Additionally, common APIs (password policies, disable Wi-Fi) and extended Android security (wiping corporate apps, blacklist/whitelist based on app name or required permissions) are supported. Active Directory is used by Good for Enterprise (with integrated MDM) for device lifecycle management, by Good's MDM-only offering for device provisioning and lifecycle management, and for provisioning and lifecycle management of Good-secured apps (containerized apps built on the Good Dynamics Secure Mobility Platform). Good Mobile Service Management, part of the Good Dynamics Secure Mobility Platform, integrates with numerous technologies for monitoring and management; this includes Microsoft Exchange and BlackBerry Enterprise Servers. Using its integration with Exchange, Good Mobile Service Management can monitor all major third-party MDM products. It can also integrate with Microsoft System Center Operations Manager, HP Operations Manager and other monitoring frameworks. Good also supports Office 365 and integrates with Cisco Identity Services Engine (ISE). Good provides security and control at the device, app and data level, regardless of device ownership, supporting corporate liable, BYOD (bring your own device), and COPE (corporate owned, personally enabled) policies. Core to this is mobile app containerization, where Good has a number of issued and pending patents. "Good-secured" apps, built via an SDK or app wrapping, can be used on any device, even without MDM. App-level, device-independent, FIPS-validated encryption secures the data. The patent-pending Shared Services Framework keeps data (documents, photos, etc.) encrypted as it is shared between apps over native OS communication channels. So, even if the device is compromised, corporate data is never unprotected. A publish/subscribe model allows sharing of app services, which can be either app-based services or server-based services.

10 Metadata can also be used to share parameters when invoking an app service. For example, an app calling a print service provided by another app could share the document and parameters to ensure printing on A4 paper, a 0.5 inch margin, etc. Data shared between Good-secured apps and behind-the-firewall resources (e.g., an app server) is always secured with FIPS-validated encryption. The cloud-based Good Network Operation Center provides device and user authentication, ensuring device compliance prior to granting network access. The NOC enables behind-the-firewall access without opening inbound firewall ports, adding DMZ/VPN infrastructure or allowing direct connections between mobile devices and corporate resources. An alternative "Direct Connect" deployment choice uses a proxy in the DMZ, providing a direct app data path from the device to behind the firewall for complete control of the data path as well as enhanced performance. A consumer-like enterprise app store comes with IT controls and can be used to curate and distribute apps to employees as well as users not in corporate directory systems (i.e., business partners, contract employees, etc). Policies, available from a central management console, control authentication, enforce compliance and manage access to the data in Good-secured apps, including cut/copy/paste, share/"open In" restrictions and wipe/lock of app data. Self-service allows users to perform a limited set of tasks (e.g., view activated Good-secured apps, lock/wipe/unlock Good-secured apps, provision/delete/resend app activation keys) on their apps. Limited device management tasks can be performed without helpdesk assistance, including self-enroll devices, remotely reset the device password, remotely lock the device and perform a selective wipe of data. Single sign-on (SSO) aids usability; authentication into one Good-secured app provides access to all apps on the device. Kerberos Constrained Delegation (KCD) support extends access to behind-the-firewall resources via the same Good-secured login, without ever needing enterprise credentials on the device. App analytics detail total app inventory, including by OS, app growth rate, app origin, most popular apps, active users, users not using provisioned apps, and current and historical trends of

11 app usage. Drill-down reports provide additional app inventory and usage details. Mobile service management (MSM) capabilities provides a "single pane of glass" from which enterprises have real-time end-to-end visibility and can provide efficient support across a heterogeneous messaging environment. MSM enables operations teams to pinpoint system-wide issues, quickly look up a device, identify and resolve problems. All Good-secured apps can detect whether a device has been jailbroken/rooted. The app can then either be locked or its data wiped, depending on policy. Good's approach to enterprise mobility is non-invasive as MDM is not a requirement. Good-secured apps coexist alongside a user's personal apps. The enterprise controls corporate data and nothing else. Because apps can coexist, end users are not inconvenienced by transitioning between the different "personas" between app workspaces. Using containerization, Good can prevent data leakage from apps across all device platforms, ensuring sensitive corporate information does not leak via other apps installed on the device. Good offers a user-based subscription model starting at $5/user/month. Customers purchase bundled solutions that include all necessary server software and support at no extra charge. Good also offers a device-based pricing model. 9. IBM MaaS360 MDM IBM's MDM solution is seeing the biggest change in our quarterly update. The company acquired Fiberlink MaaS360 last year and has integrated the solution in its mobility management suite, offering an on-premises deployment option in addition to SaaS. IBM's MaaS360 was also ranked as a leader in enterprise mobility management in Gartner's latest magic quadrant. IBM MaaS360 supports all major operating systems across smartphones, tablets, laptops, and desktops, including ios, Android, Kindle Fire, Windows Phone, Mac OX, Windows (XP, 7, 8), and other legacy systems. integration includes Microsoft Exchange 2007, 2010, and Office 365 as well as IBM Notes Traveler. Content repository support includes SharePoint, NFS, Box, Google Drive, IBM Connections, and several others. MaaS360 also supports a secure container and browser across Android, ios, and Windows Phone. IBM MaaS360 provides full feature capabilities across the entire enterprise mobility management umbrella, including mobile device management, mobile application management, mobile content management, mobile expense management, and secure container options. With flexible options, policies in MaaS360 support all types of deployments ranging from bring your own device (BYOD) to corporate owned device environments. This includes special use cases in retail, healthcare, educations, and highly regulated industries. New in 2014, IBM MaaS60 on-premises deployment has been made available. This provides organizations the well-known MaaS360 SaaS platform in a 100 percent on-premises delivery option. The MaaS360 on-prem offering includes the complete set of features available in cloud-based MaaS360. Regardless of the delivery option chosen, IBM MaaS360 enables organizations to manage mobile devices from a single console and: Fully embrace BYOD programs. Support multiple mobile operating systems and devices, including laptops. Distribute and manage public and private apps. Enable secure content collaboration. Protect sensitive corporate data on mobile devices. Integrate with app development platforms. MaaS360's secure container is especially helpful for businesses that need stringent security policy and compliance controls, such as those in the highly regulated healthcare and financial services industries. The solution is also ideal for BYOD models, consultants and vendors that need to securely share content and collaborate without managing and controlling the actual devices. IBM MaaS360 ensures that organizations can deploy in BYOD models wile keeping privacy in mind. This is accomplished with MaaS360 privacy filters. These filters restrict the collection of personal identifiable information providing protection and privacy to end users. IBM MaaS360 is priced per device, per month or per user, per month with unlimited devices. Perpetual licensing is also available. 10. McAfee EMM McAfee EMM extends the company's workstation and server security controls to mobile devices, allowing IT to use the same platform and infrastructure to manage in-house and mobile devices from a single pane of glass. End users can take advantage of the self-service portal to provision and manage their own devices and receive alerts related to security or compliance issues. McAfee Enterprise Mobility Management supports ios, Android and Windows Phone mobile operating systems. Mobile devices are provisioned to the EMM system which supports Microsoft Exchange, Domino Traveler and ActiveSync users. The EMM Enterprise ActiveSync Proxy server provides compliance checks that enable the EMM administrator to establish restrictions and

12 other security policies. McAfee EMM is a mobile device management and security solution that allows IT to manage mobile devices using the same platform and infrastructure that is used to manage laptops, workstations and servers. EMM is managed by McAfee's epolicy Orchestrator (epo) security management software enabling organizations to have a single pane of glass to provision, establish policy, enforce restrictions and obtain real-time and historical reporting for mobile devices and traditional workstations, servers, and laptops. McAfee EMM supports managed open-in, VPN and Wi-Fi certificate distribution and management (PKI), and single sign-on (SSO) for the ios platform providing secure and easy network access for end users and separation of personal and corporate data. In addition, McAfee includes centrally managed anti-malware and app reputation, and an encrypted secure container and document viewer for Android, providing extra protection for Android devices. Mobile devices are managed and secured using McAfee epolicy Orchestrator similarly as an organization would manage and secure a Windows or Mac laptop or workstation. Administrators can control who can have a device provisioned and limit the number of devices a user can provision by using provisioning tokens. Administrators can establish compliance policies based on device, operating system, user, or group. Policies can be created for BYOD and corporate issued devices. Graphical reports can be generated manually or automatically showing compliance status, device inventory by model, OS, apps installed, check-in time, mobile threat events, the reputation of apps and more for situational awareness. The solution also includes customizable white and black listing for ios and Android platforms. Administrators can create any number of custom reports (for example, show me the devices that have the RSA SecureID app installed and those that do not), and make use of automation to alert administrators to security issues. Administrative functions (such as lock, unlock, wipe, selectively wipe corporate data, and reset password) can be delegated and end users can log into a self-service portal to remotely wipe their device. What's more, end users are alerted to compliance and security issues automatically eliminating the need to contact IT. End users download a free app from the Apple App Store or Google Play Store and are quickly provisioned based on their Active Directory (LDAP) or ActiveSync server credentials. All devices are checked for security issues, such as being jailbroken or rooted, prior to being accepted. End users can use the native , contacts and calendar applications on ios, Android, or Windows Phone devices or choose the Secure Container for Android which features FIPS-compliant encryption and a secure document viewer. Corporate data can be selectively wiped from ios or Android devices without interfering with personal data. McAfee EMM includes VirusScan Mobile Security (VMS) anti-malware software for Android devices which can be managed by epo. Threat events generated by mobile malware are reported to epo's central dashboard. The EMM also leverages McAfee's Global Threat Intelligence to deliver trust-based reputation scores of the applications users have installed on their machines. The combination of device state, the presence of VMS and app reputation allows the administrator to ensure that mobile devices connecting to the enterprise have appropriate security.

13 McAfree EMM is available separately or as part of endpoint security bundles. Customers pay for a license based on the number of devices and then a smaller percentage annually for technical support and software updates. 11. Microsoft Enterprise Mobility Suite (EMS) Microsoft's recently announced Enterprise Mobility Suite leverages the company's existing technologies to enable the management of different device types from a "unified environment." By combining the cloud-based management of Windows Intune with the on-premises management of SCCM 2012 R2, organizations can manage devices from a single infrastructure and console. Microsoft's Enterprise Mobility Suite (EMS) comprises the on-premises management capabilities of System Center Configuration Manager integrated with the cloud-based capabilities of Windows Intune, Azure Active Directory for identity and access and Azure Rights Management Services for data protection. This unified solution enables simplified management of Windows, Windows RT, Windows Phone 8, Apple ios, and Android devices. For Windows 8.1 and Windows RT, as well as Windows Phone 8, Microsoft supports the native management APIs, based on the OMA-DM standard, built into each operating system. For Apple devices, Microsoft supports the ios native management APIs. For Android 4.x and higher, Microsoft has built an OMA-DM API set into the Windows Intune Company Portal app. The integration of on-premises Windows Server Active Directory and the cloud-based Windows Azure Active Directory provides users with a single identity across all locations. Microsoft's EMS offers the ability to manage all devices (PCs and mobile devices) from one unified environment. This solution provides a unified environment for organizations to view and manage all the devices accessing corporate resources, including Windows PCs, tablets and servers, Windows Embedded devices, Macs, ios and Android smartphones and tablets, and Unix/Linux servers. Specific benefits of this solution include: A Company Portal that enables users to install applications on their devices, as well as view and remove their managed devices and set up synchronization of their work data, providing a consistent experience in discovering and installing corporate applications across all managed devices. Support for the deployment of certificates, VPN, and Wi-Fi Profiles which enables people to easily access internal resources without having to call the help desk because IT has preconfigured VPN or Wi-Fi connectivity on their devices. Unified Management Infrastructure that integrates the Windows Intune web service into the Configuration Manager administrative console and infrastructure. Microsoft's most recent updates to Windows Intune give organizations increased flexibility to enable users to work on the devices of their choice: Android device management with support for the Samsung KNOX platform. Support for the upcoming update to Windows Phone. Remote to My PC from Android and ios devices.

14 Simplified deployment with Azure Active Directory. The ability for an administrator to configure profiles and remove that profile and related via a remote wipe if needed. Support for new data protection configuration settings in ios 7. The ability for admins to remotely lock the device if it is lost or stolen, and reset the password if the user forgets it. The option for organizations to choose to manage mobile devices completely through the Windows Intune cloud service without requiring the integration with System Center 2012 R2 Configuration Manager. The profile and data protection configuration settings are examples of the enhanced integration between Windows Intune and System Center 2012 R2 Configuration Manager. Upcoming Intune capabilities (available by the end of 2014) include: The first Intune-managed apps which will be Microsoft's Office apps for ios and Android, including Outlook Web App for ipad, Word, Excel, and PowerPoint. App wrapping tool which will enable customers to wrap a management policy run-time around existing ios and Android apps, then distribute it to their users via Windows Intune. Access to websites through a protected browser on ios and Android. Conditional access policy to help end users quickly access internal corporate resources with the appropriate security configurations, without having to call the help desk. These updates are designed to build manageability and data protection into the apps people use, and extend that capability for enterprises and other ISVs to build into their own apps. Microsoft's MDM solution allows for management of mobile devices and PCs in one place: Devices can be distinguished as either corporate or personally owned, and can be managed accordingly. Each device is typically associated with a user and therefore has applications installed based on user needs. Each device typically has a core set of policies set to keep it in compliance with organizational and/or legal requirements. Each device has a typical lifecycle within an organization, including deployment or discovery, application provisioning, and retirement. Microsoft's unified device management, which includes System Center 2012 R2 Configuration Manager and Windows Intune, allows for management of all types of devices, form factors, and platforms directly within a single infrastructure and console. Through this, administrators have a single view of all devices in use, which applications are installed on them, as well as the ability to define policy across all devices. Users can self-provision applications through a company portal that shows the applications they have permissions to install. Users can view, install, and run corporate applications across devices, including corporate-owned LOB applications, Web applications, and links to IT recommended apps available from public app stores (Windows Store, Windows Phone Store, Apple App Store and Google Play). Jailbreak and root detection enables IT to determine which devices are at-risk. IT can then choose to take appropriate action, including removing the devices from the management system or selectively wiping them. Windows Intune and SCCM can detect at-risk devices (jailbreak or root) and report back into the SCCM database for reporting or alerts. Admins can then take additional actions, such as removing the device from the system or doing a full or selective wipe. IT or the user can remotely wipe corporate apps while leaving personal data untouched, as well as initiate a full wipe (reset) of the device, removing everything. Windows Intune and SCCM use the native management APIs found in the OS (with the exception of Android, which has none) to avoid having to add an additional layer of technology onto the device which may affect performance or user experience. Microsoft's recently announced Enterprise Mobility Suite (EMS) includes Windows Intune (mobile device management), Azure AD Premium (identity & access), and Azure Rights Management Services (data protection). Through September 2014, EMS is priced at $4 per user per month; the standard pricing will then start at $6.50 per user per month. Several alternative purchase options are also available: A User Subscription License including Windows Intune cloud service, System Center Configuration Manager and Endpoint Protection in a single SKU is priced at $6 per user per month. Each license can manage up to five devices per user. A User Subscription License for Windows Intune is available as an add-on for existing System Center Configuration Manager and Endpoint Protection customers for $4 per user per month. Each license can manage up to five devices per user. 12. MobileIron EMM MobileIron's EMM, available as a cloud-based service or an on-premises platform, secures applications, content and devices regardless of the device type, providing a native end user experience. Leveraging MobileIron's APIs, organizations can integrate the platform with their existing IT infrastructure. MobileIron was also listed as a leader in Gartner's latest magic quadrant for enterprise mobility. MobileIron's primary operating system support is for Android, ios, Mac OS and Windows Phone, with secondary focus on BlackBerry, Symbian, Windows Mobile (legacy) and Windows RT/Pro. The solution also supports Samsung SAFE and KNOX, ActiveSync, Active Directory/LDAP, Microsoft Exchange and Office 365. For a full list of technology partners visit mobileiron.com. MobileIron is a purpose-built mobile IT platform for enterprises to secure and manage mobile applications, content and devices while providing end users with device choice, privacy and a native user experience. The platform is architected so that IT can define policies protecting enterprise data in real time both on the device and as it moves between the devices and enterprise

15 systems. The platform enables application developers to secure their mobile apps in order to make them enterprise-ready. And organizations use MobileIron's APIs to integrate the platform with their existing IT infrastrucuture. MobileIron's mobile IT architecture is composed of three integrated and distributed software components: MobileIron Core integrates with backend enterprise IT platforms such as Active Directory and allows IT to set the policy and configurations of the mobile devices, applications, and content. MobileIron Client software is downloaded by end users onto their mobile devices, enforcing configuration and security policies set by the IT department. MobileIron Sentry is an in-line gateway that manages, encrypts and secures the traffic between the mobile device and back-end enterprise systems. Each component is distributed to accommodate corporate IT environments, but integrated into a single solution for a simplified management experience. MobileIron AppConnect allows application vendors and customers to build apps that can be secured and managed by MobileIron. Technology Alliance partners develop software integrations with their products and solutions by leveraging MobileIron's APIs. IT organizations utilize the APIs to integrate with their existing infrastructure, provide customized reporting and develop customized workflows to support their business processes. The MobileIron platform provides management of mobile apps, content, and devices, as described above. It also includes several client-side products: Apps@Work -- enterprise app storefront through which end users download both in-house developed and third-party business apps. IT is able to customize the app storefront experience by defining which applications are assigned to which users based on their role in the organization. Docs@Work -- provides end users with a secure content container on the device as well as secure access to back-end data repositories like SharePoint. Docs@Work also provides DLP for attachments because it can decrypt documents delivered through Sentry. Web@Work -- secure browser for accessing web applications within the corporate intranet without requiring end users to go through complex procedures such as starting a device-wide VPN session. Help@Work -- allows end users to request IT help directly from their ios devices. After the user grants IT access to the device, Help@Work mirrors the user's screen onto the IT management console so that IT can better help the user resolve the issue. Tunnel -- enables ios 7 mobile applications, including the Apple Safari browser, to access protected corporate data and content behind a firewall through a secure per-app VPN connection without requiring a device-wide traditional VPN solution. Tunnel uses MobileIron's advanced security capabilities to continuously monitor device security before access is granted to enterprise resources. MobileIron's policy engine allows customers to set policies to address security issues based the customer's risk assessment of various threats. For example, one customer may decide that if a user jailbreaks their device that will trigger an automatic wipe of corporate content, while a different customer might set a policy to send the user an alert that the device is out of compliance. MobileIron has several different classes of policies across hardware and data: Data security: password, encryption, OS integrity (jailbreak, root). App and doc container security: authentication, authorization, encryption, DLP controls, tunneling. Apps blacklist/whitelist: policies for allowed, disallowed, and required apps. Access control: for , apps, docs, web traffic. Privacy: enable/disable monitoring of usage, apps, location, etc. Lockdown: for many functions. Sync: controls for managing data traffic, especially when roaming. configuration and security policies. MobileIron recently introduced MobileIron Tunnel. Tunnel enables organizations to authorize specific business apps, including both internally built apps and App Store apps, to access corporate resources behind the firewall. MobileIron Tunnel extends the ability to secure data-in-motion to almost any App Store app that is managed by the enterprise. Additionally, the MobileIron's platform utilizes FIPS cryptographic modules, ideal for highly regulated industries. MobileIron base solution is $75 per device perpetual (plus 20 percent per year support/maintenance) or $4 per device per month (support included). Per user pricing is also available. 13. SAP Afaria MDM SAP Afaria is the mobile device management portion of SAP's Mobile Secure portfolio that offers device, application and content management both in an on-premises and cloud-based model. SAP Afaria was also the only challenger listed in Gartner's most recent magic quadrant for enterprise mobility. SAP Afaria mobile device management solution is part of the SAP Mobile Secure portfolio. SAP and Samsung have a strategic partnership to provide additional capabilities for Samsung Safe and KNOX. SAP Afaria integrates with Network Access Control (NAC) vendors including Cisco and Fiberlink (IBM), as well as solutions including Nitrodesk Touchdown. Supported devices include: ios: 4.x, 5.x, 6.x, 7.x (185 policies; this includes all the standard Apple policies and hardware information plus Afaria specific policies around remediation, whitelisting, blacklisting, application and enrollment.) Android: 2.x, 3.x, 4.x (30 policies on base OS, plus approximately 200 on Samsung SAFE and 120 on Samsung KNOX) Windows Mobile: 5.x, 6.x (150+ policies)

16 Windows Phone: 8.x (36 policies; this includes the policies and hardware information defined in the Microsoft Enterprise Device Management Protocol for Phone 8 plus Afaria specific policies around remediation, self-service and enrollment.) RIM OS: 5x, 6x, 7x (10 policies) Other: Windows CE, Windows 8, 7, Vista, XP, Server 2008, 2003 SAP Mobile Secure portfolio address the security needs of devices, apps and content. It approaches security from multiple angles and combines the different hardware, app, and content approaches that are now available. Managing mobility is about much more that managing devices, which is a key differentiator for SAP. SAP Afaria, part of the larger portfolio, provides lower level security through the architecture, including ensuring all confidential information stored on the device is encrypted, all data communications are validated and authorized including mutual certificate-based communications, and that device provisioning utilizes one time use enrollment codes with expiration dates to eliminate reuse by unauthorized users. From an app management perspective, Afaria can provision both internal and third-party apps to a broad range of mobile platforms while providing the flexibility to accommodate a broad range of provisioning use cases. Whether it is during the initial device configuration or at another time in the device's lifecycle, Afaria can automatically install, update and remove applications through dozens of policies or permissions to ensure the device is always up to date with the right applications. Through SAP's white-label enterprise application store interface on the mobile device, the platform provides the ability to allow end users to self-select applications to be provisioned to their devices. Although device management is the cornerstone of a complete enterprise mobility management strategy, additional mobile application security methods are becoming more prevalent, including approaches that move management and security into applications. SAP Afaria integrates with SAP Mobile App Protection by Mocana to accelerate app adoption with no coding or security expertise and eliminate security bottlenecks for unmanaged and managed devices. Apps can be wrapped and distributed via Afaria. SAP Afaria also integrates with SAP Mobile Documents, SAP's mobile content management solution that equips users with secure mobile access to both personal business documents and corporate content via an intuitive mobile app. In addition, SAP partners with Network Access Control (NAC) vendors including Forescout and Cisco whose network security products interoperate with SAP Afaria to help companies accelerate the provisioning, administration and security of both corporate and personal mobile devices, apps and data. SAP Afaria includes an end user self-service portal that ensures an intuitive device enrollment process while providing a secure user experience via AD/LDAP for user authentication. Utilizing Afaria's custom-signed client that is not distributed through the App Store, the platform can test for ios jailbreak symptoms that are outside of the Afaria client application space. This allows SAP customers to have deeper jailbreak protection and demonstrates innovation beyond simply exercising the APIs provided by Apple. For the Android platform, Afaria's root detection is built into the main line Google Play client. Google does not impose some of the same restrictions that Apple does, so SAP is able to provide this functionality in the main client. The Afaria engineering team treats root detection like the antivirus world where new attacks are tested on a regular basis. SAP partners with Samsung to offer a solution for dual persona on Android. Afaria can manage the Samsung KNOX container, securing the enterprise side of the device. The overall Mobile Secure portfolio is available both on-premises and in the cloud. List pricing for the cloud offering is 7 Euros per device per month for mobile device management, mobile content management and mobile app security combined. Products are available separately as well both in the cloud and on-premises, with on-premises pricing being per user rather than per device. The SAP Mobile Secure portfolio was launched in May The solutions that make up the portfolio are currently available at the Apple App Store and Google Play and are often distributed directly to employees via a company's internal corporate app store. 14. SOTI MobiControl MDM SOTI's MobiControl offers deep cross-platform support and both cloud and on-premises deployment options. The solution's biggest differentiator is its tight integration with Android OEM partners which addresses Android fragmentation. SOTI was also noted as a visionary in Gartner's latest enterprise mobility magic quadrant. SOTI MobiControl supports the following operating systems: ios: 4.2 and above Mac OS X: 10.7 and above Android: 2.3 and above Windows Mobile: All versions Windows Phone: 8 (Windows Phone 8.1 support planned) Windows CE: All versions Windows PC: XP and above (including Windows 8) SOTI supports vendor APIs created by Samsung (SAFE and KNOX), LG, HTC, Kyocera, Panasonic, Motorola, Intermec, Honeywell, Amazon and Lenovo devices. On Windows Mobile and CE, SOTI MobiControl integrates with more than 50 vendor SDKs to allow persistence, hard reset capability, etc. In addition to vendor APIs, SOTI MobiControl utilizes its own API stack, referred to as MobiControl Android+ Technology, on the Android platform, which enables capabilities such as remote control, silent installation of applications, advanced location services, a robust scripting engine and device lockdown. SOTI MobiControl integrates with Exchange, Office 365 and Active Directory services.

17 SOTI MobiControl provides a scalable and flexible client-server based management architecture with flexible deployment scenarios, where the MobiControl server can be augmented on-thefly to provide additional capabilities on the device via an agent. MobiControl accomplishes this using an advanced scripting and rules engine within the SOTI MobiControl device management agent that can receive customized instructions that handle the nuances of devices from different OEMs. The net result is that customers do not need to be locked into devices from a single OEM, nor do they have to be concerned about pushing out large (and possibly untested) software updates to devices. SOTI differentiates its platform by offering a unified solution for end-to-end mobility management across form factors, operating systems and deployment types (BYOD, corporate-liable, rugged, and dedicated-purpose). SOTI's other differentiators include: Addresses Android fragmentation with MobiControl's Android+ Technology which is tightly integrated with over 36 Android OEM partners, extending enterprise-grade secure mobility management to a broad spectrum of Android devices. Offers flexible deployment architecture allowing for cloud, SaaS and on premises deployments. Ability to send custom scripts based on any device/application parameter. Ability to do fine-grained street-level and polygon-shaped geofencing. Ability to enable distracted driver controls (i.e. speed lockdown of device when travelling over a certain speed). Customizable Kiosk Mode that allows organizations to customize workflow, images, content on homescreen, and access to apps and settings. Remote control, helpdesk and diagnostics. Enhanced reporting and visibility tools. Ability to replace default passcode screen for Win CE/Mobile devices to allow for login using LDAP credentials instead of being limited to using a passcode. Ability to do rapid provisioning of large number devices via barcode scanning. Ability to tag devices with custom attributes. Ability to collect custom data on the device. SOTI's integrated mobile device application management enables admins to comprehensively distribute, update, manage and secure applications on shared, personal and/or corporate owned mobile devices. SOTI's centralized console effectively delivers complete lifecycle management of the entire application environment including application usage statistics. SOTI's mobile content management is a secure content library for distributing and managing access to up-to-date corporate resources from mobile devices. Supporting multiple document formats, files can be pushed as one-to-one, one-to-many or one-to-all. Some of the options include setting priority levels, specifying time durations for document availability, staggering release by geo-location, enabling automatic or on-demand downloads and more. SOTI's solution provides an effective toolkit of advanced features to manage access to corporate resources, configure lockdown/kiosk mode, detect jailbroken/rooted devices and more. SOTI integrates with network access controllers, such as Aruba, to be able to control network access for devices based on device compliance, such as jailbreak detection or lack of encryption or password. SOTI also works with companies in order to provide customized views or data that feeds into their data warehouse/business intelligence solutions. SOTI's self-service portal allows end users to locate their devices, reset their passcodes, wipe their devices if they are lost or stolen and shop for administration approved profiles. MobiControl has a long list of canned reports based on customer feedback from thousands of customers. Reports can be easily customized and scheduled for access to real time data and visibility into the companys deployment. SOTI MobiControl utilizes MS SQL DB which can be queried directly for any information captured by MobiControl if third party reporting tools are used. SOTI provides a highly scalable solution with built-in fault tolerance. Additional servers can be added in real-time without taking the system down. Alternatively, servers can be taken down independently for maintenance without affecting system performance. Load is automatically balanced among running servers. SOTI MobiControl has jailbreak/root detection built-in; the administrator has the flexibility to take any actions should the device report non compliant, including encrypt, selective wipe, enterprise wipe, block exchange and data access. MobiControl also has antivirus and malware detection. This in conjunction with ability to block side loading applications effectively minimizes security risks to Android devices. In order to maintain compliance with HIPA, CIPA and other government standards MobiControl allows administrators to configure category based blocking by utilizing a secure browser solution. Most enterprises benefit from blocking phishing and malware sites which educational deployments benefit from effective adult content filtering. MobiControl also integrates with third party technologies such as, Samsung KNOX to provide containerization, security and management of corporate data. SOTI MobiControl has very flexible security policies that allow for light management of BYOD devices, and heavier management of dedicated purpose devices via an installed agent. SOTI provides both on-premises and cloud based per-device and per-user pricing. On-premises pricing consists of a perpetual license (lifetime license) plus yearly maintenance. Cloud based pricing is charged on a per device, per month basis. Licensing is also available on a per user basis. 15. Symantec Mobile Management Symantec's App Center, part of the company's Mobile Management Suite (MMS), offers device, app and content management. The solution utilizes a unique approach to app wrapping and with policy controls that can be used on a per-app basis. Along with two other vendors, Symantec was named a visionary in Gartner's recent enterprise mobility magic quadrant. Symantec App Center provides integrated management and protection of devices, apps, content and mobile security/threat protection. It supports ios and Android, allowing users to choose the device they want while letting IT secure corporate apps and data on the device. App Center integrates with enterprise systems including (Exchange, Office 365, others), authentication services (Microsoft Active Directory/LDAP, SAML Kerberos), certificates and PKI services (Symantec MPKI), and Cisco ISE. In addition, App Center provides integration APIs that allow for more integration with existing IT infrastructure and systems.

18 Symantec's mobility solution goes beyond device management and includes an enterprise app store, app and data protection policies, mobile threat protection, mobile network control, user and app authentication (Symantec MPKI and VIP), federated identity and SSO, secure , secure browser, and mobile collaboration and productivity apps (Symantec Sealed Program). App Center protects corporate apps and data are protected using a technology that wraps a layer of security and policy management around mobile apps, without developer resources or source code changes. This technology provides granular data protection policy controls that can be applied on a per-app basis. Policies include user authentication, document sharing, copy/paste restrictions, offline access, controlling local data storage and encryption, secure app connectivity and SSL connection certificate management, and more. A secure app proxy protects data in transit with per-app SSL, FIPS tunnels, without requiring device-level VPN or firewall modifications. App Center enables self-service distribution of apps and content to end users, whoc can view only the apps they are authorized to use based on their roles. Apps can be revoked quickly and securely when employees leave the organization or devices are no longer active, with or without managing the mobile device. App Center also integrates market leading mobile security that protects Android devices from malware, greyware, privacy risks, performance risks and other malicious threats. App Center simplifies mobile management with a single, integrated web-based console that allows IT to centrally manage devices, apps, content and mobile security. App Management: Symantec App Center makes it easy for enterprises to deploy apps to mobile devices through an enterprise app store. Enterprises can wrap apps in a matter of minutes, without any code changes or developer resources.symantec has partnered with ISVs to create a relevant, trusted, enterprise-ready app ecosystem -- Symantec Sealed Marketplace. Content Management: App Center provides a simple way to distribute content to end-user mobile devices. IT can distribute documents and multimedia content in different file formats and apply appropriate file-level security policies. Network Management: App Center controls access to corporate resources via a secure app proxy and a secure proxy. The secure app proxy protects data in transit with per-app SSL, FIPS tunnels, separating corporate and personal traffic and simplifying compliance by controlling app communication without requiring a device-level VPN or firewall modifications. App Center can also enforce a secure SSL connection for wrapped apps and block the apps from going to unauthorized or malicious websites. Mobile Security Management: With App Center, IT can centrally manage and distribute mobile security to Android devices. Administrators can set threat compliance requirements and remediation actions; they can also get a snapshot of threats detected. For managed devices, Symantec's MDM capabilities enable admins to enforce device-level policies. Administrators can have visibility into the applications and content that are downloaded and accessed on these managed devices. For the unmanaged devices where user privacy is extremely critical (e.g. BYOD), Symantec's MAM capabilities provide application (and content) level policies to secure only the apps and the content that matter to the organization. Admins do not have visibility into the apps or content on the device, apart from the managed apps/data distributed via an Enterprise App Store. App Center integrates leading-edge mobile threat protection that defends both users and the enterprise against malware, greyware, privacy risks, performance risks, fraudulent websites and other digital threats. Powered by Norton Mobile Insight, a dynamic intelligence system that analyzes more than 30,000 apps each day and 200 app stores worldwide, including Google Play, Symantec's mobile threat protection applies real-world information on actual behaviors to protect privacy, detect malware, and mitigate performance risks such as battery drain. Mobile threat protection is centrally managed through the App Center console where administrators can set threat compliance requirements and remediation. App Center provides separation of personal and corporate data on devices, allowing IT to enforce policies at an app level without infringing on user privacy or impacting the native user experience. Business and personal apps coexist; end users do not need to switch back and forth between a "business" and a "personal" persona on the same device. App Center provides a flexible way of administering device and app-level policies to the relevant groups of users in an organization. App Center also has the ability to revoke individual apps or content should this be required, or wipe all enterprise apps and data whilst leaving personal data alone. Symantec App Center is priced on a per user per year model. Discounts are available based on volume or buying program. Hot Topics Follow Tom s IT Pro Cloud Computing Management Security Servers Softw are Storage Virtualization About Tom's IT Pro Advertising About Us Contact Privacy Press releases Tom's IT Pro is part of Bestofmedia Netw ork - Copyright 2014 Bestofmedia All Rights Reserved.