additional inf

Give ALL the People What They Want

(Safely) Data-Centric BYOD Can Satisfy

Both Employees and IT

A Good TechnologyTM Whitepaper

Give the People What They Want | good.com 2 A Good Technology TM Whitepaper

Contents

Introduction

Anarchy: Free-wheeling Employees

Dictatorship: Device Lockdown

A War With No Winners

Freedom: Data-centric security

Conclusion

About Good TechnologyTM

3

4

5

5

6

7

7

Give the People What They Want | good.com 3 A Good Technology TM Whitepaper

Introduction

Face it. Modern workers are addicted to mobile devices. Not just any vanilla corporate-issued devices, but our carefully selected and personalized expressions of ourselves: iPads®, iPhones®, Androids™, and whatev- er-comes-next. Many of us get to use our devices in the office: 6 out of 10 businesses have welcomed the savings, satisfaction, and simplicity of BYOD programs enabling corporate application and network access from employee-owned devices. Another 32% plan to move to BYOD soon.1

In supporting employee devices, companies tend to exert either very little control, or a stifling amount of con- trol. The approach taken depends on which community has the upper hand: the employees or IT.

“More than half of US information

workers pay for their smartphones

and monthly plans, and three-quarters

pick the smartphone they want rather

than accept IT’s choice.”

—Forrester Research

Give the People What They Want | good.com 4 A Good Technology TM Whitepaper

Anarchy: Free-Wheeling Employees

When the employees who shell out many hundreds of dollars for the latest iPad or Android and its monthly bill are winning, they get their choice of devices. The company has a “Seize the savings! Skip the security!” motto. IT may use Microsoft® Exchange® ActiveSync® to enable password-protected access to Microsoft Outlook® and Exchange, and then the devices are free to access corporate email, calendars, and address books.

No one looks closely at the confidential data that migrates to these devices. No one can. IT has no visibility into what corporate data is where. Employees can forward email to personal accounts, use free accounts on Dropbox™ to transfer around content and store it in the cloud, and upload sensitive corporate documents or even corporate contacts to cloud-based apps. Each device has different capabilities for data storage and wildly different capabilities for data protection, and no single security policy works across them.

For example, without encryption, the company has no safe haven or recourse if an employee loses a device containing sensitive or regulated data. Malicious apps downloaded to these devices have easy access to corporate data and networks, especially if a user jailbreaks a device, disabling native security functions.

Unlike traditional IT-controlled devices, employee-controlled devices mingle corporate and unknown content.

MDM Device OS

BlackBerry < 4 years ago

Device

E nterp

rise A

p p s

To lerate

d

P erso

nal A

p p s IT

MDM Device OS

Today’s iOS and Android

Device

E nterp

rise A

p p s

C o nsu

m er

A p p s

Controlled by Employee

MDM Device OS

BlackBerry < 4 years ago

Device E nterp

rise A

p p s

To lerate

d

P erso

nal A

p p s IT

MDM Device OS

Today’s iOS and Android

Device

E nterp

rise A

p p s

C o nsu

m er

A p p s

Controlled by Employee

Give the People What They Want | good.com 5 A Good Technology TM Whitepaper

Dictatorship: Device Lockdown

When IT is in control, companies may provide the devices (the BlackBerry® strategy circa 2000-2008) or dictate the device, its OS, and the way it may be used. Mobile device management (MDM) tools offer coarse- grained control: they can require passwords, block jailbroken devices, disable features, or blacklist a broader selection of devices. They can also activate application access, disable app installation, limit configuration complexity, and, in some cases, perform remote wipe of lost devices. Most companies provide email and application access and permit use of productivity apps like Dropbox.

However, MDM tools are entirely device-centric, not data-centric. They work to lock down the device and its apps and treat data stored on the device as a black box to be managed and wiped wholesale—removing personal data, music, photos, and contacts along with proprietary email, corporate apps, and files. In some cases, because the device is considered “company liable,” users may be restricted from adding consumer apps and personal content such as music and pictures. Although the user’s smartphone becomes a lot less “smart” and their personal data less private, the device is perceived to be more “safe.” The user’s carefully chosen new device becomes as vanilla as the one he or she traded in two years ago.

A War with No Winners

So far, there are few winners in this battle. Employees either have limited access to enterprise apps or give up privacy and the fun and flexible features that make these devices worth the cost. IT and security folks either experience the painful repercussions of allowing insecure systems on the network or spend their time dealing with workarounds for executive, line of business, and remote users. Often, in the face of employee outrage, IT dumbs down MDM controls like strong passwords or does not restrict any of the device features.

In practice, MDM blacklists and whitelists are frail controls that lose efficacy quickly. For example, an ap- proved, whitelisted app may be hijacked to contain malware. Or, if IT permits Facebook® or Dropbox, an employee can use any app that works with Facebook or Dropbox, including ones you may not want. Cloud- based services like these move confidential data into an outsider’s control.

The alternative, blacklisting all undesired, secondary, and malicious apps, is equally impractical. These black- lists are perennially out of date as apps are added to app stores by the thousands.

MDM controls depend on native capabilities, so policies and enforcement inevitably vary across device platforms. For instance, although Apple® is considered a secure platform, Apple only allows a few apps to run continuously. The policies you hope to enforce are inactive most of the time. To get around this limitation, some MDM vendors use location-based services to track the device so that the app remains active in the background. This implementation creates a painful side effect of privacy and compliance liability for the en- terprise. The MDM control is monitoring each employee’s private and personal activities, a potential violation of privacy regulations for which IT does not want to be responsible.

Even when IT wins, the company loses. In a February 2012 Ponemon Institute survey of mobile device risks, “Fifty-nine percent of respondents report that employees circumvent or disengage security features such as passwords and key locks.”2 If a weak password is active, hackers can crack 4-digit passwords in seconds. Once inside, all data is available—both personal and corporate.

Give the People What They Want | good.com 6 A Good Technology TM Whitepaper

Each workaround, jailbreak, and weak password increases the risk of a data breach. These breaches can cost you dearly. The March 2012 Ponemon Cost of a Data Breach survey showed that data breaches from lost or stolen devices increase the per-record cost by $22.3

CXOs need to start guiding BYOD initiatives to establish a more secure, more enduring, data-centered foundation for mobile device usage. You can start by asking a fundamental question: why does it have to be a choice between employee satisfaction and IT policy? Why can’t there be a win-win: a way for both employ- ees and IT to get what they want?

Freedom: Data-centric Security

Through rapid advances in consumer devices and enterprise vendor technology, businesses now have attractive options besides employee anarchy and IT dictatorship. While MDM functionality—application access, policies, reporting—remain necessary, you can now also layer in nuanced and sophisticated data-centric security.

Data-centric security empowers employees with device choice, user friendliness, and privacy, while enabling IT with manageable policies and reliable control over sensitive data. It makes distinctions between data types—personal and corporate—and rigorously secures the confidential corporate data without nosing about in private information.

In this approach, apps and data can be partitioned, or apps can operate around the data. Sensitive apps and data can be firewalled off from other content in an encrypted container. As personal apps and data come and go, employees make full use of their devices but keep sensitive data separate and safe. If an employee downloads a cool new game app that carries a payload of data-stealing malware, the malware cannot access the data inside the container. Confidential data associated with an internally developed app inside the container isn’t accessible to a personal app outside the container. Files can’t be copied from corporate email to personal inboxes, for example.

Most IT teams are moving to a data-centric model for other aspects of enterprise infrastructure—data loss prevention, data centers, database monitoring. Adopting data-centric security on the device allows enterprise data management policies to be extended to mobile devices and assigned based on users, devices, and roles. Mobile devices become a logical and manageable extension of the infrastructure, not an unwelcome and unmitigated hazard.

Data-centric security offers a middle ground where both employee and IT needs and preferences are satisfied.

Unrestricted Employee Devices

Data-Centric: Secure Data on Secure Devices

Device-Centric: MDM Programs

Give the People What They Want | good.com 7 A Good Technology TM Whitepaper

With confidence in the security and compliance of smartphones and tablets, enterprises can also move forward to adoption of in-house developed mobile apps and approved and certified third-party apps. As tablets replace laptops, and smartphones replace wired lines and fixed function devices, mobile apps now represent a core productivity tool of the modern workforce: in the field, the factory, and the corner office.

Conclusion

Give the people what they want. Instead of trading off employee preference and privacy against IT policies and priorities, enterprises can use data-centric security to accommodate all requirements. Using this founda- tion, you can move beyond the basic cost savings of BYOD to advanced uses of mobile apps. Who knows? The next killer business app may be a mobile consumer app your employees install today, or a mobile app your team builds in-house. Either way, you win.

About the Good Secure Mobility Solution

Comprised of the Good Dynamics Secure Mobility Platform, the Good Collaboration Suite, and a rich eco- system of 3rd-party and custom mobile apps, the Good Secure Mobility Solution provides the market’s first comprehensive solution for secure enterprise-wide mobility, supporting users’ demands for robust and in- teroperable enterprise-grade mobile apps while giving IT the data security, service visibility, and infrastructure control needed to meet both regulatory requirements and service level agreements.

The Good Secure Mobility Solution provides the security and application services enterprise developers need to build transformative mobile apps run on the most extensive, integrated framework for protecting and managing apps, data, and devices, while enabling business productivity, collaboration, and workflow trans- formation.

About Good Technology

Good Technology is the innovation leader in secure mobility solutions enabling business to move freely. Good’s comprehensive solution consists of a secure mobility platform, a suite of collaboration applications, and a broad third-party application and partner ecosystem that unlocks your mobile potential. More than 5,000 organizations in 130 countries use Good Technology solutions, including FORTUNE 100™ leaders in commercial banking, insurance, healthcare, retail, government, and aerospace and defense. Learn more at www.good.com.

1 Source: Consumerization Drives Smartphone Proliferation”, Forrester Research, Inc., Ted Schadler with Matt Brown and Heather Martyn, December 2, 2011

2 http://www.websense.com/content/ponemon-institute-research-report-2012.aspx?cmpid=prnr2.29.12

3 http://www.symantec.com/content/en/us/about/media/pdfs/b-ponemon-2011-cost-of-data-breach-us.en-us.pdf?om_ext_cid=biz_socmed_twitter_ facebook_marketwire_linkedin_2012Mar_worldwide__CODB_US

Global Headquarters +1 408 212 7500 (main) +1 866 7 BE GOOD (sales)

Asia/Pacific Headquarters +1 300 BE GOOD

EMEA Headquarters +44 (0) 20 7845 5300

©2013 Good Technology Corporation and its related entities. All use is subject to license terms posted at www.good.com/legal. All rights reserved. GOOD, GOOD TECHNOLOGY, the GOOD logo, GOOD FOR ENTERPRISE, GOOD FOR GOVERNMENT, GOOD FOR YOU, GOOD DYNAMICS, SECURED BY GOOD, GOOD MOBILE MANAGER, GOOD CONNECT, GOOD SHARE, GOOD VAULT and GOOD DYNAMICS APPKINETICS are trademarks of Good Technology Corporation and its related entities. All third-party trademarks, trade names, or service marks may be claimed as the property of their respective owners. Good’s technology and products are protected by issued and pending U.S. and foreign patents.

iPad and iPhone are trademarks of Apple Inc., registered in the U.S. and other countries. Android is a trademark of Google Inc. Use of this trademark is subject to Google Permissions.

good.com