VDC Research: Enterprise & Government Mobility Market Blog

EMM Vendors not Doing Enough to Satisfy Mobile Security Requirements

Securing mobile deployments in a fragmented security landscape

VDC will be releasing its annual mobile security report next week, which takes an in-depth look at how enterprise mobility management (EMM) vendors have enhanced their mobile security capabilities and how ownership models like that of BYOD impact mobile security investments, as the line between personal computers and mobile devices is increasingly blurred. While the mobile hardware race is in full swing, so too is the battle among mobile ISVs, who are all vying to be the primary provider for an increasingly broad range of mobile solutions for today’s enterprise. An ever-growing mobile workforce carries with it an increasing amount of potentially vulnerable data ranging from emails and attachments, voicemail and private corporate data.  Vulnerabilities such as malware, direct attacks, data interception, exploitation, and social engineering all have transitioned into the mobile space as fluidly as the operating systems themselves. In addition to having a significant financial impact, such breaches can cost organizations in terms of lost time and productivity. As a result, infrastructure investments for mobile management and security are rapidly become a top priority for CIOs, CISOs and IT leaders.

There is no silver bullet

Traditional MDM vendors have expanded their functional range to include integrated end-to-end enterprise mobility management platforms, which incorporate key app, content and network management capabilities; although organizations are recognizing that more is needed to ensure that their devices are secure in a constantly evolving threat landscape. Given the nature of how work styles have changed, and increasing desire of employees to want/need to work at any time, from any location, with data that’s accessible from the company network, the Web, or the cloud, IT is faced with a moving target and requires a broad range of protective measures depending on their organization’s security posture. Given the multilayered security dynamics of mobile platforms, security cannot be assured by finding an ideal hardware configuration or relying on a single type of communications network to catch all threats. In a dynamic market, operating systems, applications, devices, and networks all have a significant impact on security.

Mobile-first ISVs with a strong security orientation that have entered the market are taking a decidedly different path. These vendors are using a combination of technologies and have taken differentiated approaches to securing mobile platforms. One clear difference is their focus on not limiting users to specific applications (what some call an “appnostic” approach) by providing the means to apply security policies to any application. This vendor class is also keen on promoting their vision of what containerization means. To these vendors, moving into a work persona is a form of containerization, or any app that is “badged” may also be considered as being containerized. Another key area of differentiation is the focus on data and applications rather than on devices themselves.

Enterprises are looking to boost EMM investments

Enterprises are looking to mitigate the risk of data breaches, but the solutions aren’t entirely satisfying enterprise requirements. According to a recent VDC survey, nearly 50% of the respondents to a survey recently fielded by VDC indicate that they were not completely satisfied with the level of security they were being provided by their mobile device management vendor partner.

VDC expects that continued investment in device management solutions will drive adoption of mobile security-related products, as enterprises deploy advanced solutions to track, monitor and authorize corporate data access, as an increasing number of their employees bring their devices into the workplace. For this reason, we believe that mobile security vendors can expect to see continued investments in their solutions due to their ability to secure heterogeneous mobile deployment environments and help to prevent against data loss from lost, stolen, compromised, or decommissioned devices.

(with Eric Klein, Senior Analyst)

Android is Enterprise Viable

Android’s perception problem is largely due to well-documented flaws in OS releases prior to v4.0, which have been plagued with malware. The good news is that many of the exploits are limited to older versions of the operating system. The bad news is that more than 50% of the Android devices in use are on versions prior to v4.0 and, according to Google, 44% of Android users are still on Gingerbread (v2.3.3 - 2.3.7; many of these devices were released two years ago). This platform fragmentation will persist as a problem, as handset OEMs continue to sell pre-v4.0 devices. Additionally, many users can’t upgrade to the latest OS release because the process is tightly controlled by their carriers, which have been slow and inconsistent (at best) in updating devices on their networks.

Improved Security Mechanisms

While the BYOD trend has opened new opportunities for businesses, it has also introduced new risks. The continued uplift in Android market share not only has more consumers bringing these devices into the workplace, but has IT organizations increasingly open to supporting the devices due to the important incremental security enhancements Google has made since the initial release of Android in 2008. The most recent Jellybean Android firmware incorporated several critical security enhancements such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP). ASLR is a defensive technique that has long been a security mechanism for desktop and server operating systems; DEP imprints important structures that reside in memory as non-executable. These exploit-mitigation elements are common features in desktop Linux distributions, and are critical to the Android platform. They harden and protect it from exploits such leakage of kernel addresses that lead to privilege escalations and expose devices to privacy and security risks. Similar to malware problems that plagued earlier versions of Windows, pre-v4.0 Android releases are vulnerable due to the platforms’ openness. Not to mention, that the "bouncer" feature that Google added to their Google Play app store security mechanisms seems to have also helped with "bad apps".

While improvements have been made, Google has much further to go. The commitment from handset OEMs like Samsung and HTC has helped raise the bar for Android, as these vendors are partnering effectively and integrating IT-friendly security mechanisms into their devices. However, additional precautions and considerations should be taken into account for mission-critical deployments in corporate environments - vendors such as Motorola Solutions recognize this and have raised the bar with their Assured Mobile Environment (AME) solution. The platform battle looks like it will be continuing for the forseeble future (be sure to check out my next post on tnis topic).

Will AT&T's Attention to Mobile Developers Pay Dividends?

AT&T held the 8th iteration of its developer summit this past January in Las Vegas. The event kicked off with the company’s first “hackathon” of 2013 (AT&T held 28 of these in 2012) and offered attendees a full day of mobile-oriented sessions, ranging from technical deep dives to go-to-market strategies for enterprise-oriented developers. This was my second year attending this event, and I came away with a very positive impression of AT&T’s commitment to fostering its community of developers. It is clear that the company is raising the profile of the event. Not only was the attendance up from 2012 (with ~2,700 developers on hand, this was the largest event to date), but AT&T has also added executive presence to the event. Ralph de la Vega, the President and CEO of AT&T Mobility, typically keynotes this event; however, this year he was joined by other key executives, including the company’s CTO and CMO. AT&T also landed Cisco’s Chairman and CEO John Chambers as a keynote speaker and “rock stars” in developer circles like Christian Heilmann from Mozilla to lead breakout sessions. Scheduling the event ahead of CES was a smart move, as it gave the event a good representation of both the media and analyst communities (as well as a critical mass of mobile-oriented developers).

Click here to read this entire research note.

Going to MWC? Let's Meet

Please contact us to schedule a meeting at the Mobile World Congress event in Barcelona from Monday February 25th through Wednesday February 27th. 

We are looking forward to largest mobile event of the year, and hope to connect with you to learn about your enterprise mobility solutions.

To set up a meeting:

Contact Eric Klein, Sr. Analyst, Enterprise Mobility & Connected Devices Practice, VDC Research Group.

 

Solving the BYOD Challenge Without Managing Devices

Join me on February 6th to learn about enterprise-grade mobility solutions for BYOD environments

As a long-time industry watcher you've likely seen many acronyms come and go (WAP, ASP, ISDN, etc.) ‒ BYOD is no exception, and will ultimately disappear from our vernacular as well. However, given that we are in the early days of mobile enablement, the trend is sure to impact the modern workplace for years to come, and will pose both an opportunity and a threat for CIOs and IT administrators who will ultimately be supporting an increasingly diverse roster of mobile devices.

While some might argue that the "genie is out of the bottle" and that we are well beyond the point controlling to usage of personally owned devices in the workplace, there very well may be potential for the pendulum swing back toward more centralized IT practices for managing mobile deployments if the ROI garnered from BYOD programs doesn’t materialize. Regardless, the issue will be top of mind this year and next for CIOs as they grapple with device diversity, billing, security, acceptable use policies and more as our mobile workforce continues to grow.

The BYOD trend has a broad range of market participants focused on solutions to capitalize on the opportunity that mobile enablement can bring while mitigating against the risks that comes with personally owned devices being introduced into corporate environments. While there are many viable options that have come to market, one solution category we see gaining traction is enterprise-grade "workspace" or "secure container" solutions that can improve the security and manageability of mobile platforms.

If your organization is grappling with BYOD and in the process of implementing a BYOD strategy, we would welcome your participation in this important upcoming webinar being sponsored by Globo PLC ‒ Solving the BYOD Challenge Without Managing Devices. We will be discussing how CIOs are dealing with the complexity that BYOD programs introduce, as well provide guidance on how your organization can alleviate the pressures associated with the mobile enablement of its growing mobile workforce. Globo will be demonstrating its enterprise-grade mobile solution that is flexible, scalable and designed with BYOD environments in mind.

 

2013 Predictions - Part 1

Mobile Developer Skills Gap a Growing Issue

There is a massive shortage issue and skills gaps when it comes to enterprise mobile developers. According to VDC's research, IT departments rate their mobile support capabilities lowest in comparison to other more traditional IT services. While mobile development is one of the faster growing job segments, most developers are drawn to more consumer and media oriented development work. Developing sophisticated enterprise mobile applications with stringent security and backend database integration requirements - and where more complex native development remains pervasive - has represented a less appealing career choice.

Although the trend towards HTML5/Javascript for enterprise mobile solutions is potentially expanding the developer pool to more traditional web developers, a skill set disparity remains. In the case of HTML5 for enterprise mobile applications, strong coding practices are required to address and overcome many of the limitations inherent with HTML5 - such as the asynchronous nature of HTML5/Javascript. This is going to represent a major issue for enterprise mobility in 2013 and possibly years to come.

Flipboard for the Enterprise:  Enterprise Mobile Applications as the Next Wave of Consumerization

As the past few years have seen a rapid influx of mobile devices into the enterprise space - led, of course, by Apple's iPhone and iPad - so too have we seen traditional consumer apps optimized to target the enterprise market, such as Dropbox, Yammer, Salesforce Desk, and Jobvite. And yet - not for lack of trying - the award-winning Flipboard app for social news aggregation has not encountered an enterprise-ready counterpart.

First launched in mid-2010, Flipboard has garnered a worldwide following, facilitating intuitive flip-through navigation of personalized social and news content. One of the more notorious Flipboard rivals targeting the enterprise is Moprise. The company's app - Coaxion - enables real-time collaboration and document access, both online and offline, via services such as SharePoint, Dropbox. Despite VC backing of over $500k and successful partnership with QuickOffice, Dropbox, SharePoint and others, the app has yet to take off in the enterprise market.

Mike McCue, co-founder of Flipboard, tweeted in May of 2012:  "How do I feel about all the Flipboard clones? I'd rather be competing with 1,000 copycats than 1,000 innovators." While the incredible success of Flipboard in consumer markets hints at a similar opportunity in the enterprise market, McCue is spot-on in highlighting the vast importance of true innovation and optimization in design of a "Flipboard for the enterprise" application. The challenge will be to maintain Flipboard's end user-centric appeal and presentation while integrating corporate news, content, or collaborative elements. VDC sees a sizeable market opportunity for a Flipboard-esque enterprise app and expects continued competition and innovation over the next year as organizations look to capitalize on Flipboard's key value propositions (content aggregation, personalization, attractive UI/UX, visual appeal, consistent cross-platform experience), while optimizing the content, collaboration, and sharing features to suit enterprise requirements.

Rugged Mobile Community will Struggle with Balance as Market Segment Matures

That the rugged mobile community experienced a correction in 2012 is an understatement. With the rugged handheld and data collection focused vendor landscape undergoing massive consolidation - with Motorola Solution's acquisition of PSION and Honeywell's pending acquisition of Intermec - and other solution providers such as GD-Itronix end of lifting much of their portfolio - the outlook is increasingly uncertain. While the need for rugged solutions in a variety of end use markets is clear, the growing maturity of the opportunity coupled with the increasing commoditization, diminishing differentiation (and innovation) among vendor solutions and continued vendor fragmentation are combining to drive continued vendor and product consolidation.

An additional challenge in 2013 for this community will be influenced by their strong ties to Windows OS platforms. While several vendors have experimented with Android solutions, traction in target markets has been limited. Moreover, the forthcoming changes to Windows Embedded Handheld and noted issues with backward compatibility with legacy applications is a well documented concern as is the viability of Windows 8 (Pro) for these vendors 2013 tablet initiatives.

Where we do expect to see innovative developments and opportunities for this community moving forward will be in the shift from legacy rugged handheld to rugged smartphone solutions especially around the integration of mission critical communications capabilities - such as support for Public Safety Band 14. In addition, we anticipate greater opportunities and focus around rugged tablet solutions - in part as a displacement for existing mounted rugged notebooks but similarly in support for new applications and workflows.

New Entrants to Drive Increasing Competition in Mobile Content Management

The past few years have seen the steady trickle of mobile devices into the enterprise evolve into a widespread wave of BYOD support. And yet, while enterprise support of BYOD devices may appease employees' desire to use their personal devices in the workplace, organizations are currently inhibited from capitalizing on the considerable potential mobile devices offer to transform the enterprise. VDC's 2012 survey of enterprise IT decision-makers revealed that just over 40% of organization allow employees to use productivity apps on their personal devices. Even fewer (~28%) empower employees with access to specialized line of business applications. And yet, organizations are increasingly recognizing the limitations of these restrictive policies, which counteract the core advantages of mobilization initiatives (enhanced productivity, real time decision-making, customer loyalty, sales.)

Partnering with Oracle to deliver solutions for Oracle Universal Content Management, Fishbowl Solutions represents an early player in the mobile ECM (enterprise content management) space. Deploying the company's Android or iOS applications, organizations are able to empower workers with mobile access to the ECM system, while ensuring security of corporate data and systems. Over the next year, we will see increasing competition in this space, as established content management vendors adapt current ECM solutions to meet the unique requirements inherent to mobile environments. Emphasis will shift from device management (MDM) to more sophisticated content management through digital rights management, encryption, authentication, data loss prevention, geo-fencing, context-management, and other technologies facilitating administration of users' access, storage, and synchronization of enterprise content.

Q1 FASTForward Published: A Classic Attack From Below — Gauging the Impact of Best-of-Breed Mobile Startups

 

Our FASTForward Reports are a new offering here at VDC — our Q1 Report entitled "A Classic Attack From Below — Gauging the Impact of Best-of-Breed Mobile Startups" has recently published.

Here's a quick summary:

Best of Breed Mobile Startups are Driving Enterprise Mobility Innovation

Legacy enterprise mobility solution providers are struggling to respond to the rapid change in mobile technology preferences, shifting business and technology sourcing models and enterprise investment drivers. As a result, significant gaps in their capabilities are beginning to emerge. Recognizing the opportunity created by these gaps, best-of-breed mobile startups are bringing disruptive innovation and technologies to the market that are quickly becoming commercially viable, and are also producing rapid ROI for customers. Key mobile segments that represent significant opportunity for innovation include enterprise  application development and management and mobile application security solutions.

The Mobile Arms Race has just Begun

Enterprise mobility as an IT discipline is still nascent. A key issue is that many solutions currently deployed are nonscalable point solutions buried in some business silo. However, as enterprises better understand the value and opportunity that mobility represents and take a more strategic approach to solution selection and sourcing, the impact on the vendor landscape will be significant. We expect consolidation to represent a key near term theme with mobile start-ups increasingly becoming strategic acquisition targets.

Development of Mobile Capabilities will Represent the Single Most Important Near-Term Initiative for ISVs.

Enterprise software vendors can ill afford to sit on the sidelines. Mobile capabilities are becoming a key selection driver among enterprise SW vendors’ customers and represent a potentially critical avenue for these vendors  to expand the footprint of their solutions into new markets.

The Report focuses on four acute issues or investment concerns — each relates to the necessary infrastructure or platforms required to design, deploy and support business-critical mobile solutions:

• Mobile Security Management
• Mobile Application Management
• Mobile Application Development
• Back End Enterprise Connectivity

We identified the following vendors within each of these segments - each is featured in the Vendor Spotlight section of the full Report.

• Apperian
• 3PMobile
• Bitzer Mobile
• InBay Technology Solutions
• Nukona
• Webalo

We consider these vendors to be potentially disruptive and uniquely positioned to address many of the gaps that continue to emerge in the mobile ecosystem. Several are early stage start-ups that have not yet secured funding and are just beginning to emerge from stealth mode, while others are more established.

You can download the executive brief here

The Enterprise Mobility Bundle

Over the past few years, several of the innovative solutions which have emerged from mobility-oriented ISVs have not only proven to be commercially viable, but have quickly become important and increasingly required components for a complete end-to-end enterprise-grade mobility solution. The growing variety and similarity of market leading mobility solutions are making vendor selection decisions less clear and have created the opportunity for channel constituents to offer a blend or bundle of services from best-of-breed mobile-oriented ISVs. An opportunity has also developed for established ISVs with mobile strategies to round out their product portfolios by developing their channels partnerships. The core components of an end-to-end mobility solution were initially somewhat narrow in scope - however, the advent of BYOD has created the need for a broad range of solution components that goes well beyond MDM. As smartphone and tablets gain acceptance as viable application platforms, IT personnel will require solutions that cover app development, security, remote access to corporate databases and applications, as well as a cost-effective way to manage mobile app provisioning, decommissioning and integration with existing business processes.

While carriers and systems integrators (SIs) have an opportunity to play a key role in the channel for a bundled package of core enterprise-grade mobility solutions, tier 1 players (e.g., AT&T, Verizon, Accenture, IBM, and HP) continue to demonstrate an inability to move quickly in establishing working channel relationships with mobile ISVs. This in turn is creating an opportunity for tier 2 and 3 SIs, as well as mobile-oriented value-added resellers with integration expertise in mobile software and solutions, (e.g., DecisionPoint, Stratix, and Vox Mobile) to partner with innovative mobile ISVs and offer differentiated and cutting edge mobility solutions to their customers.

M&A strategies will be increasingly important moving forward, as strategic acquisitions can enable a vendor to add core mobility capabilities to their product portfolios and get closer to providing and end-to-end solution to the market. For this reason, we think that additional M&A activity is likely in the coming months...

Tactical M&A - Imperative in the Enterprise Mobility Ecosystem

Many market watchers like myself have been predicting that consolidation was looming in the MDM space - with Symantec's acquisition of Odyssey Software, we finally have some validation. The MDM segment of the enterprise mobility ecosystem is definitely one of the more mature and crowded ones. Odyssey's tenure, sizeable customer base and well regarded solutions made it an attractive target for acquisition. Mobile specialists such as Odyssey are being watched and evaluated regularly by firms such as Symantec. In fact, the company announced last week that it had pulled the trigger on yet another deal - just 11 days after revealing it had acquired Odyssey, Symantec announced that it had acquired Nukona.

For Symantec, Odyssey + Nukona is only the beginning of its mobility push

With its acquistion of Nukona, a private, ~20 person firm with an elegant and powerful mobile application management solution, Symantec has demonstrated that it recognizes the importance of having a tactical M&A strategy. Nukona is a young company, and yet just 12 short months after emerging from stealth mode, several vendors were focusing on the company and had them on their radar - not for a large customer base, but for its IP and executive talent.

While Symantec is fairly active with its M&A strategy (the company has acquired ~20 companies in the last 5 years) Nukona and Odyssey are Symantec's first "pure-play" mobile acquisitions. This move signals that Symantec saw an opportunity to expand and diversify its mobile product solution portfolio. Indeed, these acquisitions deliver expanded mobile platform coverage (i.e., Android and Windows Phone 7), as well as the ability to offer its customers core enterprise-grade mobility solution components. I'm looking forward to the company's launch of its Secure App Center next month, and expect more innovation from the mobile team that is coming together.

Symantec Advances Enterprise Mobility Strategy

Symantec's acquisition of Odyssey Software is a clear signal that the firm is making enterprise mobility a key element of its corporate strategy, and that the lines between IT Security, risk and compliance requirements and mobile solutions are blurring.

The company's recent release strengthens its mobile solution range includes enhanced native capabilities for both Windows Phone 7, Android, as well as data loss prevention and managed PKI service integration. The company also announced O3, a cloud service that protects identity and access control, as well as information security and information management. O3 is console-agnostic, and features application and data/threat protection, as well as configuration management, and expense management functionality.

Acquisition Fallout?

Odyssey was very successful with its channel strategy, and was the OEM provider behind Symantec's Mobile Management (SMM). The company's notable partners include Motorola, Good Technology, AirWatch — Odyssey is an important Microsoft partner as well. Assuming there are no snags, the acquisition will likely be finalized sometime this spring — the aforementioned partners will need to make contingency plans as Symantec will not necessarily view Odyssey's current channel strategy as ideal for it's roadmap moving forward.

A shift from Symantec could have consequences — for example, Odyssey Software's flagship product (Athena) integrates completely with Microsoft's System Center Configuration Manager, and provides Microsoft with robust full-featured mobile device management capabilities. While Microsoft recently announced an update to its System Center product (Systems Center 2012), the company remains reliant on the Exchange Activesynch component — should Symantec adjust the way it partners, Microsoft and others will may need to look elsewhere for a 3rd party add-on that can tightly integrate. 

We'll be keeping an eye on the impact of this acquisition — additional consolidation as well as the continued blurring of the lines between MDM and security are likely moving forward.