Practical IT Research that Drives Measurable Results Manage the Invasion of Consumer Technology

Introduction IT is often wary of connecting personal mobile devices to the corporate network. While not without its risks, the benefits usually outweigh the minimal costs. Learn to efficiently and safely manage the influx of consumer technology. This solution set provides practical steps to take when considering or implementing an official stance on the use of consumer technology in the workplace. It will help readers understand that: Like it or not, consumer technology is invading the enterprise. Recent increases in the prevalence and variety of smart mobile devices make them an unavoidable issue to consider. Allowing personal devices in the workplace boosts productivity and end-user satisfaction. The majority of organizations are allowing them and having great success doing so. There are several different mobile platforms. Each has its own nuances. Understand them and simplify the management of a personal mobile fleet. It is not risk-free. Learn about the technologies that can help mitigate potential damage. Safely merging the consumer and the enterprise begins with compliance. Draft a policy and hold training sessions to help employees deal properly with incidents and keep them from happening in the first place. If you can’t beat them, join them. It is safer to facilitate connecting personal mobile devices to the corporate network than have end-users connect without IT’s oversight.

Executive Summary The last two years have seen a marked increase in end-user comfort with smart phones, resulting in a greater number of employees bringing in personal technology to aid with performing their job functions. 83% of organizations surveyed by Info-Tech allow personal mobile devices on their corporate networks, though most do so only after an employee has signed a policy highlighting the rights of IT and the end-user regarding data on the device. Regardless of whether users are bringing in tablets or smart phones, the majority of IT’s job on the management side remains the same. Focus on policy creation, management and enforcement. Determine what level of mobile security your organization requires – Minimum, Basic, Enhanced or Lockdown – and implement policies and technology checks and balances accordingly. Remote wipe and over-the-air encryption are the most common security functionalities put in place by organizations at all levels of the security spectrum to mitigate the threat of sensitive data leakage. Understand that all mobile platforms are not created equal; each has its strengths and weaknesses. BlackBerry is the most popular personal device on the corporate network due to embedded infrastructure and advanced out-of-the-box security functionality. Finally, securing end-user compliance with internal mobile policy is the largest contributor to successfully managing a fleet of personal mobile devices on the corporate network.

Strategize 3 Understand 1 Implement 4 Evaluate 2 Allow personal mobile technology in the enterprise to boost productivity and end-user satisfaction. Don’t dismiss personal mobile devices without consideration; there are benefits to be had by allowing end users to connect their personal mobile devices to the corporate network. Think nobody’s doing it? 83% of your peers are allowing personal mobile devices on the network. Determine what level of mobile security is best for your organization.

Do Not Allow Personal Devices Allow Personal Devices 17% 83% Support consumer technology & an increasingly tech-savvy workforce to improve productivity BlackBerry, Apple iOS, Android, and Windows Mobile make up the majority of allowed personal devices on corporate networks. N = 144 *Respondents were asked to select all that apply, resulting in a cumulative total greater than 100%. 83% of organizations allow end users to connect personal mobile devices to the corporate network. New technology is often met with disdain from the IT group. Understand that new technology is brought into the workplace by end-users as a facilitator of job functions. Organizations that allowed devices other than BlackBerry, iOS, Android and Windows Mobile were drastically less successful than those that did not. Allow personal devices on the network, but stick to the major players to avoid being trapped in a mobile device jungle.

Embrace tech-savvy end-users; they are assets to the firm The onus of new technology introduction in the workplace has shifted from IT to the end-user. 80% of survey respondents cited end-user demand as the primary driver for allowing personal mobile devices on the network. IT The flow of new devices to the end-user was governed by IT. Users were not tech-savvy enough to take advantage of personal technology in the workplace and limited themselves to what was provided to perform their job roles. Pre-2008 IT brings technology to the end-user Post-2008 IT End-users have become more demanding about technology. The flow of new technology into the workplace has shifted from a dedicated IT group to the user. Employees are now concerned with using the latest technology to perform their jobs more efficiently, and demand that IT keeps up. End-users bring technology to IT

Don’t get mired in definitions; manage any mobile device that connects to the corporate network Smart phones make up the majority of mobile devices connecting to the corporate network, but some users may push for tablets and readers. Don’t panic. The variance in devices does not matter if you have the right management strategy in place. Tablets and smart phones access the corporate network in very similar ways. Between iPhones and iPads, for example, there is no difference in the mobile management policies needed. Tablets Smart phones Employees use these devices to... Check corporate Text message Instant messaging Connect to the Internet through corporate WiFi networks Maintain and reference corporate calendars

Don’t try to quantify innovation & productivity benefits, but understand that they are real There is no accurate way to quantify the innovation and productivity benefits for employees, but understand that with improved business connectivity, you can expect the following changes: Because end-users will… Check and respond to their more often after-hours. Experience quicker… Turn-around time on time-sensitive s. Third-party apps can be your friend. Android, BlackBerry and iOS all have independent app stores, which contain mobile applications, some of which are aimed at improving productivity (though some are productivity killers). Look into apps aimed at corporate productivity and connectivity for quick wins with employees. Apps designed to transfer SMS text messages over data networks as opposed to cellular networks, for example, allow users to send unlimited text messages. Most personal devices can also connect to virtual desktops. Be more aware of their availability. Meeting setup times. Generally be more in touch with the organization. Flow of information between internal and external parties.

Case Study: YMCA’s experience with cost reduction Industry: Non-Profit Segment: Small Enterprise Source: Information Technology Executive Pain Point Administering and paying for corporate devices was significantly driving up costs. The organization needed to find a way to maintain connectivity with employees, but remove the cost burden of maintaining corporate liable mobile devices. Solution Allowed senior employees to keep corporate-issued phones, but mandated that data and voice contracts were personally held. Junior employees were stripped of mobile devices and encouraged to bring in personal devices to connect to the network. Saved $48,000 a year in mobile contracts alone. Even if they were already given corporate devices, employees can be convinced to attach personal mobile devices to the network. If the cost of managing a corporate mobile device fleet is becoming a burden on IT, consider switching to a personal device setup. Gift formerly corporate devices to soften the blow of transferring the cost to employees. Insight We had a reduction in costs from no longer covering the monthly bills. We were spending about $4,000 a month in contracts and now we spend nothing. “ “ -IT Executive, YMCA

Embrace the Apple effect: the iPhone 3G exploded by being a multi-function communications & recreational device The introduction of Apple’s iPhone 3G in 2008 spurred a smart phone craze among recreational end-users, raising their comfort with technology. The iPhone 3G’s carrier- subsidized pricing opened the doors to smart phone adoption for the common man. With a subsidized price of $200 in 2008, 48% of iPhone 3G adopters were from households earning between $ and $ annually. The iPhone 3G was viewed as the first practical convergence device; it eliminated the need for multiple devices. The price tag of the iPhone and an accompanying plan were not feasible for lower-income markets – as a phone. But the value gained from eliminating the need to purchase multiple devices spurred adoption of the iPhone as an affordable does-it- all gadget. Source: comScore Smart phones, and the iPhone in particular, are appealing to a new demographic and satisfying demand for a single device for communication and entertainment, even as consumers weather the economy by cutting back on gadgets. “ “ - ComScore

Define your security needs based on the sensitivity of your data, and act accordingly to optimize device management The level of policy enforcement and security your organization requires is contingent upon regulatory compliance requirements and data sensitivity. MinimumBasicEnhancedLockdown Companies that do not provide employees with any sensitive data (e.g. trade secrets, fiscal information, and press releases) do not need to invest in infrastructure to increase device security. Creating end-user mobile device policies and conducting training for such organizations is often unnecessary. Companies that are concerned with employees carrying sensitive data in their corporate accounts must create a mobile device policy to enforce the right to remote wipe user devices and mandate password protection. End-user training on policy and compliance are also required. Enhanced security measures must be taken by organizations that have highly sensitive data in employee in-boxes and calendars. These organizations must develop a mobile device policy, conduct training, and consider limiting adoption to only devices with over-the- air encryption, such as BlackBerry. Lockdown is necessary for those organizations that must adhere to regulatory compliance and house potentially damaging business data on end-user devices. In general, these organizations should only be considering BlackBerry. Those that accept other devices must implement third-party management tools, policies, conduct training, and limit device adoption. Organizations with more employees had less success in allowing personal devices on their networks. Large organizations should be particularly stringent in mitigating the risks of incorporating consumer technology, and look towards Enhanced and Lockdown levels of mobile security.

Info-Tech Helps Professionals To: Sign up for free trial membership to get practical Solutions for your IT challenges “Info-Tech helps me to be proactive instead of reactive - a cardinal rule in stable and leading edge IT environment.” - ARCS Commercial Mortgage Co., LP