Mobile Device Management:

(1)

Mobile Device Management:

Bringing Order to Enterprise Mobility Chaos

June 2009

(2)

Executive Summary

Research Benchmark Aberdeen’s Research Benchmarks provide an in-depth and comprehensive look into process, procedure, methodologies, and

technologies with best practice identification and actionable recommendations.

The number of mobile device platforms has proliferated in recent years, creating challenges for IT organizations in the areas of mobile device support, device and data security, application suites, device activation, control, data synchronization, and device deactivation. This report provides a roadmap to Mobile Device Management (MDM) strategies that the Best-in-Class utilize to maintain order, secure assets, and reduce cost.

Best-in-Class Performance

Aberdeen used three key performance criteria to distinguish Best-in-Class companies from all others:

• 14% decrease in mobility initiative Total Cost of Ownership (TCO) per mobile employee; compared to a 1% increase by the Industry Average and a 19% increase by Laggards

• 4% reduction in mobility support costs; compared to a 2% rise by the Industry Average and a 17% rise by Laggards

• 12% decline in lost or stolen mobile devices NOT successfully decommissioned; compared to a 5% decline by the Industry Average and a 2% rise by Laggards

Competitive Maturity Assessment

"Mobile Device Management has massively increased the reliability of and the

accessibility to corporate data – from email to intranet."

~ IT systems architect, global pharmaceutical manufacturer, USA Survey results show that the firms enjoying Best-in-Class performance

shared several common characteristics:

• 90% require compliance of all mobile devices to company standards, 22% more than the Industry Average and 80% more than Laggards • 77% are able to remotely Over-The-Air (OTA) lock a lost or stolen

mobile device from unauthorized access, 45% more than the Industry Average and 114% more than Laggards

Required Actions

In addition to the specific recommendations in Chapter Three of this report, to achieve Best-in-Class performance, companies must:

• Step Up to OTA Updates. Without remote OTA software or firmware updates, it requires a physical return of the device for servicing, thereby increasing unproductive downtime and adding expedited shipping charges to the TCO per employee.

• Take Security Seriously. Lower the organization's mobile risk profile. Unrecovered devices can contain sensitive or private data. Encrypt all wireless data transmission, as well as data "at rest" on devices and on removable media.

(3)

Figures

Figure 1: Mobility Initiatives over Time...5

Figure 2: Employee-liable Devices Invade the Enterprise...6

Figure 3: Best-in-Class Turn to MDM ...6

Figure 4: Top Business Pressures...9

Figure 5: The Best-in-Class MDM Criteria ...11

Figure 6: Best-in-Class Strategies ...13

Figure 7: MDM Impact ...14

Figure 8: Maximum Liability Exposure Per Compliance Lapse...15

Figure 9: Process Capabilities...18

Figure 10: Organizational Capabilities...19

Figure 11: Knowledge Management...19

Figure 12: Technology Capabilities ...20

Figure 13: Performance Capabilities ...21

Figure 14: MDM Device Platform – Current Use and Future Intention...22

Tables

Table 1: Mobile Device Management Capability Sets ...7

(4)

Table 2: Mobilized Enterprise Applications...9

Table 3: Top Performers Earn Best-in-Class Status...10

Table 4: The Best-in-Class PACE Framework ...11

Table 5: The Competitive Framework...17

Table 6: The PACE Framework Key ...28

Table 7: The Competitive Framework Key ...28

Table 8: The Relationship Between PACE and the Competitive Framework ...28

(5)

Chapter One:

Benchmarking the Best-in-Class

Definition of Terms

For the purposes of this study, Mobile Device Management (MDM) is defined as the management of mobile devices including handhelds (e.g., smartphones, feature phones) and / or portable computers (e.g., laptops, netbooks), either using conventional tools such as spreadsheets or paper-based documents – or using advanced solutions with Over-The-Air (OTA) remote management capability.

Adoption of enterprise mobility continues to grow. The March 2009

Aberdeen benchmark report More Mobility – Less Budget: Enterprise Strategies in the Current Economic Downturn revealed that 84% of companies have a mobile device initiative already in place, a rate that has grown consistently since 2006 (Figure 1).

Figure 1: Mobility Initiatives over Time

5% 59% 84% 72% 23% 8% 10% 7% 0% 13% 1% 19% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% 2006 2007 2009 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

Currently implemented Will implement this year Undetermined No mobility plans

Perce n ta g e of Resp o nde n ts Pe rcent a g e of Re spo n de nt s 5% 59% 84% 72% 23% 8% 10% 7% 0% 13% 1% 19% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% 2006 2007 2009 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

Currently implemented Will implement this year Undetermined No mobility plans

Perce n ta g e of Resp o nde n ts Pe rcent a g e of Re spo n de nt s

Source: Aberdeen Group, February 2009 Meanwhile, the number of mobile device platforms has proliferated over the same period, creating additional challenges for IT organizations in the areas of mobile device support, device and data security, application deployment, device activation, device control, data synchronization, and device

deactivation.

The December 2008 Aberdeen study, Mobility Management: Does Outsourcing Make Sense?, uncovered that the percentage of devices procured by

employees (“employee-liable”) had increased four-fold from January through December 2008, while the percentage of devices procured by the company (“company-liable”) decreased by 35% (Figure 2). This has resulted in an influx of a new mobile platforms, devices, and applications into the enterprise.

(6)

Figure 2: Employee-liable Devices Invade the Enterprise

"The MDM solution that we are looking for is going to provide a useful self-help portal for our end-users, visibility for IT into applications that our end-users have downloaded, and monitoring capabilities and alerts for our enterprise services – resulting in fewer calls to our Help Desk." ~ Procurement analyst, national

healthcare retail, USA 18% 40% 19% 16% 16% 65% 75% 10% 42% 0% 10% 20% 30% 40% 50% 60% 70% 80% Jan. '08 (WEM) Sep. '08 (MMC) Dec. '08 (MobOut) Pe rc en tage o f Re spon d ent s

Purchased by employees only from authorized vendor Purchased by company from carrier

Purchased by employees from any vendor 18% 40% 19% 16% 16% 65% 75% 10% 42% 0% 10% 20% 30% 40% 50% 60% 70% 80% Jan. '08 (WEM) Sep. '08 (MMC) Dec. '08 (MobOut) Pe rc en tage o f Re spon d ent s

Purchased by employees only from authorized vendor Purchased by company from carrier

Purchased by employees from any vendor

Source: Aberdeen Group, December 2008 In the March 2009 report, More Mobility – Less Budget: Enterprise Strategies in the Current Economic Downturn, it was found that in order to reign-in

potential chaos, control support costs, and ensure compliance with corporate standards of data access and security, 50% of Best-in-Class companies turned to centralized Mobile Device Management with Over-The-Air (OTA) capabilities – a 61% greater tendency than all others (Figure 3).

Fast Facts From the March 2009 Benchmark Report

Over the prior 24 month period, the Best-in-Class achieved the following with a 19% increase in mobility TCO: √ Increased the number of

employees covered by their mobility initiative by 44% √ Improved employee

productivity by 36% √ Increased the mobile devices

in full IT compliance by 33% Figure 3: Best-in-Class Turn to MDM

Central management and OTA control of mobile devices 50% 31% 0% 10% 20% 30% 40% 50% 1 Best-in-Class All Others Percentage of Respondents Central management

and OTA control of mobile devices 50% 31% 0% 10% 20% 30% 40% 50% 1 Best-in-Class All Others Percentage of Respondents

Source: Aberdeen Group, March 2009

MDM: A Broad Spectrum

There is a broad range of capabilities subsumed under the term "Mobile Device Management" (MDM), as in Table 1.

(7)

Table 1: Mobile Device Management Capability Sets MDM Basic Capabilities

Device inventory Device provisioning

Device de-commissioning or recycling Wireless carrier billing details

Voice call tracking Self-service web portal

MDM Advanced Capabilities Heterogeneous mobile platform support

User Authentication prior to access Over-The-Air (OTA) device lock OTA device wipe (erase all contents)

OTA software application compliance enforcement OTA software application installation

OTA software application de-installation OTA Operating System update

OTA device firmware update Device remote control

MDM Emerging Capabilities Data encryption for all OTA transmissions

Data encryption on device Removable media data encryption Remote device geo-location Control access to device Bluetooth Control access to device camera

Source: Aberdeen Group, June 2009 Before the advent of today's advanced wireless OTA access and control, mobile devices were tracked and managed as physical inventory, much like desktop computers. Paper-based or spreadsheet-based and home-grown tracking and management tools evolved to attain control over this mobile asset of growing importance, and potentially risk, to the organization. Many of these tools are still in use today; in fact, in this study 63% of respondents still use paper-based or spreadsheet-based methods to manage smartphones, 48% for feature phones ("cell phones"), 75% for laptops, and 25% for netbooks (ultra-compact low-cost portable computers primarily used for Web browsing and messaging). With the exception of "self-service Web portal" above, the conventional approach can be utilized to accomplish the mobility management capabilities listed in the MDM Basic Capabilities section in Table 1.

On the other hand, MDM Advanced and Emerging Capabilities are used by 43% of respondents for smartphones, 24% for feature phones, 41% for laptops, and 17% for netbooks.

(8)

A Change in the Device Landscape

"We have seen a direct increase in sales attributable to mobile device management – having a demonstrable system that we use ourselves enables us to explain the benefits to our customers, whom we support in implementing their own systems."

~ CEO, telecommunications services, London, United Kingdom With the increasing power and capabilities of new mobile devices and

platforms, the March 2009 report More Mobility – Less Budget: Enterprise Strategies in the Current Economic Downturn described how "prosumer" devices (defined as consumer devices with professional-level capabilities) are entering the enterprise in growing numbers – creating challenges for IT departments who must deploy and support them, or support application access to them.

Many IT departments are forced to accommodate the influx of employee-liable devices because they must find a way to accommodate increasing demand for mobility with organizational mandates to reduce capital expenditure. In some cases, this has forced them to abandon hard-won corporate requirements for mobile device standardization, replacing them with corporate standards for mobile device compliance.

The industry is at a point of transition from homogenous mobile device environments to heterogeneous environments, with major implications for support, telecommunication services costs, and mobile device management.

Business Pressures Driving MDM Adoption

This report was fielded in June 2009, and resulted in responses from over 170 organizations. 95%*_{of the respondents had some features of mobile} device management already in place.

Of the 95% who did report having some features of MDM in place, 44% of them report that the predominant business pressure driving their mobile device management strategy was the increasing demand for mobile device support (Figure 2). Forty percent (40%) reported the need to reduce mobility Total Cost of Ownership (TCO) as the top pressure, 35%

reported it is the need to securely mobilize enterprise applications, and 19% said it is the need to track who is accessing the organization's data from a mobile device.

These four themes – increased demand for mobility, total mobility cost reduction, secured mobile enterprise applications, and tracking mobile use and access – are the fundamental aspects to MDM that this report will examine in detail.

*In all survey results reported in this report, percentages refer to the percentage of the total number of respondents to that particular question. All charts include the total responses in the form of “n=###” where “###” is the number of responses. Where the results from more than one question were used in a chart, the number of respondents per question is listed in order (e.g., n=151, 146, etc.).

(9)

Figure 4: Top Business Pressures 44% 40% 35% 19% 0% 10% 20% 30% 40% 50% Increased demand for mobile device support

Need to reduce mobile total cost of ownership

Need to securely mobilize enterprise applications

Need to track mobile access to company data Percentage of Respondents, n=162 44% 40% 35% 19% 0% 10% 20% 30% 40% 50% Increased demand for mobile device support

Need to reduce mobile total cost of ownership

Need to securely mobilize enterprise applications

Need to track mobile access to company data

Percentage of Respondents, n=162

Source: Aberdeen Group, June 2009 Table 2 describes the enterprise applications currently being mobilized. Five of the top six applications are messaging-based, and clearly demonstrate that messaging and its “derivatives” (email, SMS, IM, and MMS) continue to dominate as the mobility “killer apps.” The only application types other than messaging which retain a top spot are the Microsoft Office productivity applications, which reside in the third position at 82% of respondents. Table 2: Mobilized Enterprise Applications

Mobilized Applications All Respondents

SMS ('texting') 86%

Microsoft Exchange (email, contacts, calendar) 83% Microsoft Office (Word, Excel, PowerPoint) 82% Web mail (e.g. Gmail, Yahoo Mail, AOL, etc.) 73%

Instant Messaging (IM) 69%

MMS ('texting' with attachments – e.g. photos) 57% In-house developed or customized software application 56%

Customer Relationship Management (CRM) 46%

Enterprise Resource Planning (ERP) 35%

Business Intelligence (BI) 35%

Micro-blogging – e.g. Twitter 30%

(10)

This study will demonstrate that the Best-in-Class – the top performers as measured across multiple performance metrics – leverage the power of MDM to lower their mobility TCO per employee and lower their support costs; while they maintain the security and integrity of the organization's data and network.

The Maturity Class Framework

Aberdeen used three key performance criteria to distinguish the Best-in-Class from Industry Average and Laggard organizations.

Table 3: Top Performers Earn Best-in-Class Status Definition of

Maturity Class Mean Class Performance

Best-in-Class: Top 20% of aggregate performance scorers

14% decrease in mobility initiative TCO per mobile employee

4% reduction in mobility support costs

12% decline in lost or stolen mobile devices NOT successfully decommissioned

Industry Average: Middle 50%

of aggregate performance scorers

1% increase in mobility initiative TCO per mobile employee

2% increase in mobility support costs

5% decline in lost or stolen mobile devices NOT successfully decommissioned

Laggard: Bottom 30%

of aggregate performance scorers

19% increase in mobility initiative TCO per mobile employee

17% increase in mobility support costs 2% rise in lost or stolen mobile devices NOT

successfully decommissioned

Source: Aberdeen Group, June 2009 Figure 5 illustrates the benefits the Best-in-Class have achieved through their implementation of MDM over the prior 12 months: a 14% decrease in the mobility TCO per mobile employee (compared to a 1% increase by the Industry Average and a 19% increase by Laggards); a 4% reduction in mobility support costs (compared to a 2% rise by the Industry Average and a 17% rise by Laggards); and a 12% decline (compared to a 5% decline by the Industry Average and a 2% rise by Laggards) in the number of lost or stolen mobile devices that they were not successful in decommissioning, either by remotely locking or erasing the data on the device.

(11)

Figure 5: The Best-in-Class MDM Criteria -14% -4% -12% 1% 2% -5% 19% 17% 2% -20% -15% -10% -5% 0% 5% 10% 15% 20% 25% Mobility Initiative TCO/employee

Mobility Support Costs Lost or stolen devices NOT decommissioned Pe rc entag e One -Y ea r Change Best-in-Class Average Laggard n=162 -14% -4% -12% 1% 2% -5% 19% 17% 2% -20% -15% -10% -5% 0% 5% 10% 15% 20% 25% Mobility Initiative TCO/employee

Mobility Support Costs Lost or stolen devices NOT decommissioned Pe rc entag e One -Y ea r Change Best-in-Class Average Laggard n=162

Source: Aberdeen Group, June 2009

The Best-in-Class PACE Model

Using Mobile Device Management to achieve organizational goals requires a combination of strategic actions, organizational capabilities, and enabling technologies that can be summarized as follows:

Table 4: The Best-in-Class PACE Framework

Pressures Actions Capabilities Enablers

Rapid influx of non-standard mobile devices gaining access to company assets

Ensure all mobile devices with enterprise access are compliant with corporate standards Support a

heterogeneous (versus homogeneous) mix of mobile device platforms Manage, maintain, and

control Over-The-Air (OTA) all mobile devices with enterprise access

Ability to control access to company assets by all mobile devices

Ability to control access to company assets by all mobile end-users

Organizational compliance standards in place for mobile devices, platform(s), and applications

Security policy established which incorporates the full lifecycle of all compliant mobile devices maintained

Smartphones Laptops Netbooks

OTA MDM solution

Carrier wireless services contracts Mobile data encryption software Mobile Virtual Private Network Anti-virus software for mobile devices Remote device lock

Remote device wipe

OTA firmware updates for mobile devices OTA application support tools

(12)

Best-in-Class Strategies

The pressure to find an effective means to both accommodate and control the influx of non-standard mobile devices onto the company network is in part caused by the compound pressures of expanding the reach of the organization's mobility initiative, while somehow reducing its cost. This paradox was examined in some detail in the benchmark, More Mobility – Less Budget: Enterprise Strategies in the Current Economic Downturn, and recapped briefly at the beginning of this report.

The strategies or tactics that Best-in-Class companies take in response to these pressures are illustrated in Figure 6. Forty-four percent (44%) ensure all devices that gain corporate access are compliant with organizational device and application standards – 47% more than all other respondents. This brings up the increasingly recurring them of device compliance, as contrasted with the approach of standardization, which in many cases preceded it.

Standardization assumes a very small number of pre-approved devices, almost always based on one mobile platform. These standard devices are rigorously performance- and security-tested before being permitted network access. This minimizes risk to the organization, and theoretically lowers support costs due to the homogenous nature of the device landscape. However, the capital budget burden on the organization to purchase devices for every mobilized employee can quickly become cost-prohibitive, especially in the current difficult financial landscape.

Compliance assumes a very small number of pre-approved mobile platforms. Typically, the compliant platform(s) include a variety of devices from a variety of manufacturers which are all considered to be compliant. As long as a device conforms to the proscribed platform and application

(13)

Figure 6: Best-in-Class Strategies 44% 41% 31% 25% 30% 40% 21% 15% 0% 10% 20% 30% 40% 50%

Ensure all mobile devices with enterprise access are corporate compliant

Manage, maintain, and control all mobile devices with enterprise access

Contain wireless carrier services costs

Standardize on ONE mobile platform across the enterprise

Percentage of All Respondents, n=162

Best-in-Class All Others 44% 41% 31% 25% 30% 40% 21% 15% 0% 10% 20% 30% 40% 50%

Ensure all mobile devices with enterprise access are corporate compliant

Manage, maintain, and control all mobile devices with enterprise access

Contain wireless carrier services costs

Standardize on ONE mobile platform across the enterprise

Percentage of All Respondents, n=162

Best-in-Class All Others

Source: Aberdeen Group, June 2009 The next strategy – managing, maintaining, and controlling all mobile devices with enterprise access, is one that all respondents can agree upon, with the Best-in-Class leading all others by only 1%. Although their prioritization of this strategy is similar, their approach differs considerably, as described throughout this report. Containing wireless carrier services costs is a top strategy for 31% of the Best-in-Class, 48% more than for all others. Standardizing on one mobile platform was selected by only 25%, further corroboration that platform compliance is beginning to replace the notion of standardization on a single platform.

MDM's Impact on the Mobility Initiative

Figure 7 describes the impact MDM has had on the organization's mobility initiative since its inception. The Best-in-Class saw a 12% drop in

unproductive downtime, defined as not being connected to company resources while away from the office, or not able to respond remotely. The Industry Average dropped 10% and the Laggards saw no change. The Best-in-Class also saw a 10% drop in the mobile support services time logged per support call, versus a 3% drop by the Industry Average and 15% increase by Laggards. This was a contributing factor to the Best-in-Class reduction in Mobility TCO per mobile employee discussed earlier.

(14)

Figure 7: MDM Impact

"I have access to almost all of my time-relevant information 24 hours per day, seven days a week."

~ IT sales, global software leader, NSW, Australia -12% -10% -10% -3% 0% 15% -15% -10% -5% 0% 5% 10% 15% 20%

Unproductive downtime* Support services time logged per support call Pe rc entage Change S in c e Mob ili ty In it ia ti ve Best-in-Class Industry Average Laggard n=136, n=135 -12% -10% -10% -3% 0% 15% -15% -10% -5% 0% 5% 10% 15% 20%

Unproductive downtime* Support services time logged per support call Pe rc entage Change S in c e Mob ili ty In it ia ti ve Best-in-Class Industry Average Laggard n=136, n=135

Source: Aberdeen Group, June 2009 Aberdeen Insights — The Risk from Unrecovered Devices Figure 5 above described the key performance differentials between the three Maturity Classes: Best-in-Class, Industry Average, and Laggard. The Laggards showed a 2% increase in the number of lost or stolen mobile devices that could not be successfully recovered. Two percent (2%) seems like a relatively small rate of increase – what difference could 2% make?

In order to ascertain the answer to this question, we looked to some earlier Aberdeen research. In the January 2009 report, Reducing the Cost of Freedom: Wireless Expense Management, respondents were asked to describe the maximum liability exposure per regulation or compliance lapse to their organization from the misuse or misappropriation of protected information found on their mobile devices. The results are shown in Figure 8 below.

(15)

Aberdeen Insights — The Risk from Unrecovered Devices Figure 8: Maximum Liability Exposure Per Compliance Lapse

Maximum Liability per Compliance Lapse (in thousands)

$1,556 $1,473 $1,234 $1,038 $1,018 $1,002 $837 $820 $793 $356 $121 $- $200 $400 $600 $800 $1,000 $1,200 $1,400 $1,600 $1,800 Payment Card Industry Data

Security Standard (PCI DSS)

Securities and Exchange Commission (SEC) regulations

Global privacy regulations

Health Insurance Portability and Accountability Act (HIPAA)

COBIT Operational Standards

Sarbanes-Oxley (SOX, JSOX)

United States Federal Rules of Civil Procedure (Legal Discovery)

'Green' Compliance requirements

United States Patriot Act

IRS use of listed property

Other

Thousands of US Dollars n=112 Maximum Liability per Compliance Lapse (in thousands)

Other

Thousands of US Dollars Maximum Liability per Compliance Lapse (in thousands)

Other Payment Card Industry Data Security Standard (PCI DSS)

Other

Thousands of US Dollars n=112

Source: Aberdeen Group, January 2009 The data shows that the minimal liability exposure reported was approximately $121,000 and that it topped out at over $1.5 million per incident. With the wide range of potential governance, regulation, and compliance violations listed above, it is entirely possible that a single lost device could invoke more that one compliance lapse claim. This is to say nothing of the potential loss from stolen intellectual property or trade secrets. Many business executives and IT managers still pay little heed to the risks associated with lost or stolen mobile devices. Perhaps these findings will serve as a wake-up call.

In the next chapter, we will see what the top performers are doing to achieve these gains.

(16)

Chapter Two:

Benchmarking Requirements for Success

The selection of a Mobile Device Management solution plays a crucial role in the ability of organizations to reduce the total cost of mobility per

employee, while simultaneously enabling them to increase the number of employees mobilized without additional staff.

Case Study — Fortune 50 Technology Company, Head of Mobility This company is one of the globe's largest technology providers. The head of its mobility services department provides support and

deployment service to internal clients. Some of the solutions are based on his company's mobilized products, but most integrate third-party technologies.

Best-in-Class Fast Facts

√ 83% use their MDM solution to manage mobile device inventory

√ 72% use their MDM solution to manage mobile device provisioning and wireless carrier activation

His goal is to deliver the best possible mobility services to end-users, no matter who provides the technology. His department was initially focused on a single standardized smartphone platform, but has recently decided to give users a choice. The company now permits a range of smartphone platforms to access the corporate net.

It has decided against a tight list of approved mobile devices or specific device vendors. As long as a device complies with a set of standards around the company’s Virtual Private Network (VPN) connections, it is permitted full access to company assets.

Historically, the company used a third-party mobile mail server as its first entry into enterprise mobility. The challenge was that managing and hosting the servers in-house was time-consuming, as was the need to certify all mobile devices for usability and security. The mobility effort was draining too many resources, and so it was decided to chart a different direction.

The company chose a specific server platform because the carriers took care of the device certification. When pressed by end-users to support their personal devices for business use, the company then standardized on a single VPN provider as its common secure connectivity platform for all mobile devices.

The head of the mobility services department is now looking at centralized OTA mobile device management to minimize the support work-load on the team. He is based in a different country than the company's headquarters location. Ironically, as head of global mobility, with the recent budget cuts, international travel is no longer an option. This has caused a dramatic increase in the use of the company’s telepresence system in recent months.

Competitive Assessment

Aberdeen analyzed the aggregated metrics of surveyed companies to determine whether their performance ranked as Best-in-Class, Industry Average, or Laggard. In addition to having common performance levels, each

(17)

class also shared characteristics in five key categories: (1) process (the approaches they take to execute their daily operations); (2) organization (corporate focus and collaboration among stakeholders); (3) knowledge management (contextualizing data and exposing it to key stakeholders); (4) technology (the selection of appropriate tools and effective

deployment of those tools); and (5) performance management (the ability of the organization to measure its results to improve its business). These characteristics (identified in Table 5) serve as a guideline for best practices, and correlate directly with Best-in-Class performance across the key metrics.

Table 5: The Competitive Framework

Best-in-Class Average Laggards

Require compliance to company mobility standards 90%

“MDM has created significant transparency of geographic location. ‘Place’ does not mean anything anymore.”

~ Vice president marketing, global military retail services, Texas, USA

74% 50%

Secure authentication for network access for all mobile users Process

88% 68% 58%

Trained (in-house or outsourced) help desk support available for all compliant mobile devices and applications

78% 63% 46%

Enforce organizational security compliance standards

78% 68% 46%

Legal standards for liability of corporate data residing on “employee-liable” devices

Organization

42% 36% 20%

Provide end-user training on approved mobile device usage

71% 54% 27%

Document and distribute MDM best practices Knowledge

52% 33% 27%

Remote mobile device lock (prevent access)

77% 53% 36%

Mobile data encryption during wireless transmission

69% 51% 38%

Anti-virus software for mobile devices

65% 47% 33%

Over-the-Air (OTA) mobile application update Technology

52% 38% 31%

Track who has mobile access to company network and data

81% 66% 64%

Track level of mobile access to network and data provided to each mobile employee

Performance

81% 53% 51%

(18)

Capabilities and Enablers

Based on the findings of the Competitive Framework and interviews with end-users, Aberdeen’s analysis of the Best-in-Class demonstrates that utilizing MDM to manage the organization's fleet of mobile devices lowers the mobility initiative Total Cost of Ownership per mobile employee by 14%, lowers mobility support costs by 4%, and reduces the percentage of lost or stolen devices that are not successfully decommissioned by 12%.

Process

Although Figure 5 showed that only 25% of the Best-in-Class demand standardization on one mobile device, Figure 9 demonstrates that mobile device compliance is definitely a Best-in-Class attribute, with 90% possessing this capability. This is 22% more than the Industry Average and 80% more than the Laggards. Protection of company assets from unauthorized mobile access is also a clear priority of the Best-in-Class: 88% have this capability, 30% more than the Industry Average and 52% more than Laggards. Figure 9: Process Capabilities

90% 88% 74% 68% 50% 58% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Require compliance to company mobility standards Secure authentication for all mobile users

Best-in-Class Industry Average Laggard

90% 88% 74% 68% 50% 58% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% Require compliance to company mobility standards Secure authentication for all mobile users

Organization

One way that the Best-in-Class lower their cost of mobile support is by ensuring that helpdesk knowledge workers are properly trained on all compliant mobile devices and applications. This shortens helpdesk call length, and enables staff to support more end-user calls per work shift. Seventy-eight percent (78%) of the Best-in-Class provide this level of training, 24% more than Industry Average, and 70% more than Laggards (Figure 10). As mentioned above, fierce protection of corporate assets from rogue mobile access is a best practice – 78% of the Best-in-Class enforce organizational security compliance standards. This is 15% more than Industry Average and 70% more than Laggards.

Although only 32% of the Best-in-Class permit employee-owned

(“employee-liable”) mobile devices to access the company network – versus 44% of all others – 42% of them see the writing on the wall, and are taking proactive steps to protect the organization from the “devices from the edge” trend: they've developed internal legal standards for the liability of corporate data on employee-liable devices. Some require written waivers

(19)

from employees who want to access the network from their personal devices, which require the device to be centrally managed using the organization's OTA MDM solution, and enable the organization to wipe or erase all (corporate) data from the device if it is lost or stolen.

Figure 10: Organizational Capabilities

78% 78% 42% 63% 68% 36% 46% 46% 20% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90%

Trained help desk support available for compliant devices & applications

Organizational security compliance standards enforced

Legal standards for liability of corporate data on 'employee-liable' devices

78% 78% 42% 63% 68% 36% 46% 46% 20% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90%

Trained help desk support available for compliant devices & applications

Organizational security compliance standards enforced

Legal standards for liability of corporate data on 'employee-liable' devices

Knowledge Management

Once again, the Best-in-Class demonstrate their understanding of the relationship between proper training and reduced support costs (Figure 11). They focus both on knowledge acquisition and knowledge dissemination. Seventy-one percent (71%) provide training for end-users on approved mobile usage, 31% more than the Industry Average and 163% more than the Laggards. Continuing with the theme of knowledge sharing as an attribute of the top performers, 52% document and distribute MDM best practices, 58% more than the Industry Average and 93% more than Laggards.

Figure 11: Knowledge Management

71% 52% 54% 33% 27% 27% 0% 10% 20% 30% 40% 50% 60% 70% 80% Provide end-user training on approved mobile usage

Document & distribute mobile device management best practices

71% 52% 54% 33% 27% 27% 0% 10% 20% 30% 40% 50% 60% 70% 80% Provide end-user training on approved mobile usage

Document & distribute mobile device management best practices

(20)

Technology

Three quarters of the top technology enablers for the Best-in-Class relate to security and protection of network assets.

Figure 12: Technology Capabilities

77% 69% 65% 52% 53% 51% 47% 38% 36% 38% 33% 31% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90%

Over-the-Air (OTA) mobile application update

77% 69% 65% 52% 53% 51% 47% 38% 36% 38% 33% 31% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90%

Over-the-Air (OTA) mobile application update

Source: Aberdeen Group, June 2009 Seventy-seven percent (77%) of the Best-in-Class are able to remotely lock a mobile device that has become lost or stolen to prevent further access. This is 42% more than the Industry Average and 114% more than Laggards. Sixty-nine percent (69%) of the Best-in-Class encrypt all mobile data during wireless transmission; 65% also encrypt data on the mobile device itself, and only 33% encrypt the data on removable media such as USB drives and MicroSD cards. The Industry Average and Laggards pursue mobile data encryption considerably less than do the Best-in-Class. All end-users could benefit from a focus on data encryption in the three locations where it makes the most difference: while in transmission, on the device "at rest,” and on removable media. For a discussion on the financial risks associated with the misappropriation of protected data, see the section The Risk from Unrecovered Devices above.

Given the general high level of end-user awareness of malware and the importance of anti-virus software on any computer connected to the Internet, it is apparent that there is considerably less awareness of the same risks on mobile devices. Just 65% of the Best-in-Class use mobile anti-virus software, and only 47% of the Industry Average and 33% of Laggards. Although public awareness of the incidence of malware attacks on mobile

(21)

devices is relatively quite low, it is expected that the increased frequency of Web browsing on the latest generation of smartphones, combined with recent news of increasing attacks attempting to directly compromise both carrier and enterprise networks will elevate the importance of this core asset protection in the foreseeable future.

Twenty-five percent (25%) less of the Best-in-Class who can remotely OTA lock a mobile device can also update the device software OTA. It points to the fact that the more advanced MDM capabilities described earlier in Table 1 are still embryonic in their rate of adoption by end-users. Whereas just over half of the Best-in-Class have this capability, it is 37% more than the Industry Average and 67% more than Laggards.

Performance Management

Figure 13 details the top two performance monitoring capabilities of the Best-in-Class. Mobile access should be granted based on pre-existing authentication data pulled from the organization's landline network; ideally integrated with the organization's user directory and access policies as well. Once the user has been authenticated, his or her level of network and data access should be policy-driven based upon unique identity; or based upon his or her job role or workgroup identification. Eighty-one percent (81%) of the Best-in-Class can both track who has mobile access to the company network and data, as well as track and control the level of access provided on an individual basis. This is 23% and 34% more than the Industry Average, and 27% and 59% more than Laggards can, respectively.

Figure 13: Performance Capabilities

81% 81% 66% 53% 64% 51% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90%

Percentage of Respondents, n=162 Track level of mobile

access provided to each mobile employee

81% 81% 66% 53% 64% 51% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90%

Percentage of Respondents, n=162 Track level of mobile

access provided to each mobile employee Track level of mobile access provided to each mobile employee

Source: Aberdeen Group, June 2009 Aberdeen Insights — MDM Platform Support

Respondents were asked to specify which mobile platforms they were currently using with their MDM solution, as well as to describe their current platform evaluation activities and future platform intentions.

(22)

Aberdeen Insights — MDM Platform Support Figure 14: MDM Device Platform – Current Use and Future Intention

94% 52% 24% 0% 4% 16% 3% 24% 28% 81% 49% 38% 4% 7% 17% 5% 10% 13% 69% 53% 40% 2% 4% 13% 8% 11% 21% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% BlackBerry Windows Mobile iPhone BlackBerry Windows Mobile iPhone BlackBerry Windows Mobile iPhone Currently Using Currently Testing

Considering for the Future

Percentage of Respondents, n=158, n=144, n=141 Best-in-Class Industry Average Laggard 94% 52% 24% 0% 4% 16% 3% 24% 28% 81% 49% 38% 4% 7% 17% 5% 10% 13% 69% 53% 40% 2% 4% 13% 8% 11% 21% 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100% BlackBerry Windows Mobile iPhone BlackBerry Windows Mobile iPhone BlackBerry Windows Mobile iPhone Currently Using Currently Testing

Considering for the Future

Percentage of Respondents, n=158, n=144, n=141 Best-in-Class Industry Average Laggard Best-in-Class Industry Average Laggard

Source: Aberdeen Group, June 2009 Although all major client mobile platforms were considered in this study, in this analysis we’re examining the handset platforms, as there is an ongoing battle in the marketplace right now for market share and mindshare. Due to space constraints, this section focuses on just three of the top mobile platforms: RIM BlackBerry, Microsoft Windows Mobile, and Apple iPhone. As seen in Figure 14, the top grouping of bar charts shows that the BlackBerry is in a clear leadership position in terms of current use: 94% of the Best-in-Class currently use BlackBerry with MDM, 81% more than use Windows Mobile, and 250% more than use iPhone.

(23)

Aberdeen Insights — MDM Platform Support

When we look at the middle set of bars, we see which platforms are currently being tested for imminent MDM integration, and it's a different story. Sixteen percent (16%) of Best-in-Class are testing iPhone, four-times the number testing Windows Mobile, and 16-times the number testing BlackBerry. Not surprising, given that most all of them have completed the testing phase with that platform.

The bottom set of bars describes the platforms considered for future implementation, and the iPhone is again in the lead at 28%, followed closely by Windows Mobile. BlackBerry, however, trails significantly at 3% of Best-in-Class. It's not necessarily a sign that support of a particular mobile platform is waning; it is however a clear sign of growing interest in a variety of alternative platforms. It is an indicator that support of homogenous MDM platform

environments is at risk, to be replaced with robust heterogeneous platform support among many MDM solutions.

(24)

Chapter Three:

Required Actions

Best-in-Class Fast Facts

√ 48% have the ability to control their mobile devices remotely Over-the-Air (OTA)

√ 45% have an end-user self-service web portal to expedite device provisioning and self-help, cutting down on support costs

√ 41% can remotely erase all contents on a mobile device OTA

√ 41% encrypt all data for OTA transmission Whether a company is trying to move its performance in Mobile Device

Management from Laggard to Industry Average, or Industry Average to Best-in-Class, the following actions will help spur the necessary performance improvements:

Laggard Steps to Success

• Step up to OTA updates. Only 30% of Laggards can update mobile applications remotely OTA, and 27% can update firmware, which can be warranted for major software releases. Without remote OTA software or firmware updates, a physical return of the mobile device is required to have it serviced, increasing

unproductive downtime and adding expedited shipping charges to the TCO per employee. OTA updates also enable enforced application compliance and real-time device inventory.

• Take security seriously. Lower your organization's mobile risk profile. Only 47% of Laggards track the number of lost devices that have been successfully decommissioned. Unrecovered devices can contain sensitive or private data. Prior Aberdeen research quantified the maximum exposure per compliance lapse and the figures were staggering: from $100,000 per incident on the low end to $1.5 million on the high end. Assess how many mobile devices are “employee liable.” Eighty-one percent (81%) of Laggards don't have legal standards to determine liability for corporate data on

employee-liable devices. Encrypt all wireless data transmission; only 41% of Laggards currently do so.

• Lower support costs. Laggards' support costs increased by 19% over the 12 month period. This is partially due to a haphazard approach to device compliance; only 50% require compliance, versus 75% of the Industry Average and 90% of the Best-in-Class. It is more expensive to support non-compliant devices, and it tends to lengthen problem resolution and create ancillary inefficiencies. In addition to simplifying support issues through compliance

enforcement, proper staff training can facilitate improved quality of care and improved efficiency. Sixty-two percent (62%) of Laggards don't provide staff training on their MDM solution, and 73% don't train end-users on approved mobile device usage.

Industry Average Steps to Success

• Take (remote) control of your mobile devices. A first step would be to automate the inventory and tracking of all devices with network access; currently only 57% of the Industry Average do so. Remote device wipe is an important advanced MDM capability that only 53% of the Industry Average has. OTA mobile application

(25)

updates (38%) and firmware updates (29%) are additional areas ripe for performance improvement.

• Lower your organization's risk profile by raising the level of attention paid to mobile security in the organization. Introduce anti-virus software for all mobile devices – only 47% of the Industry Average has this capability. Data encryption protects your organization's most valuable asset (its information) from unauthorized access. Encrypt data in transmission (51%) and "at rest" on the device (41%). Track lost or stolen devices and decommission them – only 46% of the Industry Average currently does so. Develop legal standards for liability and disposal of company data on employee-liable devices – 65% have not yet done this.

• Share the (knowledge) wealth. Only one-third of the Industry Average (33%) documents and distributes MDM best practices. Know your mobile base: 66% don't know how many of their mobile devices are “employee-liable” versus “corporate-liable.” Forty-six percent (46%) need to provide staff training on their MDM solution, and the same number also needs to provide end-user training on approved mobile device usage.

Best-in-Class Steps to Success

"Mobile Device Management is fundamental, as mobility is a vital part of the job."

~ General manager, IT consulting services, Brabant, Belgium • Take a stronger stand and enforce compliance, don't just

"require" it. Although 97% of the Best-in-Class have some level of MDM in place and 93% require device compliance, only 77% enforce security compliance. Only 79% track the level of network access provided to each mobile employee. Enforced compliance is your last great hope to wrest order from impending platform multi-device chaos.

• Increase your OTA MDM power. If you've got OTA capability, use it; if you don't have advanced MDM capabilities, get them. 52% still don't update applications OTA, and 41% still don't do a remote device wipe on devices which are lost or stolen, and 61% don't update firmware OTA.

• Plug the remaining security holes in your mobility strategy. Only 52% know how many of their mobile devices are “employee-liable,” and only 45% have legal guidelines to protect the liability of corporate assets residing on those devices. Make sure all mobile devices are protected against malware now that your road and corridor warriors are surfing the Internet at all times. They're consequently putting your organization at risk if they're not inoculated against viruses and other attacks, and only 62% have mobile antivirus in place.

(26)

Aberdeen Insights — Summary

Mobile Device Management is the best way for organizations faced with a heterogeneous, rapidly changing device and mobile platform environment to lower their TCO per mobile employee. MDM leverages efficiencies of scale in device procurement and deployment, providing maximum negotiating power when dealing with device providers and wireless operators, and is the most efficient delivery mechanism for wireless OTA application, firmware, and security profile compliance. The mobile device infrastructure of your organization can either be a sinkhole of hidden and uncontrolled capital expense, support cost, and security vulnerability, or it can be the secure, robust, and compliant foundation for the truly mobile, flexible, and responsive organization able to compete in a global marketplace.

(27)

Appendix A:

Research Methodology

Between May and June 2009, Aberdeen examined the use, the experiences, and the intentions regarding Mobile Device Management (MDM) of more than 170 enterprises using mobility in a wide range of environments.

Study Focus

Responding enterprise

executives completed an online survey that included questions designed to determine the impact that their use of mobile device management has had on the following:

√ Mobility initiative Total Cost of Ownership per employee √ Mobility support costs √ Ability to recover or

decommission lost or stolen mobile devices

The study aimed to identify adoption rates and emerging best practices for mobile device management in the enterprise, and to provide a framework by which readers could assess their own management capabilities.

Aberdeen supplemented this online survey effort with telephone interviews with select survey respondents, gathering additional information on MDM strategies, experiences, and results.

Responding enterprises included the following:

• Job title: The research sample included respondents with the following job titles: CEO / President (20%); EVP / SVP / VP (11%); Director (15%); Manager (22%); Staff / Consultant (13%); Engineer (3%); other (4%).

• Department / function: The research sample included respondents from the following departments or functions: information

technology (38%); business development and sales (25%); operations and procurement (14%); business process management (6%);

marketing (5%); finance (3%); logistics / supply chain (3%); other (6%).

• Industry: The research sample included respondents from the following industries: IT Consulting / Services (18%); telecom-munications Services (14%); Software / hardware supplier (10%); Finance / Banking / Accounting (5%); Telecommunications Equipment (5%); Education (4%); Government (4%); other (40%). • Geography: The majority of respondents (63%) were from North

America. Remaining respondents were from the Asia-Pacific region (17%), Europe (16%), South / Central America and Caribbean (3%), and Middle East / Africa (1%).

• Company size: Thirty-five percent (35%) of respondents were from large enterprises (annual revenues above US $1 billion); 26% were from midsize enterprises (annual revenues between $50 million and $1 billion); and 39% of respondents were from small businesses (annual revenues of $50 million or less).

• Headcount: Forty-seven percent (47%) of respondents were from large enterprises (headcount greater than 1,000 employees); 19% were from midsize enterprises (headcount between 100 and 999 employees); and 34% of respondents were from small businesses (headcount between 1 and 99 employees).

(28)

Table 6: The PACE Framework Key

Overview

Aberdeen applies a methodology to benchmark research that evaluates the business pressures, actions, capabilities, and enablers (PACE) that indicate corporate behavior in specific business processes. These terms are defined as follows:

Pressures — external forces that impact an organization’s market position, competitiveness, or business operations (e.g., economic, political and regulatory, technology, changing customer preferences, competitive) Actions — the strategic approaches that an organization takes in response to industry pressures (e.g., align the corporate business model to leverage industry opportunities, such as product / service strategy, target markets, financial strategy, go-to-market, and sales strategy)

Capabilities — the business process competencies required to execute corporate strategy (e.g., skilled people, brand, market positioning, viable products / services, ecosystem partners, financing)

Enablers — the key functionality of technology solutions required to support the organization’s enabling business practices (e.g., development platform, applications, network connectivity, user interface, training and support, partner interfaces, data cleansing, and management)

Source: Aberdeen Group, June 2009 Table 7: The Competitive Framework Key

Overview The Aberdeen Competitive Framework defines enterprises as falling into one of the following three levels of practices and performance:

Best-in-Class (20%) — Practices that are the best currently being employed and are significantly superior to the Industry Average, and result in the top industry performance.

Industry Average (50%) — Practices that represent the average or norm, and result in average industry

performance.

Laggards (30%) — Practices that are significantly behind the average of the industry, and result in below average performance.

In the following categories:

Process — What is the scope of process standardization? What is the efficiency and effectiveness of this process?

Organization — How is your company currently organized to manage and optimize this particular process?

Knowledge — What visibility do you have into key data and intelligence required to manage this process? Technology — What level of automation have you used to support this process? How is this automation integrated and aligned?

Performance — What do you measure? How frequently? What’s your actual performance?

Source: Aberdeen Group, June 2009 Table 8: The Relationship Between PACE and the Competitive Framework

PACE and the Competitive Framework – How They Interact

Aberdeen research indicates that companies that identify the most influential pressures and take the most transformational and effective actions are most likely to achieve superior performance. The level of competitive performance that a company achieves is strongly determined by the PACE choices that they make and how well they execute those decisions.

(29)

Appendix B:

Related Aberdeen Research

Related Aberdeen research that forms a companion or reference to this report includes:

• More Mobility – Less Budget: Enterprise Strategies in the Current Economic Downturn; March 2009

• Get the Message: Good Technology Acquisition Enables VISTO to Go Corporate; March 2009

• Reducing the Cost of Freedom: Wireless Expense Management; January 2009

• Mobility Management: Does Outsourcing Make Sense?; December 2008 • An Opened Door: Enter the New Mobile Enterprise Platforms;

November 2008

• You Can Take it with You – Enterprise Mobile Messaging & Collaboration; October 2008

• Enterprise Mobile Messaging and Collaboration Impacts Work / Life Balance; October 2008

• Google Android and Chrome: Pay No Attention to the Robot Behind the Curtain; October 2008

• It's Nothing Personal: Taking Control of Corporate Mobile Devices; September 2008

• GRC for Mobility: Are Enterprises Prepared for the Tipping Point?; April 2008

• The Aberdeen Report 2008; April 2008

Information on these and any other Aberdeen publications can be found at www.aberdeen.com.

Author: Andrew Borg, Senior Research Analyst, Wireless & Mobility andrew.borg@aberdeen.com

Since 1988, Aberdeen's research has been helping corporations worldwide become Best-in-Class. Having benchmarked the performance of more than 644,000 companies, Aberdeen is uniquely positioned to provide organizations with the facts that matter — the facts that enable companies to get ahead and drive results. That's why our research is relied on by more than 2.2 million readers in over 40 countries, 90% of the Fortune 1,000, and 93% of the Technology 500.

As a Harte-Hanks Company, Aberdeen plays a key role of putting content in context for the global direct and targeted marketing company. Aberdeen's analytical and independent view of the "customer optimization" process of Harte-Hanks (Information – Opportunity – Insight – Engagement – Interaction) extends the client value and accentuates the strategic role Harte-Hanks brings to the market. For additional information, visit Aberdeen http://www.aberdeen.com or call (617) 723-7890, or to learn more about Harte-Hanks, call (800) 456-9748 or go to http://www.harte-hanks.com. This document is the result of primary research performed by Aberdeen Group. Aberdeen Group's methodologies provide for objective fact-based research and represent the best analysis available at the time of publication. Unless otherwise noted, the entire contents of this publication are copyrighted by Aberdeen Group, Inc. and may not be reproduced, distributed, archived, or transmitted in any form or by any means without prior written consent by Aberdeen Group, Inc.

Mobile Device Management: