The Enterprise Guide to Developing Secure Mobile Apps

(1)

The Enterprise Guide to

Developing Secure

Mobile Apps

(2)

About This Guide

Mobility is here and it’s transforming businesses across every industry, in every part of the world. For enterprises that have traditionally relied on monolithic legacy applications, the transition to mobile can introduce several challenges that come with navigating uncharted mobile territory. For instance, how do you decide which apps and functionality to deploy first, and how do you find the right resources and best practices to support your mobile goals?

To help you succeed on your mobile journey, this guide outlines essential best practices and recommendations across all four stages of the mobile app lifecycle: Design, Develop, Deploy, and Maintain. It’s ideal for organizations that are ready to move beyond enabling basic apps, such as email and calendar, on mobile devices. It also provides operational guidance for deploying and maintaining existing mobile apps.

(4)

Mobility is driving a massive enterprise culture shift, one that has radically altered the needs and expectations of employees and fundamentally changed the role of both the enterprise user and IT. Employees are no longer passive recipients of IT-issued hardware and software. They are extremely adaptive, enthusiastic, and demanding mobile users who have tremendous influence over the technologies they use for work.

In addition, as more companies adopt the rapid mobile application development (RMAD) model, they are looking beyond IT to acquire the business apps they need. Lines-of-business (LOB) no longer require (nor can they wait for) highly specialized programmers to build mobile business applications. Instead, mobile app development is shifting to a self-service model that extends app development to more people without traditional programming skills.

Move at the Speed of Mobile

Shifting from linear to agile app development

As a result, mobile innovation is driving enterprises to move beyond the linear, legacy app development model. Large-scale, year, multi-million dollar app deployments simply can’t support the rapid pace of business as well as the highly agile and less expensive mobile app development lifecycle can. To stay in the game, companies of all sizes, in every industry around the world will need to adapt to the new reality of mobile business computing.

Embracing mobility takes planning, however. Your organization can’t simply port PC enterprise apps to mobile devices. In fact, IT should no longer think of building “enterprise apps” at all. In the mobile enterprise, it’s all about building consumer apps for employees. Your employees are already using powerful, well-designed mobile apps for personal business, and many of these are great examples for IT organizations to model. Although they have different functions, effective mobile apps all share these characteristics:

• Lightweight and highly intuitive for the end user

• Fast and easy to develop and download (even on a cell network) • Able to stand alone without constant backend connectivity • Simple and provide only a few essential features and functions Now let’s look at how to build mobile apps, and what you need to get started.

(5)

How do I make sure my

apps integrate with our

backend resources?

The answer is to automate integration as much as possible. Instead

of figuring out the integration requirements for each app, you should build a shared services layer that makes it easy for developers to use just a few lines of code to connect to resources such as backend data systems and security features such as single sign-on (SSO) and encryption. This accelerates the app development process and ensures critical security features are embedded in every app. Automated integration also has economic benefits because it can drastically reduce mobile app development costs and time-to-deployment.

How can I successfully

deploy mobile apps to

make sure they get to the

right people?

First, relax. You don’t need your entire organization to adopt the new app all at once. Once your app is ready for deployment you can develop a phased plan for delivering your app to its intended users. Remember that mobile users are accustomed to smooth app delivery experiences on public app stores, so your enterprise app store should deliver a similar experience — all while enforcing your corporate security policies.

How do I encourage broad

user adoption?

The success of any mobile app is determined by whether or not your users adopt it. Your first mobile development project must enable a compelling, daily productivity function, such as conference room scheduling, or a compelling business function, such as package tracking in a logistics environment. It should also provide an instant out-of-the-box user experience. This means the app needs to be fast and easy to use on the employee’s preferred device with little to no training required.

When should I start testing

my apps and how often?

The need for mobile app testing is often underestimated. There is no one-size-fits-all testing tool for mobile apps because there are so many factors to consider. For example, you must test how mobile apps perform under a range of conditions, such as battery failure, offline, across multiple form factors and operating systems, on Wi-Fi or cellular networks, and so on. Because mobile apps must perform in extremely complex situations, the answer is to start testing your apps early and often, using all the hardware platforms and form factors you will support. Continuous testing is also important to account for industry technology changes that can impact the app, such as new OS releases.

1.

2.

3.

4.

To learn more, see Step 1: Build an

(6)

Build a Powerful App

Design Strategy

As you begin your mobile app journey, it’s important to remember one thing: There are no shortcuts to building great apps. You must have a structured development approach so you don’t end up with apps that are hard to use, difficult to support, vulnerable to malware, and cost too much to upgrade. By taking a thorough approach to each phase of the mobile app lifecycle, you can start to build a solid foundation for your overall mobility program.

You must have a structured

development approach so you

don’t end up with apps that are

hard to use, difficult to support,

vulnerable to malware, and cost

(7)

Phase I: Design

Step 1: Know Your Mobile App Maturity Level

Assessing your organization’s mobile app maturity level is the first step to understanding whether or not you’re ready to build and

leverage mobile apps today. More importantly, it helps you identify the resources and processes you need to advance to the next level.

DEVE_LO P DESIG N M AIN TAIN DEPL OY Level 1: Unmanaged

IT is completely hands off but needs to assert more control over apps developed by other departments within the company.

Level 2:

Structure forms

IT gets involved and offers some basic recommendations for app development, but still needs to delineate roles and responsibilities within the development process.

Level 4:

Collaborative approach

Mobile IT advances to the next level by building a collaborative app development environment with developers and businesses. Advanced app management capabilities are deeply integrated with enterprise resources. Level 3:

Established foundation This is the recommended minimum level to start. IT has established and published app development standards and guidelines for developers. In-depth documentation is also available to guide the process.

Level 5: Predictability

Automation supports advanced management and reporting capabilities. Level 1 Ad Hoc Level 2 Repeatable Level 3 Defined Level 4 Managed Level 5 Optimized

Enterprises that remain below Level 3 typically fail to maximize their mobility program potential.

(8)

Most companies today are somewhere between Level 1 and 2, on the cusp between chaos and basic structure. Organizations should strive to achieve and maintain Level 3 with an established foundation that guides the app development process for both in-house and third-party developers.

Step 2: Establish a Mobile Center of Excellence

No IT organization can develop apps in a vacuum. You have to bring together all enterprise stakeholders (including executives, HR, finance, and LOB managers) to establish ground rules, needs, expectations, and criteria for success. This group may also be formalized into a Mobile Center of Excellence (MCOE), which is comprised of key people from different business areas who specialize in identifying and developing mobile solutions quickly. Since usability is critical to mobile app adoption, you should consider adding UI and graphic design experts who specialize in mobility.

An MCOE is a must-have for any company looking to make mobility a strategic part of the business, and should be established early in the mobile development process.

Step 3: Identify the “Minimum Viable App”

If your IT organization is just beginning the mobile app development process, the most important thing to remember is to keep it simple. If you try to deliver a robust, full-featured mobile app and your effort fails, it will be extremely difficult to win back the trust of end users on future projects.

The key to success for all mobile apps is gaining user support and adoption. Your first mobile development project must enable a compelling, daily productivity function, such as conference room scheduling, or a compelling business function, such as package tracking in a logistics environment. It should also provide an instant out-of-the-box user experience. This means the app needs to be fast and easy to use on the employee’s preferred device with little to no training required.

Once you’ve identified your app’s core functionality, you will need to have these infrastructure components in place to ensure it will work the way it’s intended:

• Device information: Determine device details such as the mobile OS and version, orientation of device, battery level, and more.

• Connectivity: Which backend resources will the app connect to, such as Salesforce, SAP, or Oracle? Will you need things like certificates and open firewall ports?

• Common functions and conversions: Be sure to integrate functions such as time zone management, date and currency formats, etc.

• File encryption and decryption: Put standardized methods into one framework to mitigate human error.

An MCOE is a must-have for any company

looking to make mobility a strategic part of the

business, and should be established early in

the mobile development process.

(9)

• Authentication: Provide SSO for mobile apps that are signed with the same developer certificate. This allows developers to access hundreds of backend systems with just a couple lines of code, and protects credentials such as certificates, passwords, and usernames on devices.

• Developer testing tools: Always test app connectivity and

performance across mobile platforms and form factors before going live.

• Timeframe: If the app can’t be rolled out within three to six months, consider narrowing your requirements or features.

Step 4: Find the Best Development Resources

Leverage existing relationships, if possible. Ideally you will have development contacts with people you already know and trust. If they currently work with your organization, you can save time since they will likely be up to speed on your existing infrastructure, security policies, rules, and other requirements.

Sub-contract: If you have to involve a third-party, don’t leave the hiring decision to others. Be involved in the evaluation process from start to finish. This is key, especially in an industry where mobile development experience is in extremely high demand. You want to be sure to have the most qualified people working for you. Review their app portfolios to understand their experience and capabilities and ensure they map to your requirements and guidelines.

Establish ownership: This might sound obvious, but make sure you specify that all your corporate IP and data that is collected in the app, as well as the app itself, will be owned by you. This legal clarification is usually specified in the contract.

Gather analytics: If possible, find out if your developer can provide metrics such as app performance, how it’s connecting to the backend, recording logs, and usability.

Step 5: Establish Infrastructure Support

After your apps apps are built, you need a way to distribute and secure them. This will require a platform from an enterprise mobility management (EMM) provider that allows you to leverage features of different mobile operating systems and securely manage all of your devices and apps. You will also need to choose an EMM provider with a broad partner ecosystem. Consider the provider’s leadership position: Does the company support multi-OS, maintain a global services

(10)

Phase II: Develop

Once you’ve established a working stakeholder group or MCOE, identified the requirements for a minimum viable app, and created a pool of preferred developers, you’re ready for Phase II: Develop.

Step 1: Build an “App Factory”

Your IT organization can provide tremendous value to everyone who builds apps for your company, including internal business units and external developers. IT can streamline this process by building an “app factory” with all the infrastructure and tools needed to build, deploy, and upgrade apps in a way that’s consistent, secure, and supportable. Your “app factory” or toolset should prioritize three key areas:

1. Focus on mobile solution development, not just apps. Your mobile strategy is about more than just writing code. You have to look at the whole ecosystem that supports your mobile strategy. Identify which standards, SDKs, APIs, and Common Libraries best support your business requirements. Then create an online knowledge base and mobile app playbook that includes best practices, code samples, and recommended tools to accelerate app development.

2. Build a mobile platform layer. Simplify the development process by abstracting much of the development work from the underlying complexity. Build a platform that enables rapid app development and more consistent apps through a shared services layer that includes guidelines for authentication, security, data protection, SSO, encryption, content management, and more.

3. Be ready to adapt to changing technology and business needs.

Mobile success is all about the ability to quickly adapt to new challenges and opportunities. Although your organization should have a strong foundation for mobile development, you also want to be flexible enough to leverage new technologies and respond to changing market conditions.

DEVE_LO P DESIG N M AIN TAIN DEPL OY

Instead of building each app from

the ground up, IT can build an

“app factory” or ready-made developer

toolset that streamlines and accelerates

(11)

Step 2: Choose an App Type

Based on your app requirements, you will need to decide whether your app will be a web, hybrid, or native app. Determining the app type requires you to first understand the target user experience, the environment in which the app will be used, and whether or not you have the skills and resources available to deliver an app that meets these requirements. For example, if you need an app that provides detailed mapping and you have the developer skills to create it, a full native app may be the best choice.

The important thing to remember is that most large companies will likely use all three apps at some point. You should have a good understanding of the pros and cons of each app type in order to make the most informed decision. Don’t try to shoehorn your technology choices into a preconceived scenario. First understand the user experience you need to provide, and then determine the best technology to support it.

Guidelines for selecting each app type include:

• Web app: This may be the best option if the app needs to be available on multiple platforms, devices, and browsers. Apps that don’t need to reside on a device or be distributed through an enterprise app store can also be built as web apps. These apps are accessed only through a web browser.

• Hybrid app: Like web apps, hybrid apps need to run across platforms, devices, and browsers. However, they also need to reside on a device, with their own icon, and be distributed through an enterprise app store. A hybrid app is similar to a native app, but it uses web technology to make it more portable and easier to update. A simple way to think about this is that the application uses a native frame around HTML code.

• Native app: Native apps are device-specific and must be downloaded from an enterprise or consumer app store. They also have to be able to run offline, so they require offline storage and access to all of the device’s features.

Choosing the Right App Type

Knowing which type of app to use depends on which is more important: user experience or portability. Here are two questions to help you decide:

Do you require a rich user experience and workflow?

If the answer is yes and you have more sophisticated requirements, then choose a native app to encourage broad user adoption.

Does your app need to be portable and have connectivity?

If your requirements are relatively simple and portability is more important than the user experience, then a web app will suffice. A hybrid app is also a good choice because it provides some support for both the user experience and portability — capabilities that will likely expand in the future.

Web

Native Hybrid

(12)

Step 3: Decide Which Platforms to Support

To determine which mobile operating system(s) to support, review email and device statistics from your EMM provider to identify which systems and devices your employees use most. At first, it’s often best to support the most widely used device platforms, and then expand as your mobile program matures. It’s better to succeed at supporting fewer device types and operating systems than to go too broad too quickly. Also, consider the costs vs. benefit of supporting more than one platform at first. Do you have enough users on multiple operating systems to justify the development and support costs?

Step 4: Don’t Forget Your Stakeholders

In the legacy model of enterprise computing, it’s not as critical to get feedback and guidance from internal stakeholders across the company. That all changes in the mobile enterprise. Regular meetings with stakeholders or your MCOE are essential to the success of your mobile initiatives. They will help you determine what is and isn’t working so you can improve the outcomes of future projects.

Step 5: Measure Results

While it’s important to report on development issues such as bugs, you also have to focus on the big picture — the business value of your apps. For example, you should be able to quantify how much your apps contribute to top-line growth, efficiency or productivity, and employee satisfaction. You should also track which mobile apps employees use most, as well as the most popular features within those apps. With this feedback you can develop a more engaging and productive app experience.

(13)

Top Five Mobile App Traps to Avoid

1. Don’t make security an afterthought.

Be sure to build in security right from the start, keeping in mind that the security features of mobile architectures differ greatly from the standard firewall-protected network. Understanding how to enable secure data access on mobile devices (by supporting certificate-based authentication, for example) will be critical to protecting your enterprise data across the mobile app lifecycle. Second, remember that most app developers are not security experts. Your IT organization needs to take responsibility for security and provide the right tools and training so developers can meet your security requirements.

2. Don’t assume desktop apps will work on mobile devices.

Instead, design your apps with two goals in mind: driving user adoption and improving business competitiveness. Some organizations simply try to give mobile users remote access to existing apps, but quickly realize this is not a viable approach. Gaining user adoption requires well designed mobile apps, not keyboard-based apps delivered to an iPad. Also, think of the move to mobile as a great opportunity to retool your business processes. You can eliminate what isn’t working, improve upon what does, and incorporate these learnings in leaner and more efficient mobile apps.

3. Don’t ignore the data model.

Avoid building mobile apps that require large data transfers or depend on continuous backend connectivity. Apps that try to download megabytes of data at regular intervals can degrade the user experience, especially if the data is not transferred quickly or if the app fails to download the entire data set. If you use the wrong data model, the app experience will suffer. If users have to wait too long for data to load, they will simply give up and abandon the app.

4. Avoid uncommon app creation tools.

Steer away from tools that use unsupported libraries or code that is specific to a particular platform or operating system. Otherwise, your apps may be very difficult to support once they’re deployed.

5. Don’t underestimate app testing

.

Be sure to test your mobile apps early and often, and always assume they will run on different devices — even if they are on the same operating system. For example, an app may run perfectly on Android 4.x running on a Galaxy X device. However, if the app is deployed on the same OS version but on a different device model, the UI may not function properly. You should also test app performance under various circumstances. For instance, what happens to app data if the device battery fails? Skipping these critical testing steps may seem to save time in the short run, but can add developer cycles down the road (and seriously frustrate your users).

(14)

Phase III: Deploy

Once an app has been developed, tested, and approved, it’s ready to be deployed across the organization. This phase requires the tools, processes, and expertise to ensure a successful rollout. Keep in mind that you don’t need the entire organization to adopt the new app all at once. Even for apps that will eventually touch everyone, you can do a phased rollout, which allows you to:

• Gauge success and recalibrate your approach as you go.

• Reduce the number of workers impacted if there is an unforeseen issue.

• Minimize strain on your help desk and support staff.

• Build some hype for each app by word of mouth among employees. The first step is to develop a detailed plan for delivering all the required apps to their intended user populations. Remember that mobile users are accustomed to smooth app delivery experiences on public app stores, so your enterprise app store should deliver a similar experience — all while enforcing your corporate security policies.

Five Mobile App Deployment Best Practices

1. Develop a Mobile App Policy

The intent of a mobile app policy is to define app whitelists and blacklists so employees have clear guidelines about acceptable apps. This can help prevent potentially malicious or inappropriate apps from creating problems for your business. You can also inform employees about why certain apps are allowed or disallowed to gain internal support for these guidelines.

2. Create and Manage App Store Accounts

Many employees already have personal app store accounts, and often prefer to use them for business app downloads as well. You will have to decide whether your corporate security policies will allow employees to use a single personal account for all app stores, or if you will need to set up a corporate account for your enterprise app store.

3. Plan Distribution Groups

Remember: relevancy matters. You need to have the right

management tools to ensure users can access the apps they need based on their role and device type. For instance, you don’t want to deploy Android apps to iPad users or accidentally allow marketing interns to access your accounting department’s financial apps.

4. Establish Metrics

Mobile app metrics measure both individual and collective app usage. This allows admins to collect data on app usage across the entire deployment as well as on individual mobile devices. This data can be used to improve future apps and better serve the needs of your users.

5. Simplify the User Experience

As mentioned previously, establishing user trust is critical to

(15)

maintaining a successful mobile program. A great user experience accelerates mobile adoption, improves productivity, and increases job satisfaction. To deliver a great mobile experience, you should: • Automatically install and update apps on devices, with no user

intervention needed.

• Pre-populate app configuration fields.

• Configure secure access to all corporate resources, such as Wi-Fi, email, and VPN.

You should also have a variety of tools, such as self-service portals, FAQs, training, and education resources that help users quickly solve problems and engage IT only when necessary. Fortunately, mobile users are already accustomed to self-service tools and processes, which can significantly reduce IT and helpdesk inquiries if done well.

A Great Mobile App Experience Depends

on Great Content

Delivering the content users need, when they need it is essential to a great app experience. Managing content on mobile devices requires an approach that leverages the capabilities and advantages of mobile platforms, which is different from content management systems for desktop computers. For example, mobile device limitations such as storage, network throughput, slow processors, and smaller screen real estate all pose challenges to managing and delivering content at a scale comparable to desktop computers. In addition, you need to consider bandwidth utilization costs, roaming status, network access, and device and software versions when developing and distributing content to mobile devices.

For corporate content that is delivered and stored on mobile devices, appropriate security and management controls must be in place to protect data in motion and at rest. Access controls on mobile content for delivery, updates, management, and deletion are necessary and must be part of the solution.

(16)

Five Mobile App Content Management Best Practices

1. Reformat Video, Photo, and Other Media Files for

Mobile Devices

Mobile apps may be used to deliver content that has already been created for platforms with larger screens such as desktops and laptops. To effectively deliver this content to mobile devices, you need to reduce file sizes and bandwidth requirements for content such as video, photos, and other media.

2. Decouple Content from the App

While optimizing file sizes is one way to reduce download times and bandwidth costs, you can also remodel the app instead of the content. This approach decouples the content from the app and delivers them separately to the device. Instead of packing content into an app and delivering it all at once, the app is first delivered to the device and then the content is distributed through a separate process. After the app is installed on the device, it manages the delivery and maintenance of content. This approach also makes it easier to manage and control content at a more granular level. Individual components can be added, deleted, or modified without the need to update and deliver a massive app every time a change is made to the underlying content.

3. Optimize Data Synchronization

Efficient content delivery and updates can save substantial time and money in data network utilization and lost productivity during file transfers. For large

resend the same information to the device. For example, when mobile email is first configured on a device, the initial data load may take some time while the mailbox contents are downloaded to the device. Afterward, only new items are sent and received by the device, reducing the amount of traffic and resources required.

4. Use HTML5 Where Appropriate

HTML5 continues to improve and expand its functionality, which makes it easier to deliver and manage content through a browser using web services. HTML5 can significantly reduce development costs, offer universal browser access and cross-platform support, and simplify content updates. For example, Google and Yahoo currently deliver full-featured apps based on HTML5. You will need to review your specific content management and app requirements to determine if HTML5 is an adequate solution or if you will still need native and hybrid apps.

5. Use eCommerce Methods for Content Delivery

eCommerce methods can also be used to provide access to content, products, and

services. For example, retail or manufacturing companies can use e-commerce apps to deliver real-time information on inventory, status, and availability because content is updated constantly and information is accessible on demand. By utilizing efficient data caching and synchronization methods, the need for a constant data connection can be mitigated in areas with intermittent data coverage. For apps that require specialized content, such as

(17)

Phase IV: Maintain

In the final phase of the mobile app lifecycle, the primary role of mobile IT is to increase user adoption as well as support, maintain, upgrade, and eventually retire mobile apps. Management tools consist of app control policy, app distribution management, and self-service resources for end users. In the mobile app world, ongoing testing becomes an important part of this phase when OS changes and new devices are launched.

App Control Policy

App Control Policy management includes functions such as whitelisting and blacklisting, specifying whether apps are recommended or

required, and automating security measures when devices fall out of compliance. IT will need to create clear guidelines detailing acceptable app use to educate users about corporate expectations and policies.

(18)

Renewing iOS Apps

The iOS app renewal process can be fairly complex, but here are some key practices to follow to ensure you don’t miss any crucial steps:

• Establish processes and procedures for managing the app software repository, code signing, and app versions.

• Develop a plan to manage the annual renewal of provisioning profiles and the three-year renewal of iDEP distribution certificates.

• Consider using a universal provisioning profile.

• Line up resources and start the app renewal process early. • Update apps on a regular schedule.

• Develop a communications plan for app upgrades and distribution.

• Include data management and retention in your application lifecycle management plan.

App Distribution Management

App Distribution Management involves the processes of distributing, upgrading, and retiring apps at the end of their business life. For iOS apps, organizations must follow an annual renewal process. Finally, when apps are retired from the system or removed from devices, organizations must follow secure data handling procedures to ensure all corporate data and access is removed from the device.

Self-service and Troubleshooting

Mobile users are accustomed to finding the information they need, when they need it to troubleshoot app problems. To control help desk costs and meet employee expectations, IT should first make the app deployment and update process as seamless as possible. When questions or problems do arise, mobile users should be able to quickly access troubleshooting guides that enable them to resolve problems quickly.

(19)

Meeting the demands of a constantly changing business environment and tech-savvy employees requires IT organizations to do more than put email on mobile devices. Your organization must become a strategic mobility leader capable of transitioning your enterprise from legacy

PHASE II

PHASE III

PHASE I

PHASE IV

• Know your app maturity level.

• Involve stakeholders and establish an MCOE.

• Identify the key components of a successful mobile app. • Find the development resources that best meet your

requirements.

• Shore up your mobile support infrastructure.

• Establish clear app control policy guidelines. • Follow best practices for adopting, distributing,

upgrading, and retiring apps.

• Follow the app renewal requirements for each platform (Android, iOS, etc.).

• Simplify the user experience with self-service and troubleshooting resources.

• Build an “app factory” toolset to simplify and accelerate the development process.

• Decide whether your app will be a web, hybrid, or native app.

• Choose which mobile platforms to support first. • Meet regularly with your MCOE or stakeholder group. • Continuously track and measure results.

• Develop a mobile app policy.

• Create and manage app store accounts. • Plan distribution groups.

• Establish metrics.

• Simplify the user experience.

• Incorporate content management best practices.

DEVE

_LO

P

DE

SIG

N

M

AIN

TAIN

DE

PL

O

Y

to lightweight mobile apps. Using the recommendations outlined in this guide and summarized in the graphic below, you will be well on your way to establishing a flexible and cost-effective mobile app development program.

(20)

The Enterprise Guide to Developing Secure Mobile Apps