Why MDM May Save IT from Consumerization

#Mobile convergence may drive demand for #VDI and other less invasive technologies

When you’re traveling you carry devices. I’ve got my smart phone, of course, to keep connected via e-mail and text and, if need be, voice. But I also carry my tablet and the old stand-by, my laptop. Because writing a blog post on my tablet or smart phone just isn’t my thing. While status updates and tweets are easy enough to compose on such constrained-size keyboards, I (and many others) need a full keyboard to really crank out the copy.

But when I’m wandering around a conference it’d be nice to be able to focus on just one, which is where convergence comes in. My phone is a corporate resource, completely managed by our more than able IT department but the tablet? That’s mine (well, and the Little Man who’s in charge of our household at the moment).

So while traveling out to Cloud Connect I tried to set up access to my corporate e-mail account on my tablet. It’s a Samsung Galaxy Tab 10.1 and it’s an Android device. It supports standard e-mail access via POP3 and IMAP – I already have my Gmail and personal accounts connected – but it also, apparently, supports Microsoft Exchange ActiveSync which supports hundreds of devices. It’s through ActiveSync that our growing iPhone using population accesses e-mail when they’re on the road. So I thought I’d give it a try.

It worked like a charm, until I got to the warning part.

HYPER-STRICT SECURITY

That was the part that gave over complete – and I do mean complete – control to the fine IT folks at headquarters.

The list of actions required to be allowed would not be surprising (and indeed are not) when applied to a corporate managed resources, like my Blackberry. But when I read through what I had to allow administrators to potentially perform on my device, I had second thoughts.

It all makes perfect sense. If I’m going to have corporate e-mail messages, which in addition to their sensitive nature often times include attachments that have even more confidential data – product roadmaps, marketing strategies, detailed internal discussions on functionality and features – then it would be necessary to follow best practices like locking the screen with a password and requiring stored data to be encrypted.

I stopped right there. Not because I didn’t think it was good practice and a requirement, but because my four year old routinely uses my device. He’s quite adept at getting around on an Android device (I’ve finally managed to teach him to ask before installing or buying new games) and while he occasionally deletes items – permanently and purposefully – generally he’s a good steward of the technology while he’s using it.

But can he learn to enter a password that may be required (and forced on the device) by IT administrators? And even if he could, is that even acceptable? The rule is never share your password, and perhaps in today’s increasingly consumerized IT that should be amended to “especially not with your four year old.”

And what if I allowed the administrator to do these things – require a password with a complex rule – and then the young man tried to access it without my presence? Sure, he always asks before he uses it today, but tomorrow? This is a child, we’re talking about. What if he grabs it and tries to unlock it – and fails? Would IT automatically delete everything on the device, as I’ve granted them permission to do?

And would IT be willing to talk him down from the hysteria when he realizes every one of his games has been deleted remotely?

I’m guessing not.

AT an IMPASSE

And so I hit “cancel”, because ultimately I wasn’t willing give over that much control and suffer the potential “damage” just for the convenience of converged e-mail. Then I considered what that meant. I am perfectly fine with the same control over my corporate owned and issued resources – my laptop, my Blackberry – but not my own, personal mobile device.

The hyper-security policy scared me away from using a personal, consumer grade device because they wanted to turn it into an enterprise-grade device.

I spent much of the rest of the flight wondering if VDI was the solution to this problem. It effectively sandboxes corporate resources within an enterprise-grade container and they can do whatever they want to it without any impact on my device. But not all VDI solutions are equal – and most assume connectedness, which is not entirely compatible with the on-again off-again nature of roaming, mobile devices when on the road.

Certainly a less invasive MDM policy would also suffice (I’m sure administrators can pick and choose which actions they want to be allowed) but that would defeat the purpose of managing the device in the first place. If they can’t secure the corporate data that might be on my device, in a way that’s compliant with corporate (and potentially industry and government) policies, then there’s no point in offering the option.

We’re at an impasse, it seems.

And maybe that’s not necessarily a bad thing. If overly strict security policies are required in order to access something as simple as e-mail and users are scared away by the potential wiping of their device, maybe that’s a good thing. Corporate resources are kept secure and one less headache (managing yet another device) is averted until we can come up with a solution that balances the need for security with the need for me to ensure games like Yoo Ninja and Tank Hero don’t inadvertently end up in the trash bin.

Ultimately there will be a solution that does just that – a combination of a secure storage vault on the device, managed exclusively by IT, in which e-mail – and other resources retrieved via secure remote access solutions – can be encrypted and managed as per their specific security needs. And that area can be protected by specific passwords and strength policies and wiped at a moment’s notice – without disturbing the all important Reading Monster or Captain America.

But that technology doesn’t yet exist, though the need certainly does. Trusting that the old adage¹ continues to be right – that necessity is indeed the mother of invention – I’ve no doubt someone will come up with that technology in the near future.

¹The source of this idiom is apparently hotly contested – Plato, Whistler, and Victor Hugo are all cited as being the source.

Published Feb 27, 2012

Version 1.0