Hide Notes 

Slide 1: Mobile Device Management John Rhoton Hewlett Packard john.rhoton@hp.com
Slide 2: What is MDM? • Automation ● ● User configuration Administration • Standardization • Remote Support ● OTA (Over-the-air)
Slide 3: Agenda • Enterprise Mobility Status • Enterprise Challenges ● ● ● Security Management Applications • Mobile Device Management Approaches • Mobile Device Management Technologies
Slide 4: But just what is mobility ? Devices: • Mobility = Mobile phones? • Mobility = Smart phones? • Mobility = PDAs ? Wireless: • Mobility = Wireless LANs? • Mobility = GSM/GPRS? Applications: • Mobility = Form-factor adaptation? • Mobility = Synchronisation?
Slide 5: Mobility on the rise! 35 30 25 20 15 10 5 0 Source: Gartner Dataquest, and IDC 2006 34.1% Converged Mobile Phones 245 Million converged devices by 2010 •140 Million Windows Mobile devices •Over 3 Billion mobile subscriptions 18.6% Mobile PCs YOY % shipping growth 5.8% Mobile Phones 3.9% Desktop PCs 2006-2010
Slide 6: Status of Mobility • Components Maturing ● ● ● Exponential growth in mobile devices Near-ubiquitous wireless access Application mobilization accelerating • Hype transforming into stealth • Enterprise adoption ● ● Organic Consumer-driven
Slide 7: What customers typically want from mobility Forms Sheets Workflow Mobile Business Applications •Industry specific applications (i.e. Mobile construction workforce…) •Field Sales Automation (SFA) •Field Force Automation (FFA) •Paperless Forms (Police Force…) •Proof of Delivery (Transport) •Field Service Bundle •Work Order Mgmt •Parts & Inventory tracking •Expense Management •Asset / Property Management •Merchandizing / FMCG Sales •Healthcare, Public safety •Inspections, Data Capture •Unified Communications – Fixed Mobile Convergence •Mobile office (Mail, PIM, Calendar) (Baseline) •Mobile device management (Baseline) •Mobile Device security (Optional) •Shared Mobile Device Management (Baseline) •Shared MDM Device security (Optional) •End 2 End security (authentication, encryption, protection…) 7 HP Confidential Messaging Legacy - Animated (0)
Slide 8: Mobility: Challenges
Slide 9: Mobile Content Protection Access Control Solutions • • • • • • • • Native Pocket PC Biometric Authentication HP ProtectTools Pointsec Credant TrustDigital Utimaco Bluefire
Slide 10: Bluetooth In security
Slide 11: WLAN security • Rogue Access Points • Decoy Access points • WPA-Personal • WPA-Enterprise
Slide 12: Why MDM? • • • • Security: Ensure integrity of configuration Higher ease-of-use Deploying line-of-business applications Lower TCO December 24, 2009 12
Slide 13: Reduction in Total Cost of Ownership Cost per User per Year Device Cost Connectivity data Connectivity voice Backend/Ops Service Management User Support $250 $900 $800 $504 $192 $312 $2958 8% 30% 27% 17% 6% 11% 100% -30% -40% -30% -11% -$151 Setup & operate backend mobile application, change requests -$77 Setup users, connectivity, user management, change requests -$94 -$322 MDM Benefit Amortized over 2 years Cost reduction per user per year with MDM $322 Net Reduction in TCO 11% Net Reduction in Annual Device Management Costs 32% Source: HP & Gartner
Slide 14: Customer MDM Maturity Levels • Infancy ● ● Inventory collection Basic software updates Software Updates Configuration Control Device Security Enforcement Data publication and synchronization Multi-platform support Policy driven application install and update “OTA” startup and maintenance Extension of Desktop Management ** 14 • Adolescence ● ● ● • Mature ● ● ● ● ● December 24, 2009
Slide 15: Different MDM Approaches • Extension of Desktop Environment ● ● ● Altiris Microsoft SMS HP Client Automation Exchange 2007 Good ● ● • Comprehensive Solution Suite ● ● Intellisync RIM Blackberry • Enterprise MDM Focused ● ● ● iAnywhere Afaria HP Enterprise Mobility Suite Microsoft System Center Mobile Device Manager • Carrier MDM December 24, 2009 15
Slide 16: OMA DM Standard • Device Management protocol: ● ● ● ● Defined by the Open Mobile Alliance (OMA) group Current specification : 1.2 – April 2006 Based on SyncML Conceived for Carrier MDM Device Provisioning (1st time use) Device configuration – Enabling/Disabling features Software distribution – Firmware upgrade over the air (FOTA) » Firmware Update Management Object (FUMO) – Applications deployment on devices – Software upgrades • Designed for management of mobile devices ● ● ● ● Fault Management: report/ query status
Slide 17: HP MDM Logical Topology Internet via Wireless Wan or Wireless LAN Networks Neutral Zone (DMZ) Customer Enterprise Network VPN or Proxy or Firewall hole Domain Licensing site MDM Server(s) (i.e Afaria) Authentication Internal WLAN or Cradle December 24, 2009 17
Slide 18: Scalability: Replication & Server Farms DEV TEST MASTER GEO 1 CLUSTER GEO 2 CLUSTER •Server Farms provide scalable capacity •Replication provides a logical master server, with many physical instances •Replication also facilitates division of ownership of functions; Multiple owners can maintain portions of the total server (eg. IT owns base configuration; Business Units own their applications & data.) December 24, 2009 18
Slide 19: Device Management Technologies • Afaria ● ● ● XcelleNet, Sybase, and now iAnywhere Mobile Device Management and Mobile Security Solution Historically market leader in Managed Mobility Solutions Formerly Bitfone OMA-DM interoperable Heterogeneous (multi-platform) device set Integration with OVCM (OpenView Configuration Manager) Compliant with OMA DM Mobile Device Management solution (System Center family) Based on Windows infrastructure: AD – SQL Windows Mobile 6.1 devices only • HP Enterprise Mobile Suite (EMS) ● ● ● ● • Microsoft SCMDM ● ● ● ●
Slide 20: iAnywhere Afaria Connectivity Management Capabilities Inventory Management Software and Application Deployment Document and Content Management Process Automation Data Backup and Recovery Configuration Management TCP/IP Wireless WWAN HTTP, HTTPS, ISA Dial-up LAN or WLAN Afaria Server Features Console Highlights Web Administration SNMP Alerts Console Status and Event Logs MS NT 4.0/2000/2003 Unlimited Clients Highly Scalable Device and Data Security LDAP & NT Domain User Authentication Channel Replication Afaria Mobile Clients Windows Laptops Java WinCE/Pocket PC Palm Blackberry Symbian ESM Integration Enterprise Integration Microsoft SMS Software & Mobile Optimizations Inventory Compression Check-Point Restart Byte Level Differencing Segmented File Delivery Opportunistic Execution Safe File Transfer Encryption December 24, 2009 Web Server 20
Slide 21: Inventory December 24, 2009 21
Slide 22: Server “Channels” December 24, 2009 22
Slide 23: Channel Sets December 24, 2009 23
Slide 24: Script Commands December 24, 2009 24
Slide 25: HP Enterprise Mobility Suite Enterprise • Intranet • CRM • Application Portal HP Worldwide Hosting Facilities FOR ENTERPRISE • Exchange® • Domino® • Groupwise® HTTPS HTTPS • Device Support • S/W Maintenance • WW Network Support • Corporate Directory • Active Directory ® Existing IT Systems FusionDM for Enterprise • Device Troubleshooting • Device Security • Policy Mgmt • Asset Mgmt • IT Dash Board Internet HTTPS Leading OEM Device Manufacturers P P/I TC S SM SM S TC P/I P HP Enterprise Devices WW Wireless Operator Networks
Slide 26: Self Care Driven
Slide 27: Use Case: Set Up My Device • Out-of-the-box device setup • Employee Joe purchases a new device ● ● ● Logs into the Enterprise Self Care portal Enters his phone number Selects setup my device • Joe’s email, ActiveSync, and corporate WiFi settings are automatically configured on the device • Automated OTA Delivery Without Cradle • Simple One Click Trigger for Setting Up New Device • Minutes to Fully Configured, Ready-to-Use Device
Slide 28: Use Case: Diagnose My Device • Device Diagnostics • Joe’s email is not working ● ● Selects diagnose my device Problem is automatically displayed • Activesync settings are incorrect ● Selects the checkbox & presses go • Joe’s ActiveSync settings are corrected and he is receiving his email • Instantly Validate All Device Settings • Automatically Detect Device Faults • OTA Push Fixes to Address Root Causes
Slide 29: Use Case: Update Software • Joe needs the new VPN client ● ● ● ● Selects Update Software Device inventory is remotely List of required applications are displayed Selects the checkbox for VPN & presses go • VPN application is automatically installed • Instantly distribute corporate tools and applications and their updates OTA • Collect S/W Inventory of Device Fleet • Detect and Remove Unauthorized S/W
Slide 30: Use Case: Device Security • Joe loses his device on a business trip ● ● ● Logs into the web-based application Selects Lock & Wipe device Remotely locks his device • Corporate data is secure until the device is recovered • Remotely Lock Compromised Devices • Wipe All User Data OTA • Unlock Recovered Devices
Slide 31: Microsoft SCMDM Security Management Active Directory Domain Join Policy enforcementusing Active Directory/Group Policy targeting (>125 policies) Communications and camera disablement* Application blacklisting and whitelisting File encryption Remote wipe Device Management Full OTA provisioning and bootstrapping OTA Software distribution based on WSUS 3.0 Inventory SQL Server 2005 based reporting capabilities Role based administration MMC snap-ins and Powershell cmndlets OMA-DM compliant Mobile VPN Machine authentication and “double envelope security” Session Persistence Fast Reconnect Internetwork roaming Standards based (IKEv2, MobIKE, IPsec tunnel mode) Management Workload Deployment: inside firewall Network Access Workload Deployment: in DMZ
Slide 32: Security Management Benefits SCMDM extends Active Directory/Group Policy to Windows Mobile •AD is the most widely deployed enterprise network directory worldwide ● ● 80% + penetration in the U.S. 55% + penetration in G7 countries overall •AD- GP is widely used by IT to configure policies for their desktops, laptops and servers ● Over 90% of Active Directory customers use Group Policy •Over 130+ configuration settings for Windows Mobile can now be managed through Group Policy including control of Bluetooth, WIFI, SMS/MMS, IR, Camera, and POP/IMAP •Extensible architecture
Slide 33: Device Management Benefits • Enterprise-wide OTA software distribution ● Leverages Windows Software Update Service (WSUS) 3.0 • • Most widely deployed Windows software update solution across organizations of all size (60%+ penetration) Rich targeting and packaging capabilities required by IT departments • Rich Inventory and Reporting ● ● Robust hardware and software inventory capabilities SQL Server 2005-based reporting infrastructure • • Highly flexible Customizable
Slide 34: Secured Corporate Data Access • • Enables secure behind-the-firewall access to the corporate network and applications ● Any intranet data! (SAP, Siebel, intranet sites, SQL, etc) Aligns with existing remote access model for desktops/laptops and scales to a broad set of scenarios ● Thin and rich client apps Allows end-to-end security Headless gateway deployed in the DMZ Privacy compliance Domain Controller Internal Corporate Site Securit y Efficie ncy Use best available channel Adapt to network to minimize keep alive traffic (goal) Corporate Internal Firewall Controlled access to Internal corporate resources from the mobile devices connected via Mobile VPN Mobile VPN Gateway DMZ Extens ible Transparent to mobile application Transparent to LOB services Corporate External Firewall iile o ob M M N N VP Internet Reliabi lity Always connected Allows pushed technology M ob i le VP N Mobile Operators Cellular Data Connection WiFi Connection Simpli city Minimum user configuration Transparent to user and to applications
Slide 35: SCMDM Architecture E-mail and LOB Servers OMA Proxy Initial OTA Device Enrollment Internet Mobi le VP N SSL Usermutual Auth or Similar Console Mobile Server Back-end R/O WSUS Catalog Front Firewall Mobile GW Back Firewall SSL Machine Mutual Auth Enrollment Service SSL Auth (PIN+Corp Root) Self Help Site CA AD Corporate Intranet DMZ 35 December 24, 2009
Slide 36: Summary • Rapid acceleration of Mobility • Enterprise obstacles: Manageability & Security • Multiple Mobile Device Management options • Enterprise requirements will determine optimal choice ● ● ● Platform standardization VPN capabilities and LOB applications OMA-DM
Slide 37: Questions? Contact me at: john.rhoton@hp.com
Slide 38: Your Feedback is Important Please fill out a session evaluation form and either put them in the basket near the exit or drop them off at the conference registration desk. Thank you!