Kaboom!

Most companies don’t have plans for a mobile device management system, our survey finds. With more devices taking on more important tasks, that’s just asking for trouble.

 By Richard Martin

When it comes to managing the mobile devices used by physicians and staff at her company, LifeLong Medical Care, IT director Betsy Ami chuckles, “There’s not really a strategy,” she says.

While acknowledging that having no system isn’t necessarily the best system, Ami doesn’t yet see an urgent need for an overarching policy. The jumble of PDAs and smartphones used by the employees at LifeLong, a group of nonprofit health clinics in the Bay Area, doesn’t contain patient medical records, “so there hasn’t been an issue of compliance” in tracking them.

What’s shocking, though, isn’t that one company finds itself in this situation. It’s how widespread this laissez-faire approach to managing mobile devices is. Not only have most organizations in InformationWeek’s recent survey of 307 business technology managers not adopted mobile device management strategies, most of them—52%—don’t even have plans to buy or implement tools that would help them corral proliferating wireless devices.

IT leaders need to get ahead of this issue. Mobile device management will become a must-have capability for most IT departments over the next few years—and we think it’s closer to two than five. As mobile devices and applications take over many of the functions previously carried out on desktop PCs, the ability to secure, track, update, and provision such devices will present a significant competitive advantage in many industries, from financial services to health care to shipping and logistics. As the power and connectivity of mobile devices surge, their numbers will explode. Research firm IDC predicts that sales of converged mobile devices for businesses will reach 63 million units worldwide by 2010, up from 7.3 million in 2005.

Unfortunately, IT directors’ ability to manage these devices as corporate assets, while controlling the data and applications that run on them, hasn’t kept pace. However, of those that do have a mobile device management plan, 55% plan to increase device management spending in the next 12 months. Driving that spending is concern over security: Password protection, remote-wipe capability, and physical device-tracking are the top three features cited by these companies.

Those who haven’t adopted such products and don’t plan to cite three reasons: lack of need, cost, and complexity. MDM vendors apparently have done a poor job of educating potential customers about the value and ease of use of their products. That’s explained in part by the fragmented nature of the mobile device management market. Products are available from wireless telecom carriers, handset makers, telecom expense management specialists, and security software providers.

Reflecting the dominant position of BlackBerrys among mobile business users, Research In Motion’s BlackBerry Enterprise Server is by far the most prevalent mobile device management platform cited in our survey, by 80% of respondents. Its ability to offer device security and management comes because RIM has created essentially a closed universe. A system administrator can manage up to 2,000 BlackBerrys from a single server, with capabilities such as over-the-air updates and remote data wiping of misplaced devices. BlackBerry Enterprise Server is priced at $4,000 per server plus $100 per user or device. That price includes the BlackBerry e-mail service and device management.

Burned By Experience
One reason uptake of mobile device management products hasn’t been faster may be that companies aren’t all that sure how their mobile strategies are going to evolve. LifeLong’s situation is partly a result of the fact that its experience with mobile applications hasn’t been stellar: The 371-employee company conducted a pilot electronic-prescription program a few years back, using the since-discontinued Axim PDAs from Dell. Mainly because of a lack of wireless coverage in its Berkeley, Calif., medical facility, the trial led nowhere.

For now, while LifeLong issues a few PDAs to clinicians and managers, most employees use their own cell phones or smartphones, billing the company for partial reimbursement for their service plan. It’s hardly ideal. “The problem is that because we have no management strategy, the IT department orders and issues the devices, but nobody really checks the bills,” Ami says. Software updates are another problem. To install new software and upgrades, Ami’s team has to physically retrieve every smartphone in use in the organization.

ABI Research forecasts that revenue from mobile device management services will exceed $20 billion by 2013, from less than $600 million last year, a striking swell in demand considering the lukewarm interest our survey turns up. In addition to Research In Motion, Hewlett-Packard, the business division of Verizon, and an array of other providers are offering mobile device management in one form or another.

The market got a significant entrant in March when Microsoft began shipping its System Center Mobile Device Manager 2008, first unveiled last October. A new server application that works only with Windows Mobile 6.1, Mobile Device Manager 2008 is the first major product by the world’s largest software company to make handhelds as manageable and secure as PCs. 

The product review site Engadget describes System Center Mobile Device Manager 2008 as “dull” and “restrictive,” but its popularity is rising among the Microsoft crowd, with 19% of survey respondents using it. Its capabilities include VPN connectivity, over-the-air updates and feature disabling, and remote wiping of data from lost or stolen devices. Microsoft’s system is priced at $2,149 per server plus $57 per user or device before discounts.

Significantly, close to 60% of IT departments have standardized on a single mobile device for employees who get them, which should make device management easier. But device homogeneity won’t last, as more employees bring their own cell phones and smartphones to work rather than get them through their companies, as with laptops and other standard-issue computing equipment. Apple’s iPhone, in particular, is storming the enterprise. Ami and other IT directors are resisting, but resistance is futile: Ami’s boss recently started using an iPhone, a gift from his son.

Many IT organizations lack even the most basic information about the devices and services their employees are using. “We don’t even know how many are out there,” is a typical comment. Another: “We don’t have a way to control what the users are doing.”

At InformationWeek’s Over the Air Mobility Forum in New York last month, one exasperated CIO asked, “So you’re telling me I have to figure out what type of device every one of my employees is using, who their carrier is, and what they’re running on it?” He didn’t say it, but clearly the thought bubble above his head was “Fuhgeddaboutit.”

‘Amazed At What You Find’
“Our initial focus was just to see what we had,” says Keith Brown, a network administrator at Gwinnett Hospital System of Georgia. With about 5,000 physician associates, Gwinnett got an early start on mobile management, installing a suite from LANDesk in 2004. Before that, Brown says, the hospital system didn’t have any visibility into the devices being used until a problem “forced you to go look for them.” And then?
“You’re always amazed at what you find,” he says.

Such comments belie the fact that 40% of participants in the InformationWeek survey say they don’t see a need to adopt MDM technology. That statistic is almost certainly an artifact, soon to change. Indeed, a majority respond that MDM should be part of wider mobile applications and platforms strategies encompassing BlackBerrys and Windows Mobile. Thirty-eight percent consider MDM extremely important to vendors’ mobile-app portfolios.

That latter percentage likely will grow along with the fragmentation transforming the mobile and wireless market today. The iPhone wave, the emergence of Google’s Android mobile operating system, the push by Nokia and Symbian deeper into the U.S. enterprise market, the rise of Windows Mobile, and the proliferation of mobile devices from innovative vendors like HTC—all will keep IT managers scrambling to keep up in the next few years.

Security’s the foremost factor opening the checkbook for MDM—57% of companies adopting MDM or planning to cite security as the main reason, twice the next factor. When Ami’s team inventoried LifeLong’s mobile devices earlier this year, she discovered one employee had passed a company-issued phone on to her son. “It wasn’t until we threatened to cut off the service that he admitted who he was, and said his mom worked for the organization,” she says. For organizations mobilizing proprietary data and applications, a lack of device accountability is a huge security risk.

End-to-end security is paramount, says Samir Bouraoui, director of marketing for HP’s mobility solutions group. That strategy must include secure access to corporate networks, data encryption, and the protection of company assets. Some IT directors don’t think the risk is manageable at all: “No data should ever reside on remote/mobile devices,” insists one survey participant. “EVER.”

That’s an extreme view. For most companies, managing mobile security will inevitably take up an increasing share of IT departments’ time and attention, which includes maintaining and upgrading the devices and the software they run. Many companies are discovering that, while security is a must-have, the real productivity benefits of device management systems lie in the wireless capabilities of the devices themselves, letting IT maintain and update devices remotely.

Old Dominion Freight Line, a less-than-truckload carrier, puts some 3,500 Symbol MC9000 devices in the hands of drivers today, running order tracking and delivery software. The remote-control feature on its Athena MDM system, from Odyssey Software, was the biggest selling point, says Barry Craver, director of freight processing applications at Old Dominion. “The biggest thing we use that for is that it allows us to troubleshoot a potential device issue without having to ship the device back here to headquarters,” Craver says.

In general, such secondary cost savings are either underestimated or underappreciated by many IT managers, judging from our survey. Only 28% of IT managers who have deployed or plan to deploy an MDM product say that more efficient mobile spending is a primary reason for doing so. Cost reductions are the main driver for just 6%.

There’s a bad-news, good-news aspect to those findings. They indicate that vendors have a long way to go in providing mobile device management software that would-be customers think delivers bottom-line benefits. But there’s a big upside for buyers if vendors succeed in doing that.

Will It Move To ‘Must Have’?
Enterprise device management products can be divided into two categories: those, like BlackBerry, Windows Mobile, and Sybase iAnywhere’s Afaria, that encompass device management as a software add-on to an overall mobile software package, and those that offer “mobility management” as a standalone product. Among the latter, Novell’s ZENworks line—including ZENworks Handheld Management, to protect data stored on the devices, and Endpoint Security Management, to control the devices themselves—focuses almost exclusively on security. Athena, by Odyssey Software, is an on-device agent that integrates with enterprise management platforms from bigger providers, including Microsoft.

Other systems increasingly abstract the mundane but important tasks of device procurement, replacement, and service plan management. That’s the model of Movero Technology, a startup founded in 2003 that offers a managed-mobility interface for IT administrators, Maestro. The interface essentially gives IT departments a buffer between themselves and their carriers, allowing routine tasks like device upgrades, shopping for the best voice and data plans, lost-device replacement, and transferring phones from one employee to another to be handled online, via the Maestro portal.

To do so, they will have to persuade IT directors like Ami, who’s among those not actively shopping for an MDM system but who see the need for added visibility and control over devices. Ami has started to add some de facto management to her department’s routine deployments. A few weeks ago, LifeLong instituted an “asset acceptance” policy and form for employees issued company devices. “So if that person leaves, at least the HR department will have a copy of this form to say, ‘By the way, you have this piece of equipment’ as they walk out the door,” she says.

That’s a decent way of tracking and recovering mobile devices and a step forward for LifeLong, but automation would be more efficient. Right now, Ami is window shopping. At the annual conference of the Healthcare Information and Management Systems Society, in February, she stopped by the Sprint Nextel booth to ask about device management options. It would be helpful, she says, to have an MDM system that would let her distribute software upgrades over the air, and to recover software assets from employee-owned phones when the person leaves the company.

Getting customers to move from “it’d be helpful” to “we can’t live without it” will be the next step for Microsoft, HP, Novell, and the other big players in the MDM arena. More than a quarter of respondents to our survey say they access job-specific and personal-productivity applications on their devices. As more workers move beyond mere e-mail, pressure will grow to manage not only access to applications, but the devices, too.

IT pros must get control over the mobile device proliferation that’s happening around them. That means being proactive now or, for those who procrastinate, in emergency mode later.