How to Manage Mobile Device Mayhem

When it comes to mobile, can campus users be left to their own devices? Universities are increasingly turning to mobile device management solutions to create some order--and security--whether the devices are BYO or institutionally owned.

• By David Raths
• 07/08/13

Illustration by Shane McGowan

Managing mobile devices is hard enough when institutions own the equipment--Apple products, for example, often require a different approach in an enterprise setting. But when students, staff, and faculty flood campus with their own devices--be they Android, Windows, iOS, or BlackBerry--the task becomes exponentially harder.

Many universities are turning to mobile device management products to manage the mayhem. While vendors are peddling more than 50 MDM products, the right solution for your institution will depend largely on your specific setup and needs. But even small pilot deployments of 30 or 40 tablets--especially those involving iPads--may require an MDM solution.

Identifying your needs and developing an appropriate approach are a key first step. The rapid growth in the use of personal devices at Purdue University (IN), for example, led the school's chief information security officer, David Shaw, to convene a project team in 2012 to study MDM policy. "When [campus users] are accessing university data, we need some reasonable level of protection," Shaw says. "Some are accessing sensitive data." In his view, the mobile device is just another endpoint device that Purdue needs to manage.

The type of mobile-policy reassessment undertaken at Purdue is becoming increasingly common on campuses, and mirrors what is happening in corporate settings, says Chris Silva, an analyst with the Altimeter Group of San Mateo, CA. "We used to see more devices such as BlackBerrys owned by the organization and locked down," he says. But now in the BYOD era, he adds, "the device matters less and the focus is more on role-based access to applications. We are seeing an array of devices ranging from university-owned to BYOD, and the solutions have to be able to handle those distinctions. One MDM solution should be able to apply different rules to different types of devices."

In 2012, an MDM evaluation team at the University of Pennsylvania came up with what it considers the top three questions to ponder before choosing an MDM solution:

1. Stand-alone or integrated product? In general, stand-alone products have more features, simpler interfaces, and function better. However, for those wanting to manage both mobile and desktop clients with the same solution, an integrated product is worth considering. And if a desktop-management solution is already in place, is there an MDM component available? If the answer is yes, the benefits of a relatively quicker deployment and unified environment may outweigh the shortcomings compared to a dedicated product.
2. What do you want to manage--and what will you want to manage? What does the environment to be managed look like now? What will it look like in two years? An iOS-only environment can get by with iOS-focused tools, but those considering supporting Android, Windows Phone, or another mobile OS should keep that in mind when choosing a product.
3. Managing one group or many? Does the product need to apply one set of policies to a single group of users or several sets of policies to several sets of users? A product that can easily handle multi-tenancy is key, particularly in larger organizations.

Concerns About Vendor Solutions
But are commercial MDM solutions up to the challenge, particularly with respect to the third question? According to Chris Rhoda, vice president of information services and CIO at Thomas College (ME), MDM vendors have struggled to create enterprise management solutions for personal products. "They are doing their best, but they are not perfect," he explains.

It's an observation borne out by the MDM team from Stanford University (CA). When the team reviewed the commercial products available a few years ago, it found that most products were intended for businesses, which don't necessarily share Stanford's complex, multilayered network environment.

Stanford expects its users to enroll and support their devices largely on their own, and it was looking for hierarchical reporting and administrator access down to the workgroup level. "Unfortunately, there were no commercial solutions that could function in this sort of environment or provide the distributed-management features that we needed," recalls Mark Mellis, an associate information security officer at Stanford. So the school decided to build its own MDM solution, starting with an iOS version since 85 percent of devices on the network ran iOS. (This solution won a Campus Technology Innovators Award in 2012.)

Stanford wanted to offer MDM to the broadest possible cross section of the university community for four reasons:

1. To protect university information.
2. To control support costs by automating provisioning of services such as e-mail and calendaring.
3. To assist community members in protecting their own privacy.
4. To provide insights into trends in mobile device use.

In many ways, the Stanford decision to build its own MDM was a stopgap measure to allow commercial vendors to come up to speed. "We knew from the beginning that we would eventually need to migrate to a commercial product in order to support platforms other than just iOS--and to control support costs over the long term," adds Mellis.

Stanford is now beginning the transition to a commercial product, but it's using the lessons learned from its own MDM foray to make some changes particular to the university's approach. "Even today, the self-service model we adopted isn't available from the commercial products," says Mellis, "and that is an area where we expect to extend our commercial system."

Finding the Right Fit
Even if commercial products don't offer a flawless soup-to-nuts solution, the pressure to handle the influx of mobile devices is forcing many schools into the MDM market anyway. But they should be sure to evaluate the pricing closely. The costs associated with MDM solutions vary widely, according to consultant Silva, with some vendor pricing models ill suited to colleges and universities. "You should look for per-user pricing rather than per-device pricing," he suggests.

Most universities are looking for a similar set of core functions from MDM vendors, although needs will vary depending on whether a school intends to support just one OS or a variety, and whether support will extend only to university-owned assets or to personal devices as well. The following list, based on a 2012 University of Massachusetts request for proposals, is reflective of the needs of most colleges:

• Over-the-air (OTA) configuration: The ability to assign different security settings, applications, and configuration policies to different work segments
• Intelligence, troubleshooting, and support: The ability to specify scheduled or event-based actions for troubleshooting and support, in addition to real-time monitoring
• Real-time inventory: The ability to provide real-time information on system configuration, installed applications, and security configuration; it should also be able to perform automated real-time remediation
• Reports: The ability to generate reports on devices that do not meet compliance policies (e.g., jailbroken/rooted, passwords, encryption)
• Remote-control capabilities: The ability to manage the system from off-site
• Employee self-service portal, including such features as backup and restore, wipe, remote wipe validation, locate, "find me" sound/alert, and password reset

At the very least, adds Silva, universities need the capability to locate, lock, and wipe employee devices that have access to sensitive data. But he also wags a cautionary finger about central IT becoming too heavy-handed. "You don't want to wipe a whole device and erase that last picture of Grandma," Silva explains. "That type of thing happens and it leads to lawsuits, so the less devastation you can cause the better."

And just how far do universities extend their reach? Do universities need to offer MDM solutions for students' personally owned smartphones, for example? Silva claims it really comes down to the level of service the school wants to offer students. The same way they offer disk space and e-mail to students, many universities are starting to offer some level of device tracking that extends to smartphones brought by students to campus, he says, but is up to the students to decide whether to take advantage of it or not.