How can a company even begin to manage live TV on cellular phones? How will the proliferating wireless e-mail be stored? How will it all be made secure, with so many different networks and devices and applications?

Companies have faced, and sometimes ignored, the demands of managing handhelds and wireless devices for years. IT managers waver between two approaches: Throw open the floodgates and try to accommodate what’s coming, or throw up your hands and ban everything except what you deem acceptable.

But the problem will become more complex as new college grads arrive at work — and bring the consumer-focused devices and applications they see not as toys but as essential tools they have integrated into their lives.

When a young “prosumer” (short for professional/consumer) shows up with streaming video clips, live broadcast TV and a whole range of instant messaging, collaboration and music-downloading options on his smart phone, how will IT hold the line on standards?

And if he wants to use the device for work-related e-mail, access to corporate databases or storage of corporate data, will IT restrict the access pathway? What happens when that worker resists using separate devices for work and personal life? Will IT allow frivolous functions to run on the same approved devices as mission-critical ones?

Analysts say that over the next two years, these and other scenarios will force IT managers into the role of enforcer as never before. “The IT department has to do something about more and more consumer-type devices entering the enterprise,” says Roberta Cozza, a U.K.-based analyst at Gartner Inc.

This will require careful planning at the highest management levels to develop policies that control devices and applications to limit security lapses and IT headaches while still winning the support of end users.

Two Approaches

Some IT managers are already holding a tough line on handhelds and wireless devices, while others have tried to accommodate innovations.

“Why do we in IT care what that new hire just out of college wants to run on his phone or device?” says the assistant vice president of IT compliance at a Western bank. (She asked to remain anonymous because her company is in acquisition talks.) She believes the bank should ignore user pleas for consumer applications and set strict controls on devices and access.

“You have to protect the enterprise,” she says. “You have to protect the customer. It’s a huge thing for a bank.”
Lapses that could result in leaked customer information could bring severe federal fines as well as damage to the bank’s reputation, the vice president explains. “That’s huge, and we could not be in business if customer information got out,” she says.

The bank limits devices used by many of its 2,300 workers. A typical knowledge worker carries a laptop, a cell phone and a BlackBerry handheld capable of transmitting encrypted e-mail. Handhelds and phones are treated like desktop computers with regard to access privileges and rules about what data can and can’t be loaded on them, the compliance officer says.

Workers aren’t allowed to attach a personal device to the bank’s network, and they can’t use the Universal Serial Bus ports of their laptops for storing corporate data, to prevent it from being transferred to a personal storage device.

“Control is important,” the bank executive notes. “You can’t be compliant [with federal rules such as the Sarbanes-Oxley Act] if you don’t have control.”

In contrast, at consumer electronics retailer Best Buy Co. in Richfield, Minn., 4,000 employees are allowed to use a fairly wide range of devices, including BlackBerry and Audiovox handhelds and Palm OS devices such as the Treo, says Jeff Robles, sourcing manager for enterprise products and transportation at Best Buy.

“Given we are a technology company, we understand there are business requirements that will govern the use of our devices, so we attempt to manage to the need while mitigating any security issues,” he says.

To do this, Best Buy relies on several management software products from Traq-wireless Inc. in Austin, including Mobile Source. Traq-wireless says its software is designed to reduce costs and mitigate security and intellectual property risks by giving IT managers visibility into which employees have which devices and services.

More to Come

Regardless of today’s approach, the next few years will challenge IT shops to keep up with multiple operating systems, wireless carriers, and new devices and applications, analysts say.

“It’s going to be a lot worse,” says Bob Egan, an analyst at Mobile Competency Inc. in North Providence, R.I., citing the proliferation of cheap consumer-centric devices, including camera phones and mass storage devices. “It’s a new frontier. There’s not a single company out there doing a very good job managing mobile devices as a class.”

For example, Egan says, most companies overlook the issue of protecting intellectual property on smart phones. When a salesman puts customer contact data on a phone, that information can be lost if he changes jobs.

Some mobile operators such as Sprint Corp. are beginning to offer services to manage mobile hardware and software, Egan says, but outsourcing mobile security is a step many IT shops may resist.

As for applications, Egan says some companies are trying to enforce a list of approved software for employees, but that’s difficult to implement on a practical level. Egan says the same management model that corporations use for purchasing a laptop and provisioning and supporting it should apply to a phone or handheld device. But with handhelds, rules are harder to enforce.

There are other potential issues, he says. What if an employee purchases a device himself but uses it for work? Can the company demand access to the data? And what happens if the device is lost or stolen? What about archiving e-mail and capturing and archiving short text messages?

Gartner stated in a recent report that the trend of consumer devices entering the workplace “creates havoc for IT organizations whose operations are based on standards and stable platforms.”

Companies are protecting the front end of the organization with a firewall, the report says, but the back end is protected “only by the good intentions of employees.”