The BYOD movement seems to be changing the hardware landscape permanently and it’s showing no signs of slowing down. Naturally, this presents both opportunities and challenges. Security managers within the enterprise have less control then ever. “Anywhere access” has blurred the lines of what used to be called the corporate network perimeter.

So what are CIOs and CTOs specifically worried about with BYOD? Well for one, mobile devices can easily go missing while containing sensitive data and employers often cannot even assess the impact of data security breaches from compromised devices. But locking down employees’ personal devices is generally not an option.

So how can enterprises re-assert control over their data assets while still allowing employees to use their own smartphones as they choose? We’ll be discussing this and other questions during out live, interactive Q&A. So, be sure to clear your calendar and join in the discussion on March 26 at 9am PST.

Here’s How to Join the Discussion
Make sure you click Add to Calendar to get the event details and a reminder in your calendar. Then, on the day of the event, click here to join:

• layer7.com/live

To ask questions, you can:

• Tweet using the tag #Layer7Live
• Email techtalk@layer7.com
• Post a message on Facebook

Recently, we began a series of free eBooks that will distill our communal knowledge into specific, targeted recommendations for dealing with a variety of challenges around APIs – from interface design, to security, to developer engagement. Today, I’m pleased to announce the first two of these, which deal with API exposure for internal mobility projects and for externally-facing open APIs.

First, we have Enterprise on the Go: 5 Essentials for BYOD & Mobile Enablement. This eBook focuses on the challenge of securely exposing internal applications and information assets to mobile employees, either on their own devices (BYOD) or as part of a larger mobility initiative. These five key points for a successful deployment are presented in an easy-to-consume synopsis and then backed up by white papers, webinars and customer case studies. Of particular interest to our enterprise customers are the sections on repurposing existing services and using middleware to optimize for mobile use cases.

Next, we have 5 Ways to Get Top Mobile App Developer Talent for your Open APIs. While not all enterprises have chosen to expose their APIs externally, those that have are faced with the challenge of acquiring a talented community of developers that will build useful mobile apps for the consumer marketplace. However, enterprises can’t simply assume “build it and they will come.” Getting devs onboard requires investment in documentation, branding and community development. This eBook discusses some of the best methods for onboarding and rewarding those developers who provide the most value.

Whether focused on internal or external developers, these eBooks are valuable resources for anyone looking to expose APIs for mobile access to enterprise assets. We welcome your feedback on this format and look forward to continuing the series.

Meanwhile, BYOD is making Mobile Access an urgent issue for enterprises; forcing them to make application functionality available to app developers in a consistent, easily-consumable, mobile-optimized manner, via APIs. Therefore, enterprise technologies are evolving to support API-based mobile interactions.

Identity and access management (IAM) represents a key concern for enterprise IT and it is particularly crucial in BYOD/enterprise mobile scenarios. Mobile IAM requires fundamentally new approaches and the adoption of new standards such as OAuth.

These are some of the most critical issues facing IT departments today but the associated techniques and technologies are not necessarily that well understood in the enterprise world. Therefore, I’d like to take this opportunity to  flag up some relevant webinars from the Layer 7 archive, all of which feature Forrester Research.

If you’re facing the challenge of ensuring secure access in an enterprise mobile scenario, these resources should help you make sense of the issues:

• How to Make Your Enterprise Applications Mobile Ready, Fast
  Leverage backend mobile middleware to deliver mobile ready enterprise APIs
  Find out more >>
• Identity, Access & Privacy in the New Hybrid Enterprise
  Make sense of OAuth, OpenID Connect and UMA
  Find out more >>
• A Practical Guide to API Security & OAuth for the Enterprise
  Implement OAuth as part of an enterprise-level API security solution
  Find out more >>

However, these technologies are only half the story. The other half is the API that provides a method of interaction with the server. To provide a rich, functional interface, this API must be user-friendly for people and machines. It should be easy to develop against, with or without extensive documentation. And it should be able to represent both the current application state and the operations available to the client. These API design principles were discussed by Layer 7’s Principal API Architect, Mike Amundsen, in his fascinating talk on Wednesday.

QCon was yet another in a long line of analyst, enterprise and developer conferences to draw the same conclusions about the future of enterprise IT. It’s time to look at software development in a new way – and Layer 7 is helping enterprises get on board with these new technologies. Our recently-announced SecureSpan Mobile Access Gateway provides the middleware necessary to adapt internal information assets into secure, optimized APIs consumable by mobile devices for enterprise mobile enablement or BYOD.

At Layer 7, our enterprise customers are sometimes constrained by industry regulations regarding data privacy. These restrictions, especially in the healthcare and financial services industries, often prohibit medical or financial data from traveling across international (or even state) borders, to ensure compliance with local regulations. Some may require additional forms of authentication when connecting from a new physical location.

Many enterprises are also rolling out BYOD initiatives based on the employee’s proximity to company offices – they can use their own phones to access company data while in the office but that access is restricted when they head for home. More complex GIS integration is sometimes necessary for mobile employees and field technicians.

Building strict geolocation rules into every mobile application is possible but time-consuming to develop and difficult to maintain. Managing these policies in a centralized Mobile Access Gateway allows flexibility of design and easy updates. Compliance auditing is simplified and policies are reusable and configuration-driven. If you want to tighten distance restrictions or change GIS providers, you only have to make the change once.

Layer 7′s SecureSpan Mobile Access Gateway is far more than just a simple API proxy. It provides mobile-specific features around identity, security, adaptation, optimization and integration. It is these integration features that allow powerful orchestration of third-party APIs (including geolocation), legacy applications and mobile notification services for a truly comprehensive Mobile Access solution.

As the variety of available business apps and mobile devices continues to grow exponentially, enterprises will find it increasingly difficult to place such rigid limits on BYOD. Employees are already beginning to feel entitled to use apps that make them more efficient. In some case this may mean that employees will knowingly use banned apps. If businesses want to avoid this kind of insubordination, they will have to work with their employees, not against them.

One part of the solution is a focus on education rather than overly-strict technological bans. Another is embracing the concept of BYOD rather than fighting it. For instance, many of our customers provide their own apps to run on employee-owned devices. We focus on providing these customers with solutions that allow them to make BYOD secure and manageable, without having to ban apps or impose invasive mobile device management software.

The rest of the solution will come from Cloud and mobile vendors taking steps to make their technologies more enterprise-friendly. This means, for example:

• Apple will need to recognize its prevalence in the enterprise market and take steps to certify iCloud and Siri for business use.
• Google Drive and Microsoft SkyDrive will need to deliver terms of service that assuage fears rather than fostering them.

No one has all of the answers yet and I suppose you can’t blame IBM for a cautious approach but the most successful BYOD initiatives are likely going to be those that are flexible enough to avoid alienating employees. How else will we know what happens when Siri is asked to open the pod bay doors?

CIOs have started to recognize that – with BYOD gaining strength – mobile is coming to business, like it or not. The many CIOs who came by our booth all seemed determined to address the issue head-on. For some, this will mean developing apps in-house; for others, enabling third-party app developers. In either case, the key to success will be publishing secure, robust APIs.

Publishing mobile APIs raises various questions for CIOs. Some of the questions we heard in Vegas are external corollaries of challenges we’ve been solving for years (“How do I expose a REST API when my data is delivered via SOAP services?”) Others are completely new (“What happens when someone with our app on their personal smartphone leaves the company?”)

These issues also arose during an interesting session called “Navigating the Mobile Shift.” At this session, after some input from Forrester analysts, everyone split into groups for brainstorming on problems (and solutions) in specific categories. When each group presented its findings, security and governance questions were at the top of every list.

These forum participants aren’t from mom-and-pop startups – they’re with large enterprises that have serious security, governance, performance and scalability concerns. Helping enterprises address these concerns for API-based integrations is Layer 7’s core business, so we’ll be eagerly following future developments in enterprise mobile enablement and BYOD.

Up to this point, apps have focused mainly on consumers. But with the BYOD (“bring-your-own-device”) movement’s unstoppable momentum driving mobile devices into the center of the enterprise IT landscape, there is a growing need for enterprise apps that give employees the user experience they are used to with consumer apps. That means a decent chunk of the $3.8 trillion spent on enterprise IT this year could be heading to mobile app developers like you.

Building mobile apps for the enterprise is going to create some new challenges, though. Perhaps most significantly, you will be much more reliant on enterprise data and applications. That’s going to mean a lot of work integrating the functional requirements for your apps and even more work nailing down the non-functional areas like security, scalability and availability. Nevertheless, these challenges are well worth accepting, given the stakes.

The good news is that Layer 7 will be out there making things easier for you. We help enterprises expose data and applications as RESTful APIs, significantly simplifying integration with mobile apps. Additionally, our API Portal product helps developers discover and get maximum value from enterprise APIs. It’s an exciting time for mobile developers and we’re excited to be laying the foundation upon which a generation of enterprise apps will be built.

While there are existing solutions for playing keep-up, many of them rely on isolation and restriction to prevent corporate assets from traveling too far from the enterprise. Unfortunately, I think employees – especially the more tech-savvy among them – will resent having corporate security policies installed on their devices or being limited to separate-but-equal wireless networks with limited access to the resources necessary to do their jobs. By focusing on containment and control, enterprises are missing an amazing opportunity to make BYOD work for them.

The efficiencies gained by embracing the inevitable and implementing some BYOD-centric systems should not be overlooked. Layer 7 customers are creating mobile applications designed specifically to support their employees, whether their devices are employee-owned or provided by IT.  Our solutions for security and governance of the APIs used by those applications can prevent data leakage, protect against incoming threats and provide access to only appropriate personnel.

So, whether your employees are baggage handlers determining the destination for a piece of lost luggage, nurses providing care to house-bound patients or remote employees connecting to their peers through a corporate directory and communication hub, the real winner is the bottom line. BYOD and mobile workforce enablement are opportunities to embrace – not afflictions to be cured – and we’re here to help.

Here are some takeaways from the conference:

• It’s all about apps… – The hottest exhibition hall at MWC was the “App Planet”, which was primarily populated by app development companies. It’s clear that mobile apps are the draw when it comes to this era of mobile dominance we are entering and this hall emphasized that point clearly and gave a view into the future.
• …and APIs – App Planet also had a lot of API enablers, such as Neustar, on display. Also, three of the keynote speakers — China Mobile, AT&T and Ford — all emphasized the importance of using APIs as a foundation for their mobile strategies. With apps driving mobile adoption, it’s evident that APIs are a fundamental enabler.
• Increasing focus on enterprise – Although much of the focus in the app space was on the consumer market, there is a marked increase in enterprise options. Vendors like Roambi were showcasing their business apps and a number of exhibitors were emphasizing solutions for mobile device management and mobile identity.

All these trends and issues are discussed in Layer 7’s new white paper Secure Mobile Access for Enterprise Employees. The white paper explores how enterprises can use APIs to open internal information assets to mobile developers, to enable the creation of mission-critical apps that maximize employee productivity and availability.

I look forward to following up with all of the people I met in Barcelona and to injecting the lessons I learned into our product suite.

Download the white paper: Secure Mobile Access for Enterprise Employees.