Debunking the Six Myths of App Wrapping
As organizational leaders increasingly recognize the value of deploying and adopting mobile applications, a critical decision they eventually need to make is determining the most effective approach (or mix of approaches) to deploy, secure, and manage mobile apps such as mobile application management (MAM®) and enterprise mobility management (EMM). Among these choices—as Gartner points out in a recent research report (“Debunking Six Myths of App Wrapping”)—app wrapping “remains one of the most misunderstood, yet important, pieces of the puzzle.” App wrapping is a method for applying security and usage policies to mobile apps after they’ve been compiled without requiring any changes to the app’s source code. As the title of the report suggests, Gartner has debunked six myths that continue to proliferate about app wrapping. Here’s a brief recap of what Gartner has exposed:
Myth #1: App wrapping is dead.
Because recent versions of some popular mobile operating systems—namely, iOS—have implemented a growing set of native app-level controls such as data loss prevention (DLP), secure connectivity, and containerization without the use of app wrappers or software development kits (SDKs). This has led some industry observers to proclaim that app wrapping is dead in the water. But as Gartner points out, these native controls typically require a mobile device management (MDM)/EMM system, along with the delivery of what’s known as a configuration profile for a targeted device. Placing a configuration profile on a mobile device isn’t always practical. Plus, most mobile operating systems typically allow just one relationship between a device and an EMM system. This creates problems for contractors and business partners that are often needed by an organization to access certain apps. In such cases, app wrappers may be the only practical option for securing enterprise apps.
Myth #2: All app wrapping products are the same.
In fact, there are distinct differences in app wrapping capabilities offered by providers. Many EMM and MAM vendors provide app wrapping as an alternative to using an SDK to embed libraries in an app. Some vendors offer an SDK and app wrapping capabilities while others provide a wrapper-only approach. Moreover, another class of vendors uses wrapping to enable sophisticated approaches to mobile data encryption, rights management, or to enable self-defending apps. There are multiple approaches to app wrapping where buyers should closely examine their specific requirements.
Myth #3: Any mobile app can be wrapped.
In reality, the types of apps that can be wrapped depend on the wrapping technology. Some administrators will discover that certain wrapping technologies don’t support some of the apps they want to wrap, such as a hybrid app that was developed using a particular cross-platform development tool. Just as not all app wrapping tools are the same (see Myth #2), some wrapping products are able to wrap an app while others can’t.
Myth #4: It’s best to use wrapping for apps where you don’t have the source code, and use SDKs for those where you do.
Wrappers are often supplied in addition to an SDK to enable companies to implement the functionality they want with an app. This provides companies with the flexibility to apply either wrapping or embedding SDK libraries to achieve their requirements. Gartner recommends using wrapping over SDK when agility and speed are priorities and when the wrapper can provide the same required capabilities as the SDK
Myth #5: App wrapping runs afoul of Apple’s EULA.
Some organizations contend that wrapping a public app violates end-user license agreements (EULA). This notion has been both reinforced and occasionally denied by vendors. It’s a complex issue. Gartner believes that Apple has a few prohibitions but generally approaches this on a case-by-case basis. It depends on whether a particular app wrapping technology changes an app’s behavior and how it does this. Apple doesn’t outright prohibit wrapping an app from its app store. But Apple’s EULA language is intentionally broad-based and it seeks to maintain the right to prohibit certain types of changes to app behavior as it sees fit, in part to protect its relationships with ISVs and the experiences of end users.
Myth #6: App wrapping is at a crossroad, so view it as tactical.
Major OS vendors are constantly evolving their platforms to meet the needs of enterprise users, making many of their app policies once available only through app wrapping and SDK enablement part of native management APIs. But wrapping can be used for a variety of purposes. For instance, mobile security companies are using wrapping to make apps “rights-management aware” or to enable apps to encrypt or decrypt file-level protections. Future uses such as run-time application self-protection promise to deliver malware and threat protection on an app-by-app basis demonstrate imminent potential use cases for app wrapping.