Over the past couple of weeks I\u2019ve been doing some work on how best to secure data on the myriad of mobile devices that are used these days to access email and calendar information.<\/p>\n
It\u2019s a hot topic at the moment, and so it should be.\u00a0 Recently here in the UK the information commissioner brought in a \u00a3500,000 fine<\/a> for each instance of information data loss.\u00a0 Of course it would depend on the information lost, but hands up anyone who understands everything that\u2019s on their companies smartphones and PDA\u2019s\u2026 with info creeping out in email attachments or iPhone apps that cache your work username and passwords<\/a>, it\u2019s a real risk.<\/p>\n If you use MS Exchange, one of simplest ways to apply a level of security to mobile devices is to use the Exchange Activesync Policies that are included out the box.\u00a0 These allow you to apply \u2013 and more importantly enforce \u2013 a range of configuration options on devices and block access to devices that don\u2019t meet a minimum standard you decide on.<\/p>\n At the bottom of this post I\u2019ve attached a spreadsheet <\/a>which I\u2019ve put together which details the policies available and the devices they are compatible with.\u00a0 To get the information I spoke to MS, Google and Apple (thanks Jason) directly, so it should be accurate.\u00a0 But I don\u2019t have any contacts at Nokia or Palm so that info was taken from their deployment guides.<\/p>\n Part of the reason I thought I\u2019d post this up is that I noticed a very similar doc was added to Wikipedia<\/a>, but it doesn\u2019t include some important information about the level of Exchange Client Access Licence (CAL) need to use some of the policies, nor does it talk about the differences between hardware versions of iPhone.\u00a0 If I can bring myself to dive into the wiki mark-up language I\u2019ll amend the article to include the info but for now I hope this spreadsheet helps some of you.<\/p>\n If you\u2019re not currently implementing any policies in Exchange there are a few things to consider before you do.\u00a0<\/p>\n First think about the types of device currently connecting.\u00a0 If you\u2019ve been using Exchange EAS for a while the chances are you\u2019ll have a range of kit from Windows Mobile 5 onwards.\u00a0 This older equipment may not support many of the available policies, so if they\u2019re company owned devices you may want to look at upgrading them rather than cut the users off entirely.\u00a0 Unfortunately it\u2019s not just older devices that don\u2019t support all EAS policies correctly.\u00a0 Modern OS\u2019s such as Google\u2019s Android and Palms WebOS don\u2019t either.\u00a0<\/p>\n There are some simple reports that an be run using PowerShell that will list out all the device that connect in, including device type, versions and usernames.\u00a0 Unfortunately the iPhone doesn\u2019t report back its hardware version until iOS4 however.\u00a0 I\u2019ll try to follow up this post with the query details.<\/p>\n Remember that neither Google\u2019s Android, Applies iPhone or iPhone 3G support any level of device encryption, which from a business perspective is a little scary considering their popularity.\u00a0 What\u2019s worse, early versions of the iOS3 firmware apparently mislead the Exchange server into thinking early iPhone were encrypted.\u00a0 If you have a lot of these things out there but still want to apply a level of security you can buy yourself some time using the \u2018Allow non-provisional devices\u2019 policy.\u00a0<\/p>\n One option would be to create a basic security policy with all the PIN settings you want to apply and enforce that by un-checking the \u2018allow non-provisional devices\u2019 policy.\u00a0 This will ensure that if a device doesn\u2019t support the policy it can\u2019t connect.\u00a0 You could then create a seperate policy with the encryption settings and the \u2018allow non-provisional devices\u2019 enabled.\u00a0 In that case the policy should apply only to those phones that support it.<\/p>\n As always, communication out to your end users is going to be key, especially if you have personal devices connecting to Exchange in addition to your company ones.\u00a0 Whilst having a PIN etc is probably a fair exchange for the Exchange functionality they\u2019ll receive, suddenly finding that your personal phone has had a PIN enforced and that your SD of music and photos has been encrypted is likely to annoy\u2026\u00a0 Something to keep in mind!<\/p>\n Anyway, here\u2019s\u00a0spreadsheet: Exchange ActiveSync Policies<\/a><\/p>\n