{"id":875,"date":"2010-11-23T07:32:16","date_gmt":"2010-11-23T07:32:16","guid":{"rendered":"http:\/\/refraction.co.uk\/blog\/?p=875"},"modified":"2010-11-23T09:33:13","modified_gmt":"2010-11-23T09:33:13","slug":"more-on-windows-phone-7-security-policies","status":"publish","type":"post","link":"https:\/\/refraction.co.uk\/blog\/2010\/11\/23\/more-on-windows-phone-7-security-policies\/","title":{"rendered":"More on Windows Phone 7 Security Policies"},"content":{"rendered":"<p>Following my <a title=\"windows phone 7 and exchange activesync\" href=\"https:\/\/refraction.co.uk\/blog\/2010\/11\/22\/windows-phone-7-and-exchange-activesync\/\" target=\"_blank\">previous post<\/a> about Windows Phone 7\u2019s support for Exchange ActiveSync (EAS) security policies I\u2019ve had some further conversations with MS on the subject.<\/p>\n<p>They\u2019ve sent through some more detailed information about what\u2019s supported, what\u2019s not supported and the thinking behind those decisions.<\/p>\n<p>The big one is encryption, at present WP7 doesn\u2019t support it.\u00a0 However there are some factors which help mitigate the risk of having data in plain text on the device.\u00a0<\/p>\n<p>Firstly WP7 doesn\u2019t support accessing data on the device over USB.\u00a0\u00a0You can\u2019t plug a WP7 phone into a PC and access it&#8217;s file system as you could with earlier Windows Mobile OS\u2019s, so in that respect it behaves like an iPhone.\u00a0\u00a0 In addition, WP7 doesn\u2019t support the use of removal media such as Micro-SD cards, so in theory there\u2019s no way of getting to the raw data.<\/p>\n<p>In practice I\u2019m not sure that\u2019s the case.\u00a0 It looks like at least <a title=\"Engadget on Windows Phone 7 and SD cards\" href=\"http:\/\/www.engadget.com\/2010\/11\/17\/windows-phone-7s-microsd-mess-the-full-story-and-how-nokia-ca\" target=\"_blank\">one device<\/a> has a user accessible micro-SD card slot, and that WP7 does have at least some support for <a title=\"Windows Phone 7 and Removable Storage\" href=\"http:\/\/windowsphonesecrets.com\/2010\/10\/12\/windows-phone-7-and-removable-storage\/\" target=\"_blank\">expanding storage<\/a> in that way.\u00a0 Whether you could remove a card and recover anything useful from it is another question altogether.\u00a0 Initial reports would suggest not, but but that&#8217;s not certain.<\/p>\n<p>The other slight concern was WP7\u2019s limited support for MS Exchanges ActiveSync Policies.\u00a0 These allow an organisation to configure the security options on any device connecting into it for email.\u00a0 Or indeed block any device which doesn\u2019t comply.<\/p>\n<p>My <a title=\"windows phone 7 and exchange activesync\" href=\"https:\/\/refraction.co.uk\/blog\/2010\/11\/22\/windows-phone-7-and-exchange-activesync\/\" target=\"_blank\">previous post<\/a> lists the policies that are supported, but MS have offered some additional info about some of the policies which aren\u2019t.\u00a0<\/p>\n<ul>\n<li><strong>Encrypt storage card<\/strong> \u2013 <em>With WP7 not supporting removable storage this isn\u2019t needed<\/em><\/li>\n<li><strong>Disable desktop ActiveSync<\/strong> &#8211;<em> WP7 no longer supports desktop Sync for Email and Documents, and Zune software takes care of media sync\u2019ing with a PC<\/em><\/li>\n<li><strong>Disable removable storage<\/strong> <em>&#8211;\u00a0 Again, WP7 doesn\u2019t removable storage<\/em><\/li>\n<li><strong>Disable IrDA<\/strong> \u2013 <em>WP7 doesn\u2019t have any Infrared support so the policy wouldn\u2019t do anything<\/em><\/li>\n<li><strong>Allow desktop sharing from device<\/strong> <em>&#8211; Desktop Sync is no longer available or supported<\/em><\/li>\n<li><strong>Allow unsigned applications<\/strong>\u00a0<em>\u2013 As all WP7 apps are delivered through marketplace, they are all signed and have to be in order to be installed.\u00a0 WP7 doesn\u2019t allow loading or installation of apps through the browser as Windows Mobile used to.<\/em><\/li>\n<li><strong>Allow unsigned CABs<\/strong> <em>&#8211; WP7 does not support native applications delivered through CAB files so the policy is redundant<\/em><\/li>\n<li><strong>Configure message formats (HTML or plain text)<\/strong> <em>&#8211; plaintext messaging is not supported in WP7 anyway<\/em><\/li>\n<li><strong>Allow mobile OTA update <\/strong>and<strong> Mobile OTA update mode<\/strong> <em>&#8211; WP7 only supports app installation through marketplace, marketplace automatically notifies users if there is a new version of software<\/em><\/li>\n<li><strong>Include past calendar items (Days)<\/strong>\u00a0<em>\u2013 This is only user controlled in WP7<\/em><\/li>\n<li><strong>Require manual sync while roaming<\/strong>\u00a0<em>\u2013 Again this is user controlled in WP7, though I would imagine many organisations would like control over this \u2013 either to enforce it to minimise data charges or disable it.<\/em><\/li>\n<li><strong>Allow attachment download (client side)<\/strong>\u00a0<em>\u2013 This is always on in WP7<\/em><\/li>\n<li><strong>Application allow list<\/strong> and <strong>Application block list<\/strong> <em>&#8211; All applications are installed through MarketPlace and currently there\u2019s no way to explicitly allow or block the use of certain apps<\/em><\/li>\n<\/ul>\n<p>Many of these do make sense, but whether the support offered will be enough to mitigate the security risks for large organisations who care about these things I\u2019m not sure.\u00a0<\/p>\n<p>I think MS will need to demonstrate and prove the inherent security they are claiming around WP7\u2019s internal storage, particularly where devices can be expanded through micro-SD cards.\u00a0 Previous versions of Windows Mobile have been pretty secure, indeed there are configurations that have passed <a title=\"Windows Mobile Common Criteria Evaluation\" href=\"http:\/\/technet.microsoft.com\/en-us\/library\/ff723752.aspx\" target=\"_blank\">Common Criteria evaluation<\/a>.\u00a0 Whether MS is pursuing this with WP7 is unknown.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft Windows Phone 7 doesn&#8217;t support encryption or the full range of Exchange ActiveSync policies, but there are some explanations<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[129,425,106,13,447],"class_list":["post-875","post","type-post","status-publish","format-standard","hentry","category-tech","tag-activesync","tag-encryption","tag-exchange","tag-microsoft","tag-windows-phone-7","entry"],"_links":{"self":[{"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/posts\/875","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=875"}],"version-history":[{"count":6,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/posts\/875\/revisions"}],"predecessor-version":[{"id":886,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/posts\/875\/revisions\/886"}],"wp:attachment":[{"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=875"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=875"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=875"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}