We're concerned about the security of data on mobile
devices if those devices are
lost. We have more and
more employees using smart
phones and other mobile
devices that have copies of our
users' mailboxes as well as
whatever company data (e.g.,
customer lists) that they copy
to their devices. What can we
do to protect that data?
You're right to be concerned, not only about the information on the devices but the
passwords as well, because most of
your users probably have configured
their devices to save their password
for synchronizing with Microsoft
Exchange Server. That Active Directory (AD) username and password
is often also their main account for
accessing the rest of the Windows
network. Windows Mobile protection
of saved passwords has come under
fire for being easy to break. Therefore,
loss of a device could potentially
result in that user's entire account
being compromised, including all
applications that depend on AD for
authentication.
Asking users to configure mobile
devices with a PIN is likely to meet
with little compliance because of the
inconvenience, especially because
some poorly designed Windows
mobile phone devices require you
to enter the PIN just to answer an
incoming call.
To reduce the risks associated
with mobile devices, you should
consider implementing the Windows
Mobile 5.0 Mobility and Security Feature Pack and insist that all devices
on your fleet either run Windows
Mobile 2005 or fully support the client-side features of the Mobility and
Security Feature Pack. In addition
to the Mobility and Security Feature
Pack's DirectPush technology that
enables mobile devices to immediately receive new email messages
and other mailbox updates as they
occur, it introduces two crucial features for secure management of your
mobile device fleet. Mobility and
Security Feature Pack allows you to
remotely wipe devices that are lost or
stolen and also lets you set a policy
that enforces the use of PINs. If a user
reports a lost or stolen device, you
simply log on to the administration
Web page of the Mobility and Security Feature Pack on your Exchange
server and issue a remote wipe command for that device. If the radio in
the device is turned on, it will immediately wipe the device's memory
and report back to the Exchange
server so that you get positive confirmation. Otherwise, as soon as the
device is turned on, the device will
see the wipe request when it tries to
connect to Exchange.
I recently left my Palm Treo 700w
in a cab and immediately logged on
to Exchange and issued a wipe command. As it turned out, the battery
had already died and I later retrieved
the device from the cab driver. I
was able to log
on to Exchange
and cancel the
wipe command
before bringing
the phone back
up, thus eliminating the need to reconfigure all my phone settings.
The key to making remote wipe work
to mitigate risk is to train users to
notify the Help desk immediately if
their phone is lost or stolen.
End of Article
Register
WM5 SFP can only wipe the local storage, not the additional storage of an SD card. Thus, if an associate losses a device and a wipe is issued, it will get all the data on the device but not the memeory card. Because of that, all a hacker need do is remove the memory card and pull the data off it.
We have talked extensively with Microsoft about this and their solution is to use a third-party solution. Most of the ones they recommended are more expensive than just added a BlackBerry Server to your Enterprise.
This is a nice feature for small businesses but not really for security concious Enterprises.
will.smothers January 11, 2007 (Article Rating: