Supporting iPhones and Exchange? Today could be a very bad day…
By Simon Bisson & Mary Branscombe in Editorial
Posted in Enterprise, Security, Email, Apple on
If you’re an Exchange admin, use the “Require encryption on the device” policy, and you’ve got users out there who are using first and second generation iPhones to get their mail over Exchange ActiveSync, then be prepared for a whole rush of support calls as users update to the latest version of the iPhone OS.
Why?
Because iPhones have stopped lying to Exchange servers.
The hardware on earlier iPhone models doesn’t have the power needed to support whole device encryption -you need the 3GS for that - and that means that if your business needs to secure its mail, then most of the iPhones out there can’t be trusted. Apple’s earlier versions of the iPhone email software just ignored that policy setting, and reported back that all policies had been applied.
That meant that devices that should have been encrypted (either for corporate or regulatory reasons) weren’t - and all the mail on them was available for anyone with a USB connection and the appropriate software.
As I’m sure you can guess, that drove a coach and horses through your security policies, and opened your business up to all sorts of regulatory problems.
Now at least those phones will stop getting mail.
But it’s a bit of a worrying thought that one of the most popular phones in the world was skating past security policies. Of course that leaves us with two more worrying thoughts:
First, how many other phones out there are doing just that without you knowing?
And secondly, just how are you going to tell your bosses that they can’t use their phones for email any more?
Rated: 20% (1 votes)
Loading ...Comment by fireball_xl5 - September 15, 2009 on 9:17 am
But surely all those experienced Exchange Admins out there would have rigorously followed their corporate tried-and-tested Release/Deploy and Change policies, processes and procedures and identified this security issue PRIOR to rolling out the ‘phones……. wouldn’t they?
Comment by - September 15, 2009 on 10:58 am
We never allowed Iphones to connect to our servers. Not because of the security but we couldnt be bothered to support different handsets. HTC Touch pro for everyone here. Its not a great phone but seems to do for business purposes.
Comment by - September 15, 2009 on 11:02 am
@fireball - but how would you know that a handset was accepting the policy and not doing the encryption? Nokia N series phones don’t have the oomph to do the encryption, so they don’t get the mail - Apple just lied to the server. It’s all about root of trust, and Apple dug that out.
@David - have you checked out the Touch Pro 2? Beautiful, beautiful business phone with a superb speakerphone and phone conferencing tool.
Comment by - September 16, 2009 on 8:27 am
@Simon & Mary: “But it’s a bit of a worrying thought that one of the most popular phones in the world was skating past security policies.”
More hype — it’s a fact that the iPhone is still a *minority* player in the mobile world. It is *not* one of the most popular.
One can never fully trust any device that runs secret, proprietary code for the simple reason that it cannot be tested. You don’t know what that code is doing; that’s what makes it secret. When are people going to realize that?
Admittedly, in the mobile world there is not much choice at present, but Android has begun to change that.
Comment by - September 16, 2009 on 11:06 am
@tricky
The iPhone hasn’t sold as well as the BlackBerry, certainly, and overall Windows Mobile has sold more - and of course Nokia is still the big name in Europe at least. The G1 one sold perhaps 100,000 units in the UK; iPhones and various Windows Mobile units sold more like a million in the same time. The iPhone has plenty of flaws, but you can’t seriously deny that it’s popular.
Android isn’t offering any more choice than any other smartphone platform and I’d encourage you to go find out exactly how much of the Android platform is open source and how much of it isn’t, and perhaps to learn about platform APIs that allow you to discover what an OS is doing without delving into source code.
M
Comment by - September 16, 2009 on 5:38 pm
@Simon & Mary: You told us that the iPhone was not just popular but was “one of the most popular phones in the world”, so I’ll say again — stop hyping it.
I also find your reply incredibly patronising. You suggest that I “learn about platform APIs” but you know nothing about me or what I do. If you seriously believe that you can “discover what an OS is doing without delving into source code” then you are the ones that should be re-educated. If an API gave you all the information about a secret, proprietary OS then it would no longer be secret would it. Even reverse engineering rarely provides all the answers. All an API of proprietary code does is to supply you with the information necessary to hook into that code. As the acronym suggests its merely an interface — an Application Programming Interface.
Furthermore, as you appear to know so much about Android perhaps you could reveal to us “how much of the Android platform is open source and how much of it isn’t”.
Trackback by - February 9, 2012 on 5:39 am
will smith beatboxing…
[…]Tennis League (WHL). With a great deal of great brains at the rear of these products and […]…
Make a comment
Tag cloud
Archives
- September 2009
- August 2009
- July 2009
- June 2009
- May 2009
- April 2009
- March 2009
- February 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
- July 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- December 2006
- November 2006
- October 2006
- September 2006
Most commented posts
- Java's SSVAGENT.EXE: training the monkey
102 comments
- When Windows 7 upgrades won’t hibernate (the solution)
- Do you need IPv6 for DirectAccess? Yes and No
- Chrome OS: what happens when "always connected", isn't?
- The ColdFusion Renaissance
- There’s a reason smartphones are locked down
- Is there a showstopper bug in Windows 7 CHKDSK?
- The LHC isn
- At sixes and Windows 7s
- Make Adobe Acrobat Pro deactivate
Highest Rated Blog Posts
- Songs of distant satellites (100%)
- Nobody knows what Web 2.0 really is (100%)
- Log in and lock in (100%)
- Top tips for speeding up Vista (100%)
- Mommy, why is there a home server in the office? (100%)
- Employees are our most valuable asset (snigger) (100%)
- Locking down IT or blocking creativity (100%)
- Consumer BlackBerrys are good for business (100%)
- HD Trek (100%)
- Join the (beta) community (100%)
