Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My client is excited about GOOD technology; it allows them to have controlled access to business applications & email from BYOD (bring your own devices) and will enable a more mobile workforce. Another department within the company has installed GOOD and allows access to email and some whitelisted web apps.

Whilst testing the GOOD browser, we didn't recognise the exit node IP address from the GOOD Browser and it turned out to be some infrastructure hoster that we did not recognise. It turns out that all traffic from the GOOD apps is routed through various proxy servers at GOOD's "Network operations Centre" which itself is hosted on various cloud providers. One would "expect" that the browser would directly access the website — but it doesn't.

The risk is that GOOD themselves, or their cloud suppliers have unencrypted access to all the traffic.

Given that many EU financial organisations use GOOD, how did you get compliance?

  • do you include GOOD as a data processor?
  • do you allow users to use this for any classification of data?
  • or do you restrict the usage?
share|improve this question
2  
What? This looks like an advert for something, or market research. I've never even heard of "GOOD", and there's no Wikipedia entry for it. Is it a commercial product? What're you actually asking here? What problem are you trying to solve? –  Polynomial Nov 28 '12 at 10:33
1  
GOOD is a mailclient, it's widely used on iPhone and Android. We use it as well. I think I posted some Q/A on it a while back. –  Lucas Kauffman Nov 28 '12 at 10:45
    
Cheers for the info. –  Polynomial Nov 28 '12 at 10:48
    
@Poly - read www1.good.com/iphone - Good For Enterprise is pretty widely used now, especially in financial services. It's a bit like AirWatch. –  Rory Alsop Nov 28 '12 at 11:01
    
@RoryAlsop Thanks for the link. I've added it to the question. –  Polynomial Nov 28 '12 at 13:12
add comment

3 Answers

My company are using this tool to allow staff to access email and apps from their own devices without worrying about whether the iPad or whatnot is compromised or not.

GOOD Dynamics works by issuing a certificate pair to the GOOD server (hosted in your network) and the third party mobile device during provisioning. This is the end to end security wrapper. The GOOD Security system itself also encrypts traffic to and from the NOC -- but essentially, there is never unencrypted data lying around the NOC (unless they have some unknown backdoor key).

google for CESG certification (IL2 I think).

share|improve this answer
add comment

I am not sure what the concern is here. Presumably you currently use a mail provider that you send unencrypted mail through.

Or if it is sensitive mail, you'll encrypt before you send it, right?

Using Good, you'll be doing the same, but you will have some additional protection for the device itself, and some segregation of your corporate mail from the user's personal mail (ie no copy and pasting from corp email to their own one)

It also allows you to restrict access to applications - allowing users to use their own device to connect, rather than a corporate device. If your data is sensitive you may encrypt end to end anyway, but in any case you'll have a contract with the provider to detail what their responsibilities are.

As regards compliance, where a regulator asks you for your compliance information, those aspects you have outsourced are still within remit, so you need to be able to answer them. The only ways to do this are by requesting this information from the 3rd party or by auditing them.

share|improve this answer
add comment

The fact the GOOD browser uses a proxy isn't really concerning, Blackberry does exactly the same when you have a Blackberry services account.

I suggest you actually hire a consultant or a lawyer to answer this. The questions you are asking and considering your client is probably relating to financial services. You shouldn't be asking this is on a Q and A website. You should be asking the people at GOOD themselves. They should be able to provide ample documentation to show if they are compliant or not.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.