Considering that the iPhone 3GS and the iPhone 4 (and the latest iPad) all support local device encryption, how do you enforce that only secure devices can connect to your ActiveSync endpoint?
In other words, how do you prevent older iPhones and iPads (that do not support local encryption) from accessing the server, and downloading messages with attachments to unprotected storage?
Remember that even a device with local encryption may have no passcode lock, and may be backed up via iTunes to an unencrypted volume. If that volume is on a laptop, then it's just as portable and losable.
Exchange 2010 / Windows R2
Exchange 2010 includes much of this functionality built-in, and IIS in 2008R2 allows the ability to filter on URLs similar to the 2003 solution below.
Command line junkies can manage devices and default policies as well. As far as I can tell, there is complete feature parity between the ECP and the commandline :
Get-ActiveSyncOrganizationSettings | fl UserMailInsert, AdminMailRecipients, DafaultAccessLevel
Set-ActiveSyncOrganizationSettings -UserMailInsert "Your phone has not been approved, contact IT at x443 to enable email access for this phone" -AdminMailRecipients [email protected]
Exchange 2003 / Windows 2003
We installed Mod_Rewrite (an Apache port to IIS) on each of our Exchange 2003/Front End servers to control access.
Here is the ruleset we are planning on putting into production and will block access to these servers based on the User_Agent field. Note: This ruleset is still in testing and may be revised. If you have comments, please add them.
############## RULE 1 ###############
#
# Exclude Disallowed Devices
#
#Do match and prevent version 4.3.2 (Part 1)
# RewriteCond %{HTTP_USER_AGENT} Apple-iPhone2C1/801.8* [NC,OR]
# RewriteCond %{HTTP_USER_AGENT} Apple-iPhone3C1/808.8* [NC,OR]
# RewriteCond %{HTTP_USER_AGENT} Apple-iPad2C3/808.8* [NC,OR]
#Do match and prevent version 4.3.2 (Part 2)
# RewriteCond %{HTTP_USER_AGENT} Apple-iPhone2C1/801.7* [NC,OR]
# RewriteCond %{HTTP_USER_AGENT} Apple-iPhone3C1/808.7* [NC,OR]
# RewriteCond %{HTTP_USER_AGENT} Apple-iPad2C1/808.7* [NC,OR]
# RewriteCond %{HTTP_USER_AGENT} Apple-iPad1C1/808.7* [NC,OR]
#Do match and prevent version 4.0
RewriteCond %{HTTP_USER_AGENT} Apple-iPhone2C1/801.293.* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Apple-iPhone3C1/801.293.* [NC,OR]
#Do match and prevent version 3.13 , 3.21 , 3.2
RewriteCond %{HTTP_USER_AGENT} Apple-iPhone2C1/70.* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} Apple-iPhone3C1/70.* [NC,OR]
#Do match and prevent iPad version 3.2 (7b367)
RewriteCond %{HTTP_USER_AGENT} Apple-iPad/702.* [NC,OR]
#Do match and prevent iPad version 3.3X?
RewriteCond %{HTTP_USER_AGENT} Apple-iPad1C1/702.500.* [NC]
RewriteRule ^(.*)$ http://www.nfp.com?rule1 [R=301,L]
############## RULE 2 ###############
#
# Only Permit iPhones and iPads to connect.
# If they got this far, then they are not a banned / blacklisted device.
#
RewriteCond %{HTTP_USER_AGENT} .*iPhone.* [NC]
# Do not alter the URL, and let it come through unmodified.
RewriteRule ^.*$ - [NC,L]
RewriteCond %{HTTP_USER_AGENT} .*iPad.* [NC]
# Do not alter the URL, and let it come through unmodified.
RewriteRule ^.*$ - [NC,L]
############## RULE 3 ###############
#
# Block all other devices, deny rule
#
RewriteRule ^(.*)$ http://www.nfp.com/?rule=3 [L,R=301]
#Device Reference
#iPhone Simulator == i386
#iPhone == iPhone
#3G iPhone == iPhone1C2
#3GS iPhone == iPhone2C1
#4 iPhone == iPhone3C1
#1st Gen iPod == iPod1C1
#2nd Gen iPod == iPod2C1
#3rd Gen iPod == iPod3C1
#Apple-iPad1C1
# The 1st part of that string is always just "Apple-".
# The 2nd part of the string is DeviceType and is defined just
# like the URL above and is either "iPhone" or "iPad".
# The 3rd part of that string is just a delimiter "/".
# The 4th and final part of that string is the software version formatted in a way that Exchange Servers can digest it.
# Here's an example of creating that 4th part of the string using software build version for iPhone which is 7E18 aka iPhone OS 3.1.3.
# The first number from 7E18 (the 7) will become a "7" in the translated string.
# The first letter from 7E18 (the E) will become a "05" since it is the 5th letter of the English alphabet.
# Then you insert a "." (dot).
# The second number from 7E18 (the 18) will become "18". It will be padded with zeros to be 3 digits
You can use certificate based authentication. If you don't provide a certificate they can't authenticate. Here's one link on it, but may be different depending on your version of Exchange.
This adds some operational overhead if you want to support mobile devices, you need to provide and install the certificates. But it will let you choose which devices can and can't connect.
http://technet.microsoft.com/en-us/library/bb430770.aspx
Edit: Adding links on setting up ActiveSync with certificates.
http://www.expta.com/2010/02/how-to-securely-deploy-iphones-with.html
http://images.apple.com/iphone/business/docs/iPhone_Certificates.pdf
You might consider evaluating Good Technology's product? It appears like it might address your concerns and even allow you to securely support a wider range of devices. It would unfortunately add an additional layer of software and increase your cost.
In the iPhone enterprise deployment guide, there's a section on Exchange ActiveSync, which mentions the "Require Device Encryption" policy which should prevent non-encrpyted iOS devices from connecting to the service.
Codeproof MDM integrates with Exchange Server and provides various rules to block/allow devices with various device properties. You may want to check it out.
Disclosure: I work for Codeproof.
---------More details added as per the member request---------------
Codeproof is easy to use, low-cost, SaaS based MDM Service. Recently we added a new exchange activesync security feature called "Codeproof SecureSync". We have developed exchange plugins which communicates with your Codeproof account and where you can set various rules to allow/block devices such as block jailbroken devices, unlocked devices..etc. Some rules requires Codeproof Agent App to be installed on your mobile devices.
Management Console UI:
