Does GOOD Dynamics Proxy comply with EU data legislation?

Question

My client is excited about GOOD technology; it allows them to have controlled access to business applications & email from BYOD (bring your own devices) and will enable a more mobile workforce. Another department within the company has installed GOOD and allows access to email and some whitelisted web apps.

Whilst testing the GOOD browser, we didn't recognise the exit node IP address from the GOOD Browser and it turned out to be some infrastructure hoster that we did not recognise. It turns out that all traffic from the GOOD apps is routed through various proxy servers at GOOD's "Network operations Centre" which itself is hosted on various cloud providers. One would "expect" that the browser would directly access the website — but it doesn't.

The risk is that GOOD themselves, or their cloud suppliers have unencrypted access to all the traffic.

Given that many EU financial organisations use GOOD, how did you get compliance?

• do you include GOOD as a data processor?
• do you allow users to use this for any classification of data?
• or do you restrict the usage?

Answer 1

I am not sure what the concern is here. Presumably you currently use a mail provider that you send unencrypted mail through.

Or if it is sensitive mail, you'll encrypt before you send it, right?

Using Good, you'll be doing the same, but you will have some additional protection for the device itself, and some segregation of your corporate mail from the user's personal mail (ie no copy and pasting from corp email to their own one)

It also allows you to restrict access to applications - allowing users to use their own device to connect, rather than a corporate device. If your data is sensitive you may encrypt end to end anyway, but in any case you'll have a contract with the provider to detail what their responsibilities are.

As regards compliance, where a regulator asks you for your compliance information, those aspects you have outsourced are still within remit, so you need to be able to answer them. The only ways to do this are by requesting this information from the 3rd party or by auditing them.

Answer 2

The fact the GOOD browser uses a proxy isn't really concerning, Blackberry does exactly the same when you have a Blackberry services account.

I suggest you actually hire a consultant or a lawyer to answer this. The questions you are asking and considering your client is probably relating to financial services. You shouldn't be asking this is on a Q and A website. You should be asking the people at GOOD themselves. They should be able to provide ample documentation to show if they are compliant or not.

Answer 3

My company are using this tool to allow staff to access email and apps from their own devices without worrying about whether the iPad or whatnot is compromised or not.

GOOD Dynamics works by issuing a certificate pair to the GOOD server (hosted in your network) and the third party mobile device during provisioning. This is the end to end security wrapper. The GOOD Security system itself also encrypts traffic to and from the NOC -- but essentially, there is never unencrypted data lying around the NOC (unless they have some unknown backdoor key).

google for CESG certification (IL2 I think).