My client is excited about GOOD technology; it allows them to have controlled access to business applications & email from BYOD (bring your own devices) and will enable a more mobile workforce. Another department within the company has installed GOOD and allows access to email and some whitelisted web apps.
Whilst testing the GOOD browser, we didn't recognise the exit node IP address from the GOOD Browser and it turned out to be some infrastructure hoster that we did not recognise. It turns out that all traffic from the GOOD apps is routed through various proxy servers at GOOD's "Network operations Centre" which itself is hosted on various cloud providers. One would "expect" that the browser would directly access the website — but it doesn't.
The risk is that GOOD themselves, or their cloud suppliers have unencrypted access to all the traffic.
Given that many EU financial organisations use GOOD, how did you get compliance?
- do you include GOOD as a data processor?
- do you allow users to use this for any classification of data?
- or do you restrict the usage?