Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Our company recently announced a new IT policy that requires encryption of any personal smartphone used to connect to the corporate Exchange server. As far as I can tell, they're using Exchange ActiveSync encryption.

Part of this new policy is that in the event you lose your phone, you must immediately report it to IT so that they can wipe all data, including personal data.

It is worth noting that our company does work with PHI data covered under HIPAA.

Are there any effective alternate strategies that would allow for employees to access email and calendars from personal smart phones, but which wouldn't expose employees to the risk of having their personal data wiped? Or is the ability to remote wipe all data on a potentially compromised phone an absolute requirement for security?

share|improve this question
    
Is having a backup of your phone no good? Most of the data on a phone is synced to a cloud account anyways, often - pictures, contacts, emails.... something that is inherently 'backed up' by use. Granted, things like saved games may not be (...maybe, depends on platform) - what are you worried about losing? –  Clockwork-Muse Jun 20 '13 at 19:52
    
@Clockwork-Muse Pictures, videos, contacts, and emails are all stored in the cloud. I'm not sure about SMS conversations. Then there's app data, customized settings, sideloaded information, locally downloaded documents, auto-complete dictionary, etc.. Basically, I'm looking for a distinction between "work" data and "my" data. The policy itself isn't necessarily bad, and I understand the reason for it; I'm just interested if there are better options. –  Beofett Jun 20 '13 at 20:05
add comment

2 Answers

I believe that the company is entirely justified in it's approach.

If you want to avoid the risk of having your personal data wiped out, keep your personal and work data separate. Your company might consider deploying something similar to BlackBerry's Secure Work Space technology that claims to keep work data in a completely separate workspace. This should allow your organization to manage it's data in a secure fashion while still allowing employees to use the phone for both work and personal stuff.

share|improve this answer
add comment

There is at least one Exchange compatible Android client that stores the enterprise information in a separate encrypted file and wipes only that file when a device wipe request is issued by Exchange. The down side was I do recall it being something like $50 a seat. Presumably there are similar options for iPhone.

The ability to remote wipe their data is certainly a valid concern, as is the ability to control how it is encrypted on the device. That said, it is more a technical limitation that devices don't provide for secure, segregated storage of the business information. This is why software like the one I mentioned above allow for more granular control by addressing these short comings.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.