2

Our company recently announced a new IT policy that requires encryption of any personal smartphone used to connect to the corporate Exchange server. As far as I can tell, they're using Exchange ActiveSync encryption.

Part of this new policy is that in the event you lose your phone, you must immediately report it to IT so that they can wipe all data, including personal data.

It is worth noting that our company does work with PHI data covered under HIPAA.

Are there any effective alternate strategies that would allow for employees to access email and calendars from personal smart phones, but which wouldn't expose employees to the risk of having their personal data wiped? Or is the ability to remote wipe all data on a potentially compromised phone an absolute requirement for security?

Improve this question
2
  • Is having a backup of your phone no good? Most of the data on a phone is synced to a cloud account anyways, often - pictures, contacts, emails.... something that is inherently 'backed up' by use. Granted, things like saved games may not be (...maybe, depends on platform) - what are you worried about losing?
    – Clockwork-Muse
    Jun 20, 2013 at 19:52
  • @Clockwork-Muse Pictures, videos, contacts, and emails are all stored in the cloud. I'm not sure about SMS conversations. Then there's app data, customized settings, sideloaded information, locally downloaded documents, auto-complete dictionary, etc.. Basically, I'm looking for a distinction between "work" data and "my" data. The policy itself isn't necessarily bad, and I understand the reason for it; I'm just interested if there are better options.
    – Beofett
    Jun 20, 2013 at 20:05

2 Answers 2

Reset to default
3

There is at least one Exchange compatible Android client that stores the enterprise information in a separate encrypted file and wipes only that file when a device wipe request is issued by Exchange. The down side was I do recall it being something like $50 a seat. Presumably there are similar options for iPhone.

The ability to remote wipe their data is certainly a valid concern, as is the ability to control how it is encrypted on the device. That said, it is more a technical limitation that devices don't provide for secure, segregated storage of the business information. This is why software like the one I mentioned above allow for more granular control by addressing these short comings.

Improve this answer
2
  • Microsoft's own OWA app does this on IOS. (Probably does it on Android too, haven't tested it myself.)
    – Graham Hill
    Jul 21, 2015 at 13:52
  • Yes, that is now an option as is the exchange native app. Both are new since my original post I believe, but thanks for posting an update.
    – AJ Henderson
    Jul 21, 2015 at 14:00
3

I believe that the company is entirely justified in it's approach.

If you want to avoid the risk of having your personal data wiped out, keep your personal and work data separate. Your company might consider deploying something similar to BlackBerry's Secure Work Space technology that claims to keep work data in a completely separate workspace. This should allow your organization to manage it's data in a secure fashion while still allowing employees to use the phone for both work and personal stuff.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .