2

1.4 install personal firewall software on any mobile and/or employee-owned computers with direct connectivity to the Internet (for example, laptops used by employees), which are used to access the organization’s network.

If company employees have their own mobile devices that don't connect to the internal network however they do connect to an internet facing company mail server using encryption. In this case does this apply? How about for company owned phones with the same setup?

My thinking is that neither employee owned nor company owned phones would apply as long as there's no cardholder data in their email that would get stored on their phones. Any clarification on this would be greatly appreciated.

Improve this question

1 Answer 1

Reset to default
2

Email servers can be considered an 'outside' company resource, depending on configuration. In that case, if the mobile device only connects to the email server, it is not connecting to the internal network and therefore would not apply to the 1.4 requirement.

But I can think of configurations where accessing the email server could be considered 'inside' access, so I can't make a blanket statement. That's why there are consultants to handle these questions for your specific instance.

Improve this answer
1
  • Thank you that's exactly what I was looking for. They access the email server over an encrypted connection that's not a VPN connection. Their phone wouldn't have access to any resource on the internal network.
    – Four_0h_Three
    May 28, 2014 at 19:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.