Securing Exchange Data from Unapproved Mobile Devices (or how to block a phone or service from taking data out of your Exchange Server)

re: Securing Exchange Data from Unapproved Mobile Devices (or how to block a phone or service from taking data out of your Exchange Server)

Dnalor — Wed, 12 Nov 2008 04:55:54 GMT

This article has some serious flaws

What about the concept of least privilege?

You should deny all access first thewn make exceptions for your known mobiles and servers. I think you should rewrite this

re: Securing Exchange Data from Unapproved Mobile Devices (or how to block a phone or service from taking data out of your Exchange Server)

Patrick Butler — Mon, 20 Oct 2008 20:15:38 GMT

Intresting article. Makes me wonder if this can be done to control Iphone usage as well. While we do want to allow users to use an iphone we want to control WHO is using them. I figure if we place the rule with an exception........ Also I wonder if the User-Agent string is known for the Iphone?

re: Securing Exchange Data from Unapproved Mobile Devices (or how to block a phone or service from taking data out of your Exchange Server)

F. Andy Seidl — Sun, 21 Sep 2008 06:00:42 GMT

As a webmaster, you definitely should use user-agent headers to manager server traffic. But understand that this is purely a pragmatic tactic and not a serious security measure.

I wrote more about this here:

Webmaster Tips: Blocking Selected User-Agents
<a href="http://faseidl.com/public/item/213126">http://faseidl.com/public/item/213126</a>

re: Securing Exchange Data from Unapproved Mobile Devices (or how to block a phone or service from taking data out of your Exchange Server)

Brian Wing — Thu, 11 Sep 2008 17:50:50 GMT

Hi Peter,
We disallow all of our users access via ActiveSync, and then we lock them down to a single device when they request access.

One quesiton, if you lock them down using the set-casmailbox <userid> -ActiveSyncAllowedDeviceIds <deviceID> how do you remove the ID from thier cas-mailbox settings?

I know you can remove device partnerships with OWA, ps, or EMC, but it doesn't remove the deviceID you manually set.

Thanks
Brian

re: Securing Exchange Data from Unapproved Mobile Devices (or how to block a phone or service from taking data out of your Exchange Server)

Adam Glick — Mon, 08 Sep 2008 21:04:03 GMT

Hi Peter,
The issue you refer to happens on devices that don't have any policy set. Since the remote wipe is sent down with/as a policy, if no policy is set, then it prompts for one. The most common is PIN policy which is why you see it ask for a password to be set up (you could define a policy where a PIN wasn't required but you would still get a policy prompt). In Exchange Server 2007 SP1, we introduced a "Default" policy that Admins could set. With a default policy, you will not run into the "prompt for policy" on a wipe as all device that connect will automatically have policies pushed down to them (even if that policy has no PIN requirements in it). It is always a good idea to have some policies applied to all devices that connect to your Exchange Server. Using the Default policy in SP1 will make this simple and the prompt issue experienced by organizations that didn't previously apply policies will become a thing of the past. If you are not on Exchange Server 2007 SP1 I’d recommend upgrading or setting a policy that you apply to all users and this will avoid the situation you are referring to.

re: Securing Exchange Data from Unapproved Mobile Devices (or how to block a phone or service from taking data out of your Exchange Server)

bday — Mon, 08 Sep 2008 15:24:01 GMT

Excellent. We're about to upgrade to ISA 2006 fom 2004 so this is nice to see. Now if we could only find a way to block specific models. : ) A great start!

re: Securing Exchange Data from Unapproved Mobile Devices (or how to block a phone or service from taking data out of your Exchange Server)

Peter — Sat, 06 Sep 2008 22:14:07 GMT

On a somewhat related note, why is it necessary to require a password on a mobile device in order to remotely wipe it?
Obviously, using a password on the device is more secure regardless of whether you use ActiveSync or not. But it is exactly the non-protected devices that I am most concerned about and want to be able to remotely wipe.
I would love to be able to wipe lost devices but I know I would get a huge amount of resistance if it also meant requiring a password on the device.
Is there any way to remotely wipe a device without requiring a password also?
Thanks.