Security Basics mailing list archives

Re: iTunes for iPhone in an Enterprise


From: Florian Rommel <frommel () gmail com>
Date: Wed, 24 Nov 2010 01:38:54 +0200

I know of at least 2 Fortune 500 companies (excluding Apple) where the iPhone is fully supported in the enterprise. I 
have also deployed it. Personally I think your assessment is wrong. How has RIM more confidentiality than anything 
else? They just provide a better service than most companies did. Then again Nokia's enterprise support and device 
management is up there just like RIM and The new remote config and wipe as well as failed passcode attempt wipes (10x 
wrong and its a goner) AND exchange policy wipe complies with confidentiality. Availability we already have, as long as 
you have an internet connection and Integrity we have as well as other mobile phone companies. 

So I ask again... where is the catch?

I mean ok, i am in Europe and I know that things run a "little" different over the pond but over here HUGE companies 
are flocking to the iphone as an option. Sorry to burst everyone else's bubble but the iPhone is a big player and it 
will stay that way for a while, including the enterprise.

Now, for the record: I don't have an iPhone neither in personal nor in business use. It is heavily used in our company 
but I decided on a Nokia E72. Why? no reason.. pure preference.

My 2c.

On Nov 20, 2010, at 8:56 AM, Adrian J Milanoski wrote:

Hi,

Sorry to burst your bubble about your iPhone in the corporate world but I personnally not even attempt he 
iPhone/iTunes in the corporate world. It was never designed for that.

Personally I have and use an iPhone it's great as a 'personal' phone and no more. Having the ability to deploy and 
manage the secuirty aspects of things is much more important then applications. Blackberries have dominated that 
market and allows you to do and manage everything centerally with a BES server. Both Apple and RIM took different 
routes with their business, personal and enterprise.

Honestly I don't mean to be negative about this but, if your talking this to an enterprise you got to think about 
Confidentiality, Integrity, and Availability.

I have herd of companies wanting to deploy iPhones, but I don't think anything came of it do to these restrictions. I 
would be interested in if anyone else has.






Thanks,
Adrian
_________________
Sent from my iPhone

On 2010-11-17, at 7:54 PM, J Teddy <jteddylists () gmail com> wrote:

Yes, my organisation is a little slow of the mark, and we are now
looking at deploying iPhones.

Currently it appears management is not comfortable with users having
iTunes installed on individuals machines.  I am not sure what these
concerns are.  Apparently other organisations have solved this issue
with using kiosks, and this is the golden bullet that CIO's are
talking about in their circles.
A kiosk is simply just an internal computer that can be used by any
employee, and has iTunes installed.

If my understanding of iTunes is correct, I had some concerns and wish
for your advise, help, and to understand what you did in this instance
of managing iTunes.

My concern is If all corporate users are to share a single instance of
iTunes on a public kiosk computer they will all be required to share
an iTunes account.  This will involve all users knowing the username
(an e-mail address) and password to the account.  The downfall in this
scenario is if a user wishes to purchase content through iTunes the
same content will be shared among all the users.  Further
investigation needs to be taken if this breaches Apple’s acceptable
use policy.  There may also be implications if the user stores their
credit card information for the iTunes account.

A logical solution would be to assign an iTunes account to all users
on the kiosk.  Unfortunately this can cause similar complications to
the above.  All the purchased or downloaded content will be on the
iTunes library which other users will also be able to transfer to
their device (re. investigate acceptable use policy).  If an upgrade
to a purchased application is released and a user other than the
original purchaser wishes to upgrade the application they will be
required to enter in the iTunes account username and password of the
original purchaser.

Individuals will also rely on iTunes to create backups for their
device.  These backups must be encrypted, or another user could
restore their device using another users backup, revealing private
information stored on their device.

If you know anything about the legal side, it would be great to
reference straight from Apple Policy, as I need to find something in
writing.

I have only found the below at this point in time.
* Your Account
** As a registered user of the Service, you may establish an account
("Account"). Don’t reveal your Account information to anyone else. You
are solely responsible for maintaining the confidentiality and
security of your Account and for all activities that occur on or
through your Account"

Thank you all for taking the time out to read my mail, and kudos for
those who help.

Mr. Lacanian

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, 
how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, 
purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for 
set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital 
certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, 
how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, 
purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for 
set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital 
certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------



------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------


Current thread: