Re: iPad / mobile device security and policy

["SCHALIP, MICHAEL" <mschalip () CNM EDU>]

I'm not an iPad user, so - forgive the questions - is all of this done through the onboard firmware/softare?.....or are 
you using a 3rd party package to do this?  We're still moving to Symantec Endpoint Encryption, and I'm hoping they come 
up with an iPad client.....

M

________________________________________
From: The EDUCAUSE Security Constituent Group Listserv [SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Webb, Justin 
[justin.webb () MARQUETTE EDU]
Sent: Wednesday, February 02, 2011 12:16 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] iPad / mobile device security and policy

We are finalizing our iPad/iPhone/iPod policy and will be including a requirement that a basic passcode be placed on 
our "base" level configuration, which is for all students and staff. We have a higher tiered approach for shared iPads, 
and finally, we have a full lockdown configuration that will be used when the iPad could potentially contain sensitive 
data. This last profile requires an alphanumeric unlock code, it wipes after 10 failed attempts, encrypts backups, sets 
up our Wifi, email, and configures the VPN client. The profile can only be removed by an administrator.

Sincerely,

Justin P. Webb, GCIH
Security Analyst
IT Services, Marquette University
414-288-4196
justin.webb () marquette edu

-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Flynn, 
Gary - flynngn
Sent: Wednesday, February 02, 2011 10:57 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] iPad / mobile device security and policy

Along this line, what are people's thoughts on requiring a passcode on
aphone or other mobile device whether it is enforced through something
like ActiveSync or not? Having hundreds or thousands of mobile devices
configured with a campus email account that anyone having physical access
to the phone can reach is a bit unnerving. But a lot of people don't like
the inconvenience of having to type a passcode to unlock the device before
using it.



-----Original Message-----
From: Marty Manjak <mm376 () ALBANY EDU>
Organization: University at Albany
Reply-To: <mm376 () albany edu>
Date: Wed, 2 Feb 2011 11:19:31 -0500
To: <SECURITY () LISTSERV EDUCAUSE EDU>
Subject: Re: [SECURITY] iPad / mobile device security and policy

> Lewis,
>
> We are considering using ActiveSynch to push a basic security policy out
> to personally-owned mobile devices as a condition to getting access to
> institutional business records.
>
> We currently do this with Blackberries that are managed through our own
> BES server.
>
> We have a campus Information Security Council whose membership includes
> the major data owners (Registrar, HR, Accounting, etc.). That's the
> governance body that will formulate the policy requiring
> personally-owned devices to comply with the acceptance of the security
> policy.
>
> This is all in the planning stages but that is the direction and the
> control mechanism that we are looking to implement.
>
>
>
> On 02/01/2011 11:46 PM, Watkins, Lewis wrote:
> > I'm looking for model policies and processes for managing iPad use in
> > campus environments?  Does your institution have iPad specific policies,
> > or are iPads included in a broader mobile device policy?  How do your
> > faculty and administrators currently use iPads?  Are any limits place on
> > their use? Do you have specific configuraiton requirements or
> > recommendations?   How concerned are you about the security of iPads,
> > particularly for use with confidential information?   Thank you for any
> > guidance, advice, or references you can provide.
> >
> >   Lewis
> > ____________________________
> > Lewis Watkins, CISO
> > University of Texas System
>
> --
> Marty Manjak
> Information Security Officer
> University at Albany
> 518/437-3813
> CISSP, GSEC, GCIH, GWIN


--
Gary Flynn

Security Engineer
James Madison University

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.