About the only way is to allow them to use corporate devices only and enforce that by using some method that is only deployed to corporate machines. The same technical risk applies to smartphones as it does to laptops and home desktops - just the likelihood of the event occuring goes up the more portable the device becomes.
The downside of this is that people will be unhappy. How big of a deal that is will depend on your company.
The two main things that come to mind are:
1) Require VPN access that uses a certificate to authenticate. Make sure that the certificate is specified as being non-exportable when installed. This can be set via the CA template if you run your own CA, or you could have a specific administrator controlled workstation that creates the certificates and exports them - during the export the certificate and private key you can flag it as being non-exportable when you create the PKCS #12 (.pfx) file. When they go to import, then the non-exportable flag is already set and greyed out. Remember to delete the .pfx file from the user's machine after import so they can't use that on another machine (even if it is password protected... users have a nasty habit of eventually finding out default passwords for things that they need/want access to).
The cert could be imported into whatever device by an admin. If they are allowed to use a personal machine, they should sign something that they accept the responsibility for their actions, not save data (or protect it as if they were at work if they are allowed to save), etc. -- some kind of policy anyways that they are read and agree to by signing. Then they have to bring their computer in to get the cert installed or allow you to remote into their home desktop. If you're concerned about the legal aspects of dealing with home computers for a business environment, talk to a lawyer to set up an appropriate waiver and such - not my area of expertise.
So then their email is only accessible via the internal network - if they aren't on the internal network then they need to VPN or whatever to get in.
Another idea instead of VPN would be using citrix or a terminal server to allow internal access. With these, a smartcard could be used for windows logon as a requirement. Although technically there are smartcard readers out there for smartphones, they are spendy enough to keep most people from going that route (a couple hundred bucks or so). Technically there is a workaround due to this, so this might not be the best method for you, but is a thought.
2) Client authentication cerificates - have the website require client authentication certificates. This can be used instead of, but more commonly in addition to, their normal username/password logon page. Basically they need to authenticate using the cert then they get access to the normal logon page, etc. This is a setting with IIS (or most popular web server products like apache, for that matter). This is best done if issued from your own CA so you can declare that under the root trust list that is defined within this area (not the normal root certificate store for the rest of windows), so a similar type of certificate cannot be purchased by the user from a commercial CA.
Similar concept here for the non-exportable certs.
Main Topics
Browse All Topics
by: MesthaPosted on 2009-10-21 at 13:58:26ID: 25628339
This question has come up before.
For devices that use ActiveSync you can disable the feature.
However Blackberry is designed to use OWA as the interface, so stopping it is quite hard. You would have to block access from the Blackberry IP address range to the server. That is best done with an ISA server.
Simon.