Willis Mobile Device Access Security Policy. Date: July-2014 Version: 2.0 FINAL

Transcription

1 Willis Mobile Device Access Security Policy Date: July-2014 Version: 2.0 FINAL Willis Mobile Device Access Security Policy v2.0.docx Page: 1/8 30-Jul-2014

2 Contents Introduction... 3 Supported Platforms... 3 Willis Mobile Device Policies... 3 Device PIN/Passcode... 4 Device Controls and File Management... 6 Device Features... 7 Web Browser... 8 Willis Mobile Device Access Security Policy v2.0.docx Page: 2/8 30-Jul-2014

3 Introduction In accordance with the Willis Mobile Policy, all Mobile Devices that are used to access, transmit, store or synchronise Willis data must be enrolled with the Willis device management service - MobileIron. MobileIron, allows Willis to set policies that control corporate applications and data. This document describes the policies and controls that Willis will apply to all mobile devices Supported Platforms The Willis Approved Mobile Device Standards document describes what specific mobile devices are supported by Willis and this should be referred to as changes in support status will be made from time to time. In general, Willis will support the three major mobile device ecosystems Apple (ios), Android and Windows Phone (WP), although Windows Phone will not be fully supported until version WP8.1 is released. Willis Mobile Device Policies The following sections summarise the key areas of security policy that will be applied to MobileIron enrolled devices at Willis. Within each section, there are notes on specific implementation caveats or constraints as they apply to each platform. The definition of each on the columns in the document policy tables is shown below. <Policy Area> Willis Policy Apple ios Android WP The tile/description of a policy attribute or setting The Willis policy that will be applied to this attribute/setting If this policy will be active on ios platforms If this policy will be active on Android platforms If this policy will be active on Windows Phone platforms Willis Mobile Device Access Security Policy v2.0.docx Page: 3/8 30-Jul-2014

4 Device PIN/Passcode MobileIron will be used to enforce a PIN/Passcode on each managed device. There are two PIN/Passcodes that can be applied per device: 1. A main device PIN used to control access to the device itself 2. A PIN to gain access to the MobileIron (AppConnect) services which contain the business related applications that Willis supports. This policy aims to create a balance between usability and security, and for this reason a 4 digit numeric code will be allowed although common number sequences such as 1111, 1234 etc will be blocked. The 2 nd PIN (where used) will be subject to the same restrictions as the device PIN but will have a longer timeout. Users are advised to make the 2 nd PIN (where used) different to the device PIN. Associates are reminded that, in-line with the Corporate Data Security policy, PIN s and Passwords should never be shared with others. Device PIN/Passcode Policy Willis Policy Apple ios Android WP Password Type Numeric Yes Yes Yes Password Digits 4 1 Yes Yes Yes Screen Time-out 5 Minutes Yes Yes Yes Complexity Characters 0 (None) Yes Yes Yes Password Age None Yes Yes Yes Max Failed Attempts 10 Yes Yes Yes Repeat History 5 Yes Yes Yes AppConnect/MobileIron Passcode Policy Willis Policy Apple ios Android WP Passcode Enabled Optional Yes - Passcode Type Numeric Optional Yes - Passcode Digits 4 Optional Yes - Screen Time-out 5 Hours Optional Yes - Complexity Characters 0 (None) Optional Yes - Passcode Age None Optional Yes - Max Failed Attempts 10 Optional Yes - Repeat History 5 Optional Yes - 1 Apple ios On ios we will (by default) set a single PIN that will both unlock the device and allow access to the Willis business applications. 2 Android Phone (WP) On Android devices, it is not possible to implement a single PIN to open the device and to access the Willis applications so 2 PIN s will always be active. On Windows Phone, only a device level passcode is available as there is no MobileIron container at this time. 1 Common sequences of numbers such as 1111, 1234 etc will not be allowed Willis Mobile Device Access Security Policy v2.0.docx Page: 4/8 30-Jul-2014

5 Device Controls The following are general device controls and settings that are used to protect corporate data on MobileIron enrolled devices. Blocking a device will deny access to MobileIron services but will not remove applications or data. Data can be subsequently wiped if the state or issue on the device is not resolved. Device Control & Configuration Willis Policy Apple ios Android WP Remote Lock Support Yes Yes - Remote Wipe All Data Support Yes Yes Yes 2 Remote Wipe Corporate Data Support Yes Yes Yes Whitelist/Blacklist Applications Enable Yes Yes Yes Configure Corporate Secure WiFi Support Yes Yes Yes Connect to any WiFi service Allow Yes Yes Yes Configure Corporate VPN Support Yes Yes - Configure VPN by Application Support Yes Device Compliance Willis Policy Apple ios Android WP Device not connected in X days Alert (21) Yes Yes Yes Policy out of day for X days Alert (10) Yes Yes Yes Device out of compliance 4 Block Yes Yes Yes 5 Storage Encryption Willis Policy Apple ios Android WP Device Encrypt Yes Yes Yes SD Card Encrypt Yes Yes Yes 1 Apple ios ios has the most comprehensive support and a wide range of compliance states/issues can be detected. 2 Android Device controls differ between different Android based hardware. Samsung hardware with the Samsung SAFE feature will have additional options for locking down and wiping devices for example. Phone (WP) Samsung KNOX is an additional licensed component that can be added to specific devices providing per app VPN capability similar to that in ios. Willis will not be support KNOX at this time. WP supports a smaller set of device controls at this time. 2 WP checks for policy changes every 4 hours creating a delay before any changes take effect. ios/android have more immediate responses to policy change 3 Requires MobileIron Tunnel which may incur additional licensing. There is no currently identified requirement for Corporate VPN implementation 4 Compliance state is changed when a device is changed to, disable MobileIron, remove data protection, disable encryption or deactivate administration. 5 Not all compliance states are detected and controls only apply to as there are no AppConnect services on WP Willis Mobile Device Access Security Policy v2.0.docx Page: 5/8 30-Jul-2014

6 and File Management will initially be the primary application deployed on MobileIron managed devices. The main security focus in this area is the securing of messages and the management of attachments avoiding them being saved in unsuitable locations (on unencrypted drives or in unmanaged cloud services for example) or being shared inappropriately. (Exchange) Willis Policy Apple ios Android WP Move/Forward messages to other (personal) accounts Block 6 Yes Yes 7 - Allow access to other (personal) mail accounts Allow 8 Yes Yes Yes AppConnect File Management (including Attachments) Willis Policy Apple ios Android WP Restrict open in/with Manage/Restrict Yes 9 Yes 10 - Save-As local or external drive/cloud Block Yes Yes - 1 Apple ios 2 Android Phone (WP) The native ios client will be supported for corporate . It is possible to fully control which applications (MobileIron managed and unmanaged) are able to open attachments or documents contained within Willis deployed applications. For this reason, we can support more options for consuming and updating data on ios based devices. Due to variances in Android operating system features and the difficulty in gaining consistent control, the Divide client application will be deployed and supported for access to Willis . Control of applications that can be used to open attachments is limited to those which are MobileIron (AppConnect) enabled. The native WP application will be supported for corporate A number of controls are not currently available on the WP platform making the management of and attachments weaker than on ios and Android Documents delivered as attachments or through any other application will only be able to be opened using the built-in MobileIron viewers (Docs@Work) which will maintain content within MobileIron control. On ios, we can exert controls on a wider range of applications so will allow users to optionally (and in addition) use the Microsoft Office suite for ios (via Office 365 subscriptions) but only if Office has been loaded from the Willis application store. Use of Office installed from the itunes store will be block when attempting to consume Willis data. 6 Prevent corporate messages being forwarded by or moved into personal accounts 7 Using Divide application 8 There will be no restriction on the use of personal accounts on enrolled devices. 9 Any application can be allowed or blocked 10 Only AppConnect (MobileIron enabled) applications can be managed Willis Mobile Device Access Security Policy v2.0.docx Page: 6/8 30-Jul-2014

7 Device Features MobileIron is able to control specific device features. The blocking of these features would in general restrict the functionality and productivity gained through the device. AppConnect General Controls Willis Policy Apple ios Android WP Access Camera Allow Yes Yes - Access Media Player Allow Yes Yes - Capture Screen Allow Yes 11 Yes - Copy/Paste Allow (All Apps) Yes Yes - Print Allow Yes Yes - 1 Apple ios All features allowed 2 Android All features allowed Phone (WP) These setting are not available on WP although the impact is minimal as Willis policy will Allow each service to be used. 11 Restricts across all device applications rather than just those managed via MobileIron Willis Mobile Device Access Security Policy v2.0.docx Page: 7/8 30-Jul-2014

8 Web Browser The MobileIron Internet browser supports access to internal (corporate) web sites through a secured tunnel. Internal sites can be configured/published on a site by site basis or by VLAN (address range) or all sites can be exposed through the MobileIron service. Sites published through Web@Work can leverage Active Directory (AD) for authentication. MobileIron singlesign-on (SSO) using certificates is used to provide Kerberos credentials to internal web sites thus avoiding the need for a username/password challenge. In general all *.willis.com addresses will be passed to the Willis internal network via Web@Work and all other sites will be accessed directly from the mobile platform. All sites addressed from the native browser on each mobile platform (Safari on ios, Chrome on Android etc) will be accessed directly with no traffic passing over MobileIron to Willis. Internet Browser (Web@Work) Willis Policy Apple ios Android WP AppConnect Apps access internal (Intranet) web sites Allow 12 Yes Yes - AppConnect Apps access external (Internet) web sites Disable 13 Yes Yes - 1 Apple ios Selected internal sites will be made available 2 Android Selected internal sites will be made available Phone (WP) The Web@Work feature is not currently available on WP so no internal (Willis) web sites will be accessible from a WP based device. 12 Access to individually published sites or groups of sites (by VLAN) only 13 MobileIron managed applications will browse via Willis so will be subject to normal proxy controls Willis Mobile Device Access Security Policy v2.0.docx Page: 8/8 30-Jul-2014