Droid security issue with MS Exchange (Motorola, 3G, Verizon, iPhone)

[ToucheGA]

I work for a large corporation that uses Microsoft Exchange. Currently, our policy states that employees can only access the Exchange network via smartphone if they are using:

· Blackberry (any currently supported)
· iPhone 3GS with free upgrade to iOS4 and later (this includes the iPad and iPad 3G)
· Windows Mobile 6.1 and later

"Unsupported devices" include:

· Android and Android O.S. devices (Current versions do not currently meet security controls. Version 2.2 will be evaluated. There are plans to adopt a software product in 2011 that could bring these devices to an appropriate security level and move them to an approved and supported device. Communications will be distributed once those plans are finalized.)
· Palm Devices (e.g. Palm Pre, Pixi) running Palm WebOS
· Windows Mobile 6.0 and earlier
· iPhone 3G
· Any other devices that do not natively support encryption

What makes the Android OS less secure that the other mobile OS’s? Is it simply because the OS lacks "native encryption?"

Does anyone know what (if any) security enhancements might be introduced with Android 2.2, and if these enhancements would bring the software up to par with the iPhone, Blackberry, and Windows Mobile?
Thanks!

[Peregrine]

Erring on the side of caution I suppose. The Droid supports SSL encryption. That's all you need if your email server is set up properly. If you have Outlook Web Access I am not even sure how they could prevent you from running a Droid.

We run Droids on our Exchange server. Currently 4 of them. It works well.

[ToucheGA]

We have web access, but it is only available on-site.

[hillcountrywinefan]

I know this is a bit of topic-drift, but I'd love to see Citrix release a Xenapp client for Android. Then you could access your Exchange servers seamlessly.

[Peregrine]

Originally Posted by ToucheGA

We have web access, but it is only available on-site.

That's odd. What's the point of having it? Do you use Outlook at the office?

[ToucheGA]

Originally Posted by Peregrine

That's odd. What's the point of having it? Do you use Outlook at the office?

We do, but some workstations don't have MS Office installed.

[Peregrine]

Just looked into the new 2.2 update that Verizon is rolling out for my Motorola Droid this week. It includes new security measures for Microsoft Exchange which, yes, does bring it up to the level of those other phones.
The Incredible should get the update soon after this. And Droid X ships with 2.2.
So just hang in there.
Plus it also allows "remote wipe" which is big for corporate users. You lose your phone and your IT department can wipe it remotely.

http://support.vzw.com/pdf/system_update/moto_droid.pdf

[ToucheGA]

Originally Posted by Peregrine

Just looked into the new 2.2 update that Verizon is rolling out for my Motorola Droid this week. It includes new security measures for Microsoft Exchange which, yes, does bring it up to the level of those other phones.
The Incredible should get the update soon after this. And Droid X ships with 2.2.
So just hang in there.
Plus it also allows "remote wipe" which is big for corporate users. You lose your phone and your IT department can wipe it remotely.

http://support.vzw.com/pdf/system_update/moto_droid.pdf

I think/hope that this is what my company is looking for before they approve the Droid. Thanks!!

[Peregrine]

Yea, just got emailed another article about it: it's officially supporting the things that Gartner wants it to to receive official status as a trusted device.

Article:
Motorola Droid Receiving Android 2.2 Update This Week -- InformationWeek

Snippet:
Android 2.2 really ramps up security with much better password support. Exchange administrators can enforce password policies, which now include numeric pin or alpha-numeric password options to unlock the device. Remote wipe is the other big one. Exchange administrators can remotely reset the device to factory defaults to secure data in case the device is lost or stolen.

Those are the big ones for IT admins to be concerned with. There are also some user-facing changes that will fall into the "thank goodness they finally did that" category. For example, Exchange Calendars are now supported, which syncs enterprise calendar data with the devices. Android 2.2 also adds global address lists. This means users can search through their corporate directory from within the handset's e-mail application.

____
(Exchange calendars work now, public folders do not)