Windows Phone 7 Security and Management_FINAL_122010

dows® Phone 7 for IT professionals
Microsoft Exchange ActiveSync (EAS) security–related policies
EAS is a time-tested and robust communications protocol that provides Windows® Phone 7 users with worldclass mailbox synchronization functionality. Windows Phone 7 phones ship with version 14.0 of the EAS protocol. EAS also provides the ability to manage security for Windows Phone 7 users through the use of security – related policies that are configured by IT departments, similar to Group Policy settings for operating systems and applications. EAS security–related configuration policies that can be managed by the IT department include the following: [PasswordRequired] requires the user to set a device locking personal identification number (PIN) before the phone starts synchronizing email, calendar and contact information with a Microsoft Exchange Server. [PasswordExpiration] sets the validity period of a PIN, after which the PIN has to be renewed. [PasswordHistory] prevents the user from re-using the same PIN repeatedly. [AllowSimplePassword] can be used to prevent the user from using a simple PIN, such as 1111. [MinPasswordLength] sets the minimal number of numeric characters in the PIN. [IdleTimeoutFrequencyType] defines the time before a phone locks when not in use. [DeviceWipeThreshold] defines the number of times a wrong PIN can be used before the phone wipes and resets to factory settings.
Windows® Phone 7 for IT professionals
Windows® Phone 7 security and management
This article is part of an ongoing series designed to help IT professionals evaluate Windows® Phone 7 and understand how it can play a role in their organization. The articles in this series will focus on different topics of interest, such as Windows Phone 7 features, using Windows Phone 7 devices with other applications such as Microsoft® SharePoint®, and the Windows Phone 7 architecture. This article discusses security and management for Windows Phone 7. It provides information about the holistic security approach that was used when Windows Phone 7 was designed, as well as information about Microsoft Exchange ActiveSync® (EAS) security–related policies that can be managed by IT departments and data protection considerations. This article includes the following topics: A holistic approach to security Microsoft Exchange ActiveSync® (EAS) security–related policies Data protection considerations
The Windows Phone 7 design includes numerous data protection considerations. At a basic level, Windows Phone 7 devices can be secured through PIN-lock and associated EAS password policies. Other data protection considerations include the following: Data in transit. Windows Phone 7 encrypts all data using Secure Socket Layer (SSL). Depending on the server connection, the cipher used is 128-bit or 256-bit. Implementing industry standards enables Windows Phone 7 to connect to on–premises and cloud–based services such as Exchange Server and SharePoint Server. No tethered file system access from a PC. Microsoft Zune® software, the desktop application that connects Windows Phone 7 to Windows–based PCs, does not provide access to the phone’s file system from the PC. This approach prevents users from copying or removing documents from the phone. The Zune software can only be used to synchronize media files (such as music, picture, and video files) with a PC. (RAPI is not supported on Windows Phone 7.) No support for removable storage. To further mitigate security risks, Windows Phone 7 prevents transfer of data off the phone by not supporting removable data storage cards. Windows Phone 7 devices come with a minimum of 8 gigabytes (GB) of data storage. If an original design manufacturer (ODM) has designed a Windows Phone with a SD card, Windows Phone protects the data by locking the card. To “lock” the card, a 128-bit key is used and stored in the built-in memory of the phone to uniquely pair the card with the phone. The result is that if the card is removed from the phone, the SD controller will prevent access to the card unless the correct 128-bit password is supplied. SD cards that
1
A holistic approach to security
Protecting information on mobile phones has never been more important, and Windows Phone 7 was designed from the start with security as a high priority. The result is a feature-rich, flexible, and secure phone, one that emerged from a holistic approach to security that included the following design approaches: A new security model that isolates Windows Internet Explorer® Mobile and applications from each other and also from the operating system. For more information, see the “Windows Phone 7 security model” article on the Windows Phone 7 Guides for IT Professionals page on the Microsoft Download Center. Security Development Lifecycle methods, used by all Microsoft engineering teams, that include extensive threat modeling, penetration testing, and security development practices. Minimizing the attack surface so that hackers and malware developers have as little opportunity as possible to breach Windows Phone 7 devices. To help protect against malware threats, all applications are certified by Microsoft. In addition, Internet Explorer Mobile cannot launch code from websites. Security management capabilities to address the increased risk of potential exposure of confidential information through the increased use of mobile phones in the workplace. Data protection considerations to help ensure that data in transit is protected, as well as file system data, application data, and operating system data.