BYOD - how are you auditing information disclosure?

[pete]

Say Fred uses his iPad to do lessons and it helps him out teaching and he's a better* teacher as a result. If he gets his iPad nicked in Lanzarote while on holiday, what do you have in place to prevent information being disclosed?

 

Is it a case of "don't do that" with a defence of "er, they signed a bit of paper saying they wouldn't" when ICO comes knocking?

Are you siloing off "work" and "play" using encryption software specific to the device?

Are you / they encrypting the whole device?

 

We're leaning towards "maybe" for staff because some of the staff who're using their stuff standalone (no access to school network) are demonstrably benefitting from it, but the disclosure issue concerns me vs a school laptop that I know is encrypted.

 

*whatever your metric is.

[Prodigy]

Hi Pete,

 

My understanding of your question is that a member of staff has an ipad and if it managed to get stolen you are worried about any sensitive data being disclosed?

 

I believe that Ipads have an option to remote wipe all data and deactivate the device, the only disadvantage of this is that the Ipad needs to have an internet connection to be able to send the wipe command.

Also there is an option to wipe the Ipad if the password is entered incorrectly a certain amount of times.

 

Here is a business security overview of the ipad > images.apple.com/ipad/business/pdf/iPad_Security_Overview.pdf

 

Regards,

[pete]

My question was how are people handling it.

 

There's a lot you can do if you (the company / school) own the device(s), but if it's someone's personal device with school data on, it's much harder because you need their consent to you Nuking it from Orbit if it gets nicked - it needs to be part of the BYOD agreement. And we know they won't have backed it up in ages, so it'll wipe out their baby photos (or whatever).

 

Even with remote wipe a leaver (say left under a cloud) can easily restore his ActiveSync info using iTunes (to use an iPad example). Remote wipe doesn't prevent that.

 

And Outlook Anywhere (for example) still works until IIS is restarted.

[CyberNerd]

We use Google Docs and Citrix. All the information sits either on our server or Googles - data doesn't reside on the Teacher/Students device.