[Orbital199]

I'd like to get some feedback from anyone who operates a BES with a large amount of users or manages the BES and BlackBerries for a government agency. I'm trying to better understand what problems other agencies face in regards to mobile communications and see if there's any knowledge I can take back to work to better improve how we operate.

Do you restrict the use of third party applications?

What rules and regulations does your agency enforce for company mobile devices?

What are your user's biggest complaints about BlackBerries and how you choose to manage them?

One of our current problems is that we're being slammed with requests for iphones. Even though we're trying hard to fight it off, the people that are requesting them will inevitably get what they want. It's going to be a support nightmare.

[juwaack68]

We do not limit 3rd party applications, but we do not support but a few. So if I user loads something on their own, and their device flakes out, either the app gets removed or the device gets totally reloaded (OS-wise).

For mobile device, in North America anyway, we use preferred vendors and have a standard set of device models. There are some deviations for those people that may be located in areas where the preferred vendor does not have coverage, so we then use 'backup' carriers (but same/similar devices).

Biggest complaint? That would be people who want the latest and greatest and have no clue what goes into supporting them. Camera devices are a nightmare.

I feel your pain....as I'm sure other admins here do as well.

[Orbital199]

It sounds like you guys operate the same way we do.

We deploy phones and BlackBerries, and we're also having a hard time with the camera phones. We're on the verge of having to deploy new models and it's hard to find any that are non-camera anymore.

This may sound silly, but I've heard that you can restrict the camera function of the BB's from the BES. Is this true?

[jsconyers]

We follow pretty close guidelines as to what Juwaack stated. Yes you can disable the camera through IT policies on the BES. We deployed 88xx series devices as they have no camera. However, they have been replaced by the Bold it seems.

Looks as if all the new Blackberry devices have cameras anymore, I guess that's what you get when the devices become more consumer friendly.

[Frank Castle]

Presenty we are allowing 3rd party apps as software configurations and white list / black list is yet another thing to govern / admin! I'm not about to test / package whatever software Bob in accounting decides is "business critical" for him. I do find these valuable and have software configurations for them and push as needed:

InfoSpace FindIt! (though it's now yellow pages or something)
Bloomberg (for our Bloomberg anywhere users)
Worldmate Live - great for road warriors, the free stuff is nice
Shasta Bluetooth Keyboard - for those who REALLY type
Impactica Showmate - still one of the coolest things I've seen the past 2 years

Policy at the moment enforces the password, timeout and some other basic things. To be enabled by end of year:

SMS/PIN logging
Force web browse through MDS
Memory card encryption (given once you can save documents with OS 4.5)

I don't know if we get many complaints, we are pretty open and will support any carrier / blackberry. Biggest issue is field users don't get the proper provisioning. Most of the other things I found users don't really understand the device and what is possible or not so I developed and host a monthly "using your Blackberry effectively" session. I still get people who are amazed "you can open attachments?!" .. umm yeah for the past 4 years!!

Iphone is a burr in my boot .. we presently have 36 .. mostly the upper executive set who suffer from gadget envy. I've used a iphone since the EDGE version and it's a great media device / web browsing but I could never use it daily for email. Feedback is mostly they like the device but want to use the blackberry so I imagine a portion will move back after they get fed up enough. My main issues are not the device but how Apple has no controls for enterprise:

No usage audits
No device management
No device encryption

Hopefully Apple has plans for this as for now we have zero plans to deploy iphones other then those that have the pull (read whine) to get one.

[juwaack68]

I'm working on deploying camera devices in the States. We have servers in Pudong and Ahlen, and many of their users have camera devices (and WiFi). I was told specifically to NOT block any cameras.

Yet we have no company policy on the use of camera devices.

*shrugs*

[Frank Castle]

Yes since BES 4.1.4 there was been a "disable camera" policy and the BES 4.1.5 (maybe it was 6) you can disable video record.

I asked our compliance and security groups and they had no concern with cameras. I guess they figure countless employees have personal cellphones with them so what are they going to accomplish?

[TargetIT]

The policy is great but I wish you could order a backplate without a hole for the camera - trying to convince your supplier that your camera is disabled via IT Policies doesn't work.

[juwaack68]

Originally Posted by TargetIT

The policy is great but I wish you could order a backplate without a hole for the camera - trying to convince your supplier that your camera is disabled via IT Policies doesn't work.

That's an interesting idea.

[Frank Castle]

Duct tape?

[juwaack68]

Originally Posted by jletendre

To be enabled by end of year:

SMS/PIN logging

We do this now, along with phone call logging.

Originally Posted by jletendre

Most of the other things I found users don't really understand the device and what is possible or not so I developed and host a monthly "using your Blackberry effectively" session. I still get people who are amazed "you can open attachments?!" .. umm yeah for the past 4 years!!

I know what you mean. I get this and also users who didn't know you could do a Lookup of the GAL. I used to hold quarterly training classes, but now will only do so if a group asks me to and they all commit to attending.

[audit]

My company's basic when it comes to what BB's we use and what policy's we use. Only 3 BB's are company bought and paid for, other then that the people buy their own BB's and purchase their own license if they want to go on the BES and they know they are not going to get any support for them from me. Depending on the model and what their job requires is what policy I push down to them.

[Jadey]

A lot of companies here (that work for UK government agencies) crack the camera out of the device. How, I have no idea - but they work away till it is out. Then they tape up the hole on the back cover
http://forums.crackberry.com/f52/how...-8300-a-17845/

It's a shame RIM don't make any "camera free" versions of devices - probably not cost effective to produce 2 versions of each model though.

[juwaack68]

Originally Posted by Jadey

A lot of companies here (that work for UK government agencies) crack the camera out of the device. How, I have no idea - but they work away till it is out. Then they tape up the hole.
It's a shame RIM don't make any "camera free" versions of devices - probably not cost effective to produce 2 versions of each model though.

I heard a rumor that the new Nextel Curve that's coming out 4Q08 will have both a camera and non-camera option.

Time will tell if that's true or not, though.

[Frank Castle]

I meant to add one of our better controls is we monthly monitor device usage (or lack of) and devices that show no contact for 30+ days and removed from the BES and hardware is reclaimed. Likely not useful in smaller shops but with 3000+ users it adds up!

[shuman]

Originally Posted by Orbital199

It sounds like you guys operate the same way we do.

We deploy phones and BlackBerries, and we're also having a hard time with the camera phones. We're on the verge of having to deploy new models and it's hard to find any that are non-camera anymore.

This may sound silly, but I've heard that you can restrict the camera function of the BB's from the BES. Is this true?

That is true. You can disable the camera using the IT policy.

[greg2step]

Can you elaborate on how you are enabling SD card w/ encryption? We are looking at doing that, we currently disable SD card, but that is becoming so impractical. I would like to move us towards enabled w/ encryption, probably w/ usb drive connectivity disabled by policy - we'll see.

How well does the encryption work? Do your users that have it like it, or find it painful?

Problem we have, especially on curves is if you have too much media they start dumping messages, call logs.

Thanks.

Greg

Originally Posted by jletendre

Presenty we are allowing 3rd party apps as software configurations and white list / black list is yet another thing to govern / admin! I'm not about to test / package whatever software Bob in accounting decides is "business critical" for him. I do find these valuable and have software configurations for them and push as needed:

InfoSpace FindIt! (though it's now yellow pages or something)
Bloomberg (for our Bloomberg anywhere users)
Worldmate Live - great for road warriors, the free stuff is nice
Shasta Bluetooth Keyboard - for those who REALLY type
Impactica Showmate - still one of the coolest things I've seen the past 2 years

Policy at the moment enforces the password, timeout and some other basic things. To be enabled by end of year:

SMS/PIN logging
Force web browse through MDS
Memory card encryption (given once you can save documents with OS 4.5)

I don't know if we get many complaints, we are pretty open and will support any carrier / blackberry. Biggest issue is field users don't get the proper provisioning. Most of the other things I found users don't really understand the device and what is possible or not so I developed and host a monthly "using your Blackberry effectively" session. I still get people who are amazed "you can open attachments?!" .. umm yeah for the past 4 years!!

Iphone is a burr in my boot .. we presently have 36 .. mostly the upper executive set who suffer from gadget envy. I've used a iphone since the EDGE version and it's a great media device / web browsing but I could never use it daily for email. Feedback is mostly they like the device but want to use the blackberry so I imagine a portion will move back after they get fed up enough. My main issues are not the device but how Apple has no controls for enterprise:

No usage audits
No device management
No device encryption

Hopefully Apple has plans for this as for now we have zero plans to deploy iphones other then those that have the pull (read whine) to get one.

[legacyb4]

That's pretty much the same tack I take as well.

For company devices on company data plans, there are no 3rd party apps (Canada has crappy BES data plans to begin with so allowing 3rd party apps would kill data quotas).

On personal BB's, I require password policy as I would on my workstations and laptops but don't actually support them other than enterprise activation. If something breaks, it's not my issue.

Originally Posted by audit

My company's basic when it comes to what BB's we use and what policy's we use. Only 3 BB's are company bought and paid for, other then that the people buy their own BB's and purchase their own license if they want to go on the BES and they know they are not going to get any support for them from me. Depending on the model and what their job requires is what policy I push down to them.

[MajorTom]

We set policy for password and timeout, block third party software, and set encryption on the device data (excluding contacts as long as it is 4.2.x.x software)

As for iPhone support, we currently have two phones but none are using activesync due to the lack of encryption. Being a hospital, and patient information can and is stored on some devices, we have to have encryption enabled, so this gives us the leverage to not allow iPhones at the present time and for the forseeable future.

[Frank Castle]

I believe BES introduced the media card encryption with BES 4.1 SP4 .. I'd have to go back but anyways .. there are two policies you need to work with:

Security Policy Group:

Disable USB mass storage
External File System encryption level

Users really don't have a choice, compliance/legal policy is all portable devices have data encrypted (mobile devices and PDA fall under that policy)

Just have to watch the settings for how you encrypt and if you want to allow the card to be movable to other devices / readers or married to that BB.