Quote:
Originally Posted by Jadey
In a nutshell, we:
a) enforce an idle lock password
The password has no minimum requirements apart from 6 characters, sets at 30 mins, and a change history of 6 pwds is maintained so users cannot .. also 6 attempts till device wipes
b) in use password lock
..
I wanted stronger password requirements, but this is all senior management would go for.
c) ban app downloads
d) are in process of finalising the app control policies so that anything not sanctioned by IT/available via BES will die. I am not being a total arse, and e) Banned any other IM than SameTime
f) Banned BIS email (although this looks like senior management are about to tell me to allow it)
g) Banned web browsing through anything other than BES
If I think of anything else, will add it.
I would like a stronger policy, but the issue is always getting execs to understand that in the trade-off between security and end-user convenience, security should win every time. I'm a policy *****, they'd have a 5 minute lockout if it were solely down to me! That said, we are reviewing the policies so that more options available. I think I have enough support that I will soon be banning app loader on desktop manager (and indeed the whole of desktop manager if I can) and all sorts of other fun things.
|
Are you in the military? - that seems very restrictive.
We
1. Password 4 characters minimum (this is plenty strong when you have an entire keyboard to work with)
2. 15 minute lockout enforced - I would have liked 10 minutes
3. 90 minute idle lock enforced
4. 10 password attempts - but can be changed lower by user
5. Encrypt media
6. We are toying with the idea of disabling certain apps for some users.
It's all about security without making your users feel like they are in prison.
You have to consider what are you trying to prevent, stop, slow down?