Authorization

Apple is making corporate BYOD programs less invasive to user privacy

When people bring their own devices to work or school, they dont want I.T. administrators to manage the entire device. But until now, Apple only offered two ways for I.T. to manage its iOS devices: either device enrollments, which offered device-wide management capabilities to admins or those same device management capabilities combined with an automated setup process. At Apples Worldwide Developer Conference last week, the company announced plans to introduce a third method: user enrollments.
This new MDM (mobile device management) enrollment option is meant to better balance the needs of I.T. to protect sensitive corporate data and manage the software and settings available to users, while at the same time allowing users private personal data to remain separate from I.T. oversight.
According to Apple, when both users and I.T.s needs are in balance, users are more likely to accept a corporate bring your own device or BYOD program something that can ultimately save the business money that doesnt have to be invested in hardware purchases.
The new user enrollments option for MDM has three components: a managed Apple ID that sits alongside the personal ID; cryptographic separation of personal and work data; and a limited set of device-wide management capabilities for I.T.
The managed Apple ID will be the users work identity on the device, and is created by the admin in either Apple School Manager or Apple Business Manager depending on whether this is for a school or a business. The user signs into the managed Apple ID during the enrollment process.
From that point forward until the enrollment ends, the companys managed apps and accounts will use the managed Apple IDs iCloud account.
Meanwhile, the users personal apps and accounts will use the personal Apple IDs iCloud account, if one is signed into the device.
Third-party apps are then either used in managed or unmanaged modes.
That means users wont be able to change modes or run the apps in both modes at the same time. However, some of the built-in apps like Notes will be account-based, meaning the app will use the appropriate Apple ID either the managed one or personal depending on which account theyre operating on at the time.
To separate work data from personal, iOS will create a managed APFS volume at the time of the enrollment. The volume uses separate cryptographic keys which are destroyed along with the volume itself when the enrollment period ends. (iOS had always removed the managed data when the enrollment ends, but this is a cryptographic backstop just in case anything were to go wrong during unenrollment, the company explained.)
The managed volume will host the local data stored by any managed third-party apps along with the managed data from the Notes app. It will also house a managed keychain that stores secure items like passwords and certificates; the authentication credentials for managed accounts; and mail attachments and full email bodies.
The system volume does host a central database for mail, including some metadata and five line previews, but this is removed as well when the enrollment ends.
Users personal apps and their data cant be managed by the I.T. admin, so theyre never at risk of having their data read or erased.
And unlike device enrollments, user enrollments dont provide a UDID or any other persistent identifier to the admin. Instead, it creates a new identifier called the enrollment ID. This identifier is used in communication with the MDM server for all communications and is destroyed when enrollment ends.
Apple also noted that one of the big reasons users fear corporate BYOD programs is because they think the I.T. admin will erase their entire device when the enrollment ends including their personal apps and data.
To address this concern, the MDM queries can only return the managed results.
In practice, that means I.T. cant even find out what personal apps are installed on the device something that can feel like an invasion of privacy to end users. (This feature will be offered for device enrollments, too.) And because I.T. doesnt know what personal apps are installed, it also cant restrict certain apps use.
User enrollments will also not support the erase device command and they dont have to, because I.T. will know the sensitive data and emails are gone. Theres no need for a full device wipe.
Similarly, the Exchange Server cant send its remote wipe command just the account only remote wipe to remove the managed data.
Another new feature related to user enrollments is how traffic for managed accounts is guided through the corporate VPN. Using the per-app VPN feature, traffic from the Mail, Contacts, and Calendars built-in apps will only go through the VPN if the domains match that of the business. For example, mail.acme.com can pass through the VPN, but not mail.aol.com. In other words, the users personal mail remains private.
This addresses what has been an ongoing concern about how some MDM solutions operate routing traffic through a corporate proxy meant the business could see the employees personal emails, social networking accounts, and other private information.
User enrollments also only enforces a 6-digit non-simple passcode, as the MDM server cant help users by clearing the past code if the user forgets it.
Some today advise users to not accept BYOD MDM policies because of the impact to personal privacy. While a business has every right to manage and wipe its own apps and data, I.T. has overstepped with some of its remote management capabilities including its ability to erase entire devices, access personal data, track a phones location, restrict personal use of apps, and more.
Apples MDM policies havent included GPS tracking, however, and nor does this new option.
Apples new policy is a step towards a better balance of concerns but will require that users understand the nuances of these more technical details which they may not.
That user education will come down to the businesses who insist on these MDM policies to begin with they will need to establish their own documentation, explainers, and establish new privacy policies with their employees that detail what sort of data they can and cannot access, as well as what sort of control they have over corporate devices.
Apple is making corporate BYOD programs less invasive to user privacy
See also:
Leave a comment
News
  • Latest
  • Read
  • Commented
Calendar Content
«     2020    »
 123456
78910111213
14151617181920
21222324252627
282930