{"id":15327,"date":"2019-06-11T00:43:40","date_gmt":"2019-06-11T00:43:40","guid":{"rendered":"https:\/\/rsoftsolution.com\/blog\/apple-is-making-corporate-byod-programs-less-invasive-to-user-privacy.html"},"modified":"2019-06-11T00:43:40","modified_gmt":"2019-06-11T00:43:40","slug":"apple-is-making-corporate-byod-programs-less-invasive-to-user-privacy","status":"publish","type":"post","link":"https:\/\/www.rbsitsoftwaresolution.in\/blog\/apple-is-making-corporate-byod-programs-less-invasive-to-user-privacy.html","title":{"rendered":"Apple is making corporate \u2018BYOD\u2019 programs less invasive to user privacy"},"content":{"rendered":"

When people bring their own devices to work or school, they don\u2019t want IT administrators to manage the entire device. But until now, Apple <\/a> only offered two ways for IT to manage its iOS devices: either device enrollments, which offered device-wide management capabilities to admins or those same device management capabilities combined with an automated setup process. At Apple\u2019s Worldwide Developer Conference last week, the company announced plans to introduce a third method: user enrollments.<\/p>\n

This new MDM<\/a> (mobile device management) enrollment option is meant to better balance the needs of IT to protect sensitive corporate data and manage the software and settings available to users, while at the same time allowing users\u2019 private personal data to remain separate from IT oversight.<\/p>\n

According to Apple, when both users\u2019 and IT\u2019s needs are in balance, users are more likely to accept a corporate \u201cbring your own device\u201d (BYOD) program \u2014 something that can ultimately save the business money that doesn\u2019t have to be invested in hardware purchases.<\/p>\n

The new user enrollments option for MDM has three components: a managed Apple ID that sits alongside the personal ID; cryptographic separation of personal and work data; and a limited set of device-wide management capabilities for IT.<\/p>\n

The managed Apple ID will be the user\u2019s work identity on the device, and is created by the admin in either Apple School Manager or Apple Business Manager \u2014 depending on whether this is for a school or a business. The user signs into the managed Apple ID during the enrollment process.<\/p>\n

From that point forward until the enrollment ends, the company\u2019s managed apps and accounts will use the managed Apple ID\u2019s iCloud account.<\/p>\n

Meanwhile, the user\u2019s personal apps and accounts will use the personal Apple ID\u2019s iCloud account, if one is signed into the device.<\/p>\n

Third-party apps are then either used in managed or unmanaged modes.<\/p>\n

That means users won\u2019t be able to change modes or run the apps in both modes at the same time. However, some of the built-in apps like Notes will be account-based, meaning the app will use the appropriate Apple ID \u2014 either the managed one or personal \u2014 depending on which account they\u2019re operating on at the time.<\/p>\n

To separate work data from personal, iOS will create a managed APFS<\/a> volume at the time of the enrollment. The volume uses separate cryptographic keys which are destroyed along with the volume itself when the enrollment period ends. (iOS had always removed the managed data when the enrollment ends, but this is a cryptographic backstop just in case anything were to go wrong during unenrollment, the company explained.)<\/p>\n

The managed volume will host the local data stored by any managed third-party apps along with the managed data from the Notes app. It also will house a managed keychain that stores secure items like passwords and certificates; the authentication credentials for managed accounts; and mail attachments and full email bodies.<\/p>\n

The system volume does host a central database for mail, including some metadata and five line previews, but this is removed as well when the enrollment ends.<\/p>\n

Users\u2019 personal apps and their data can\u2019t be managed by the IT admin, so they\u2019re never at risk of having their data read or erased.<\/p>\n

And unlike device enrollments, user enrollments don\u2019t provide a UDID or any other persistent identifier to the admin. Instead, it creates a new identifier called the \u201cenrollment ID.\u201d This identifier is used in communication with the MDM server for all communications and is destroyed when enrollment ends.<\/p>\n

Apple also noted that one of the big reasons users fear corporate BYOD programs is because they think the IT admin will erase their entire device when the enrollment ends \u2014 including their personal apps and data.<\/p>\n

To address this concern, the MDM queries can only return the managed results.<\/p>\n

In practice, that means IT can\u2019t even find out what personal apps are installed on the device \u2014 something that can feel like an invasion of privacy to end users. (This feature will be offered for device enrollments, too.) And because IT doesn\u2019t know which personal apps are installed, it also can\u2019t restrict certain apps\u2019 use.<\/p>\n

User enrollments will also not support the \u201cerase device\u201d command \u2014 and they don\u2019t have to, because IT will know the sensitive data and emails are gone. There\u2019s no need for a full device wipe.<\/p>\n

Similarly, the Exchange Server can\u2019t send its remote wipe command \u2014 just the account-only remote wipe to remove the managed data.<\/p>\n

Another new feature related to user enrollments is how traffic for managed accounts is guided through the corporate VPN. Using the per-app VPN feature, traffic from the Mail, Contacts and Calendars built-in apps will only go through the VPN if the domains match that of the business. For example, mail.acme.com can pass through the VPN, but not mail.aol.com. In other words, the user\u2019s personal mail remains private.<\/p>\n

This addresses what has been an ongoing concern about how some MDM solutions operate \u2014 routing traffic through a corporate proxy meant<\/a> the business could<\/a> see the employees\u2019 personal emails, social networking accounts and other private information.<\/p>\n

User enrollments also only enforces a six-digit non-simple passcode, as the MDM server can\u2019t help users by clearing the past code if the user forgets it.<\/p>\n

Some today advise users to not accept BYOD MDM policies because of the impact to personal privacy<\/a>. While a business has every right to manage and wipe its own apps and data, IT has overstepped with some of its remote management capabilities \u2014 including its ability to erase entire devices, access personal data, track a phone\u2019s location, restrict personal use of apps and more.<\/p>\n

Apple\u2019s MDM policies haven\u2019t included GPS tracking, however, nor does this new option.<\/p>\n

Apple\u2019s new policy is a step toward a better balance of concerns, but will require that users understand the nuances of these more technical details \u2014 which they may not.<\/p>\n

That user education will come down to the businesses that insist on these MDM policies to begin with \u2014 they will need to establish their own documentation, explainers, and establish new privacy policies with their employees that detail what sort of data they can and cannot access, as well as what sort of control they have over corporate devices.<\/p>\n

<\/a><\/p>\n

Article source: http:\/\/feedproxy.google.com\/~r\/techcrunchIt\/~3\/wpq5paEDsgo\/<\/p>","protected":false},"excerpt":{"rendered":"

When people bring their own devices to work or school, they don\u2019t want IT administrators to manage the entire device. But until now, Apple only offered two ways for IT <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[19],"tags":[25],"class_list":["post-15327","post","type-post","status-publish","format-standard","hentry","category-enterprise-software","tag-enterprise"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t