Comments on: Does Your Company Password Protect Your BlackBerry?

By: LJ

LJ — Fri, 09 Jan 2009 14:27:25 +0000

Financial Consulting
- Password enforced
- 6 character minimum

By: Marco

Marco — Fri, 09 Jan 2009 11:57:47 +0000

- Advertising Agency
- Password is enforced, minimum lenght of 4 characters
- Device is locked after 5 minutes of inactivity
- Device is wiped afer 10 attempts

By: Rob

Rob — Thu, 08 Jan 2009 14:11:21 +0000

- Yes on a password
- Industry – Manufacturing
- 6 Character’s

By: Blackberry Beard

Blackberry Beard — Wed, 07 Jan 2009 16:07:46 +0000

1) Please understand that when you remove the IT policy all the options stay the same including password and timeouts. Once the policies are removed you then can go into Security Options make whatever changes you need to.

2) In the above steps you will only be prompted for a password if the device already has a password. So some of you may have done the above steps and not needed to type in a password to remove the policies.

By: Blackberry Beard

Blackberry Beard — Wed, 07 Jan 2009 15:56:08 +0000

Although it is relatively easy to remove the IT policy set from any Blackberry you still have to provide the unit’s existing password first. If you don’t have the password you can’t remove the IT policy.

To remove the policy, once a home PC is set up with the appropriate policy.bin file and the one registry change, all you do is start up Desktop Manager, connect the blackberry, TYPE IN THE EXISTING PASSWORD, then once you see “device connected” you can shutdown Desktop Manager and disconnect the blackberry.

I’ve appropriately done this many times to decommissioned units that were already wiped of all company information.

By: david

david — Wed, 07 Jan 2009 02:10:15 +0000

Fortune 100 high tech firm.
Password is mandatory via BES policy.
Min 8 characters, max 16.
Must contain letters and numbers.
Auto lock time out is 30 mins max if inactivity.

Its a hassle but I understand the security reasons
Behind it. I think a 8 character minimum is overkill.
4 or 5 as a min is more appropriate for a
Handheld IMO.

By: John

John — Wed, 07 Jan 2009 01:03:11 +0000

Hi,

Senior management in wireless cellular services provider Canada.

- IT policy with 4 different digits password
- Device gets wiped after 10 attempts.
- Password renewed avery 3 months

All tough IT policy seems easy to flush (please see: http://www.blackberryforums.com/bes-admin-corner/2558-removing-policy-blackberry.html).

I hope it helps.

By: Ronen Halevy

Ronen Halevy — Wed, 07 Jan 2009 00:39:21 +0000

Nice find Sith!
The military is a perfect example of the high end of BES and BlackBerry security but many companies are just curious about what their peers do. For example Macy’s might be interested in what Bloomingdale does…

That way when you go to upper management for approval you are not comparing yourself to the military since you will get laughed out of the office…

By: DC

DC — Tue, 06 Jan 2009 21:45:37 +0000

I require a password here, as I did at my last position. In both corporations (one private-sector homebuilder and one public sector) time proved the decision prudent, as at least one Blackberry was lost.

With the password protection set to wipe after 10 failed logons we were at least reassured that information didn’t make it’s way to the press at an ainappropriate time.

By: n8

n8 — Tue, 06 Jan 2009 21:34:02 +0000

Even if your company doesn’t require it, if you don’t have a password on your blackberry, then you a certified moron IMHO.
However, you wouldn’t believe the amount of clients I see without a password on their blackberry.
I service many clients, some who have bes and some who don’t. About 1/2 “require” a password and 1/2 don’t.
Those that do require passwords too are pretty flexible on it policies though.
I have only 1 client I have ever worked for that actually had strict it policies. Most don’t care.
BTW: the clients I service range from large attorney firms to mom and pops companies.

By: Digg

Digg — Tue, 06 Jan 2009 20:09:35 +0000

- Medical Device Manufacturing.
- Password policy enforced via IT Policy.
- Password minimum 10 characters requiring at least one each: upper case letter, lower case letter, numeral, and special character.
- Device auto-locks after 30 minutes of inactivity.
- Device wipes after 10 failed attempts (I’m told).
- Content protection enabled, strongest encryption including address book.

By: panpan1975

panpan1975 — Tue, 06 Jan 2009 19:57:13 +0000

Manufacturing industry
- Password enforced
- 5 character minimum
- Content protection enabled
- Lock device after 30 min inactivity
- Wipe device after 10 attempts

By: perrin_75

perrin_75 — Tue, 06 Jan 2009 19:10:12 +0000

Software industry
1. Password enforced via IT Policy with 8 character password needing at leat one numeric value, one alpha numeric and one special character
2. Reset after 5 failed attempts

By: Blackberry Beard

Blackberry Beard — Tue, 06 Jan 2009 18:12:43 +0000

6 characters
1) auto-engages after 20 minutes of non-activity
2) auto-engages after 30 minutes regardless of activity
3) Serial port (USB) blocked from 3rd party apps – this helps protects from potential outside threats getting in via the PC but also inhibits cool programs like Impatica Showmate from working.

I appreciate and understand the need to auto-lock the device so the information doesn’t get into the wrong hands but it is such a pain in the backside because everytime you try to use it the dan thin is locked.

By: JackD

JackD — Tue, 06 Jan 2009 18:02:51 +0000

- Semiconductor Manufacturing
- Password enforced via IT Policy with 5 characters
- Content protection
- SD card encryption
- 3rd party app install block
- App permission block on keystroke + prompt only on few others

By: bryan

bryan — Tue, 06 Jan 2009 17:42:05 +0000

Password is required here. Mimics the internal computer/laptop pw policy but with only 4 characters vs 8 on internal computers. We are in a regulated medical imaging environment. We do the wipe on ten attempts too.

We have had a few people loose their BB’s, mostly exec and sales. If the information wasn’t locked it wouldn’t have been good. Not only does it protect the data but it also displays the name of the user and the company. Most of the lost phones have been mailed back to us.

By: Sith_Apprentice

Sith_Apprentice — Tue, 06 Jan 2009 17:20:40 +0000

http://iase.disa.mil/stigs/checklist/wireless_stig_blackberry_checklist_v5r2-1.pdf

There you go, a bit out of date but still not bad.

By: jskolm85

jskolm85 — Tue, 06 Jan 2009 17:15:09 +0000

I require a Password, with only 4 characters and a device wipe after 10 failed attempts. We are a software company.

By: circadian

circadian — Tue, 06 Jan 2009 16:54:23 +0000

* Yes on a password
* Industry – entertainment
* 4 Character combo with numbers and letters