[jack_b]

I am trying to convince management to have all Blackberries password protected, and they are not yet convinced.

- Can you let me know if your company requires (either yes and no)?
- What industry you are in?
- What kind of password or other requirements (# of characters, # of failed attempts, inactivity, etc)?

Also, does anyone know of any studies that have this type of data?

Thanks, Jack

[dc/dc]

Passwords are very important for any enterprise in any industry. This should not require any convincing.

My last company (Information Technology) required passwords of 4 characters, maximum timeout of 15 minutes, and 5 maximum failed attempts.

[penguin3107]

The BlackBerry is a mobile computer with direct access to your internal corporate network.
It's no different than a laptop with a VPN connection in many regards.

Our corporate philosophy is to treat the devices as equals. You'd never allow a mobile user to have a laptop without a password... so why allow a BlackBerry without one?

Manufacturing and Distribution industry.
4 characters, 10 failed attempts (default), 1 hour idle
Very lenient in comparison to other companies I've dealt with.

I'm sure there's white papers floating around somewhere too.

[Noodle22]

I work in telecommunications, and the corporate blackberries must have passwords. I believe ours is 10 failed attempts, but I don't know about character requirements or lock down time requirements. I don't have one myself, my manager does.

[mrvtx]

I work for a Fortune 10 company, multinational conglomerate
Passwords required, 9 failed attempts max, 4 characters min and none of the characters can repeat, 30 min max idle.

[juwaack68]

Our company requires them as well, for the same reasons penguin mentions. Do you enforce passwords on your company laptops? Then you should do the same with your mobile devices.

Here we only require a 6 character password with at least 1 alpha and 1 numeric character. 10 wrong attempts wipes the device.

[DarthBBerry]

Government arena.

Minimum 6 characters
Password must be changed every 180 days
Previous 4 passwords cannot be used
BlackBerry device will lock after 60 minutes of inactivity
Letter repetition in passwords is restricted (e.g.: aaa, bbb, ccc)
6 attempts to enter the password correctly; otherwise WIPE
All data encrypted while locked; even inserted media cards

When a BlackBerry device is locked, the screen will display identifying information. (Changed to protect the innocent...)
If found, please return to:
The BlackBerry Overlord
His Office
You Know Where

Since our department heads modified my original policy recommendation, this what we're using. If I had my way, I would modify it to expire every 45 days and lock after 10 minutes of inactivity.

One can never be too paranoid when it comes to IT security.

[knottyrope]

We just implemented a Password Policy similar to Penguins.
This is what I showed them since most users do lock their device while in their pocket.

Normal unlock
to unlock you press * and green key (2 clicks)

With a pass
**** and green key (5 clicks)

3 clicks to secure it. Its really knot that tough.

[mrvtx]

[QUOTE=DarthBBerry;1550204] If I had my way, I would modify it to expire every 45 days and lock after 10 minutes of inactivity. [QUOTE]

That would be tough to work with. I routinely check my e-mail when I can during meetings. I'd hate to have to enter my pw as many as 6 times during a one hour meeting.

[Yeowow]

[QUOTE=mrvtx;1550331][QUOTE=DarthBBerry;1550204] If I had my way, I would modify it to expire every 45 days and lock after 10 minutes of inactivity.

That would be tough to work with. I routinely check my e-mail when I can during meetings. I'd hate to have to enter my pw as many as 6 times during a one hour meeting.

As long as you entered a keypress or input you wouldn't have to if done more frequently than 9.9 minutes.

[penguin3107]

Originally Posted by Yeowow

As long as you entered a keypress or input you wouldn't have to if done more frequently than 9.9 minutes.

Not true if periodic challenge phrases have been implemented, which I'm sure DarthBBerry would have done as well. ;)

[DarthBBerry]

Originally Posted by penguin3107

Not true if periodic challenge phrases have been implemented, which I'm sure DarthBBerry would have done as well. ;)

Mandatory password entry every 15 minutes was recommended but shot down right away. I'm not even going to bring it up anymore. But the 10 minutes of inactivity requirement isn't that tough. If your BB is sitting idle for 10 minutes, you're obviously not using it during that time. Why not have it lock for you automatically?

I keep using this scenario to management, but they won't let me implement my Certified BlackBerry System Administrator and Support Specialist recommendations....

Let's say you walk 10 minutes to lunch from the office to the local sandwich shop. Checking your messages while eating. When you get done, you toss your tray and walk back to the office. Only after your 10 minute walk back, did you realize that your BlackBerry is still at the sandwich shop.
Out of your hands for 10 minutes.
You proceed to walk back there to retrieve the device.
Out of your hands for 20 minutes total.
The BlackBerry cannot be found after searching around and asking the staff for 5 minutes! (Oh noes!)
Out of your hands for 25 minutes total.
You walk the 10 minutes back to the office to notify your BlackBerry Administrator that you were dumb and careless.
Out of your hands for 35 minutes now.
However, the BlackBerry Admin has a life and does not sit as his desk eating his lunch waiting for you to scream that you are having withdrawl because you lost your "precious." He'll be back in 25 minutes.
Upon his return, the BlackBerry is now out of your hands for an hour.

How much data can be accessed via the unlocked device since it doesn't lock but every 60 minutes? How far can a person drive away with the BlackBerry in 60 minutes?

Sometimes I feel like I'm just waiting for an indicent to happen so I can jump up on my BlackBerry soap box and say, "TOLD YA SO!"

[juwaack68]

I agree with you, but I'm still going to send you a tin-foil hat

Just out of curiosity, what is the idle lock time for company PC's? Our PC's lock after 15 minutes of idle time (I think, it could be shorter, but definitely isn't longer).

However our BB's don't lock until after and hour of idle time. *smacks forehead*

[DarthBBerry]

Originally Posted by juwaack68

I agree with you, but I'm still going to send you a tin-foil hat

Just out of curiosity, what is the idle lock time for company PC's? Our PC's lock after 15 minutes of idle time (I think, it could be shorter, but definitely isn't longer).

However our BB's don't lock until after and hour of idle time. *smacks forehead*

Thanks for the hat Jules, I can always use another. Cant be too paranoid...

PC idle lock time is also 60 minutes. But it's not like a PC is going to getup and walk away anytime soon; unless it's a laptop. And most PCs are in an office setting where you must show credentials, have a security pass, or a key locked door to access.

[ndub33]

My company has lockdown for both PC and BlackBerry after five minutes. They just started enforcing the BlackBerry policy about a year ago. I already had mine password protected.

[cyclmpc]

Law industry.

For my employer, it took "TWO" incidents where a Blackberry was lost and it fell into the hands of people that decided to have a little fun and send obscene emails out to distribution lists and random individuals. There was a huge backlash against the p/w, but after the incidents, the policy received little opposition. Funny how that works, eh?

Max timeout of 30 minutes
Max pw age of 90 days
Min pw length 6

[mrvtx]

Originally Posted by Yeowow

As long as you entered a keypress or input you wouldn't have to if done more frequently than 9.9 minutes.

Well, sure, but I wouldn't want to have to press a key just to make sure it stays alive every 9.9 minutes. Reminds me of the old programs we used to use with dial up services to keep the connection alive by generating some slight activity;

[DarthBBerry]

Originally Posted by mrvtx

Well, sure, but I wouldn't want to have to press a key just to make sure it stays alive every 9.9 minutes. Reminds me of the old programs we used to use with dial up services to keep the connection alive by generating some slight activity;

If you're not willing to press a key on your BB every 9 minutes and 59 seconds to keep it from locking, dont come b1tchin' to your BES admin when it gets stolen and your data is compromised.

Besides, if you're not using it every 9 minutes and 59 seconds, then you probably have an alterative method of accessing your e-mail, calendar and PIM.

[CanuckBB]

[QUOTE=mrvtx;1550331That would be tough to work with. I routinely check my e-mail when I can during meetings. I'd hate to have to enter my pw as many as 6 times during a one hour meeting.[/QUOTE]

You need to start having better managed meetings

[knottyrope]

Big guy here tells everyone to turn off their phone and if yours makes a sound... everyone in the meeting is required to loudly boo and hiss at you.

No one here keeps their phone on during a meeting.