Ask Slashdot: Managing Encrypted Android Devices In State and Local Gov't?

An anonymous reader writes "I am a systems administrator for a mid size state agency. We currently offer Blackberries to our staff, but we are migrating to Android devices in the near future. Since phones have sensative data (email, documents, etc.), what is a good choice for encrypting that data? Options abound, like OS-level encryption from Motorola and Samsung, 3rd party apps from GoTrusted and even a LUKS port for Android. Does anyone have experience managing encrypted Android devices? What are the important features I should be looking at? Many thanks in advance." (And, for that matter, are there good options for doing the same with iPhones? Other options to consider?)

Don't encrypt

[Anonymous Coward]

If the state isn't doing anything wrong, it doesn't have anything to hide.

Re:Don't encrypt

[masternerdguy]

It doesn't just have to do with hiding immoral actions (btw we don't even know what agency he works for -- he could be fracking parks and recreations), it also prevents tampering.

I encrypt the disks on my computers not to hide anything, I will gladly decrypt my disk for the FBI if they ever asked, but to prevent outside tampering. Without encryption, an adversary can just load up a linux live cd and tamper with anything they want with root access. By encrypting the entire disk I can prevent that sort of tampering. They can still boot a live cd, but they can't tamper with the installed operating system or the data.

Besides, there is a metric ton of personal information on any smart phone. How would you like Joe the Laptop Thief to get access to your Google account, or possibly even login information for your online banking?

Re:iPhone

[jmorris42]

Nice propeller spinning but forget all that crap and lets get real.

If you want to enforce privacy of information you do two simple things.

YOU DON"T F*CKING ALLOW IT TO WALK OUT THE FRONT DOOR.

YOU DON"T ALLOW IT TO BE MOVED TO DEVICES OUTSIDE OF YOUR DIRECT CONTROL.

So just say no to BYOD, let em screech and bitch all they want. Tell em straight up, if your can't work without your precious iPad then go find an employer who doesn't need to deal with laws enforcing privacy. And good luck with that in this crappy economy. Just say no to portable devices, period, unless there is a truly compelling need. Data collection and off site archiving come to mind.

Otherwise admit you really don't care about privacy at all and get on with it and, again, you don't need to spend a lot of money on tech that won't actually work when it comes to crunch time with end user idiots.

Re:iPhone

[rogueippacket]

Please, I would like to see you say those exact words to your CxO when they come and ask you for help with activating their brand new iPhone/Android/Tablet. You're just going to make my job easier when I sell them a BYOD solution without your consent.
BYOD is here to stay whether you want to support it or not.

Re:iPhone

[Anonymous Coward]

iPhone is better for this stuff. but since you want android.

Spoken like a true iTard who has no idea what he's talking about. Android version 4.0 and above supports full disk encryption using AES you fucking tool.

Re:iPhone

[rhsanborn]

This is why IT people have such a bad reputation. Yes, portable devices are a security risk. Our job, as IT professionals, is to come up with solutions. On the same bent, I suppose you'd also cut the link to the Internet. Wait, you obviously haven't, because you're posting on Slashdot. But you came up with clever ways to protect your system from the Internet? Then why don't you start working on coming up with ways to secure mobile devices.

The obstructionism is well intentioned, but we have an obligation to try to support the needs of the business. Staff are more mobile, and the business is benefiting by having people more connected and better able to make decisions, even when they aren't sitting in front of a PC. So, let's make it secure.

You have no security.

[Animats]

Assume that your carrier, cloud provider, and handset manufacturer all have access to everything on the phone.

With Blackberry, you could run your own server, and nothing in the public infrastructure had access to unencrypted data. With Android, Google has a direct tap into your data. Encryption won't help when the layer that reads the keys is under the control of the provider.

Re:Don't encrypt

[Calos]

Sorry, but no, not everything the government has should be open for anyone to obtain and peruse. Take this [computerweekly.com] as an example, or several other blunders made by the UK government or its contractors. This [btlj.org] has some data and discussion on the US. Personally, I'm more concerned with the general lack of responsibility for these kind of breaches in both the public and the private sector.

Don't get me wrong, I agree with your ideal. But ideals can rarely if ever become reality. And they're not always the blessing that they would seem to be.

Re:Don't encrypt

[Last_Available_Usern]

What about personally identifiable information? Should SSN's be flying around unencrypted? Just because encryption is used to conceal wrongdoing doesn't mean it's always used for that purpose.

Re:state agency will take the best deal not the be

[dsvick]

I would think that the fact the OP is taking to the time to ask the question and even went so far as to ask for help with things he realizes he might not even know enough to ask is pretty good evidence that they are taking security seriously. Granted, he probably has to get it approved if it a pad app, but the cost of that should be pretty small compared to the cost of the phones themselves.

Re:Don't encrypt

[AmiMoJo]

I encrypt because I do have things to hide. I'm a normal person. Everyone has things they want to keep private. You wouldn't be happy getting your bank statements on the back of a postcard, would you?

Hiding stuff is normal. Everyone needs privacy. There is nothing wrong with it.