3 ms·

From your description it sounds more like process changes were needed rather than hardware. If the sensitive data is all in a web app, you don't really need pre

by clinta 11y ago

From your description it sounds more like process changes were needed rather than hardware. If the sensitive data is all in a web app, you don't really need pre-boot authentication, and could even allow windows to automatically sign in. I'm guessing you exposed your web app to the internet with 2 factor for the iPad, you could have done the same thing for windows clients and eliminated the VPN.

dogma1138 11y ago
"Sadly" (or not) the compliance requirements for mobile vs PC's are completely fubar. If you run under any regulation (PCI-DSS, HIPAA etc.) your PC will have to be hardened, have anti-virus, full disk encryption, 2 factor auth for remote connection and tick every other possible "security" box to be compliant. Mobile well it's easy just have an MDM and do what ever the fuck you want, so if you want to use your laptop from the train in a regulated industry you'll have to stand on one foot, hold the laptop over your head while giving a blood sample to authenticate you and on the other hand you can just hope on your tablet/mobile phone connect to your office using VPN on-demand or even a regular web app (as long as it's SSL because dur-dur security!) and you're golden.
- clinta 11y ago
  I've had to deal with both HIPAA and PCI-DSS and in both cases if the sensitive data is all stored within the web app, and the authentication to the web app is good and communication to the web app is encrypted, you do not have to secure the endpoint. Both of those are about securing the sensitive data, and keeping sensitive data off the endpoint is a perfectly valid method of doing so.
  - dogma1138 11y ago
    I don't know what you had to deal with regarding PCI or HIPAA but if the endpoint is in scope you have whole chapters about how you should "secure" it, same goes for remote access (VPN, Jump boxes etc.). If the endpoint was in scope I would like to see the QSA that signed an AOC/ROC which stated that the endpoints weren't secured...
    - clinta 11y ago
      The endpoints don't need to be in scope if they're not storing PII.
      - dogma1138 11y ago
        PCI-DSS the endpoints you use to connect to the CHD environment are in scope, other endpoints that are used to interact with CHD data e.g. POI's or CS terminals are also in scope. HIPAA endpoints that are used to access, view or input patient data are in scope. I am a QSA.
  - Spooky23 11y ago
    You received bad advice.
Spooky23 11y ago
We could technically do something like that, but we couldn't meet the compliance requirements. A better alternative in a laptop form factor would be a zero client laptop, but they are very niche devices. I didn't really go into detail about the full use case, they get other benefits from the overall snappy iPad experience in terms of switching apps, etc.

by clinta 11y ago

dogma1138 11y ago

"Sadly" (or not) the compliance requirements for mobile vs PC's are completely fubar. If you run under any regulation (PCI-DSS, HIPAA etc.) your PC will have to be hardened, have anti-virus, full disk encryption, 2 factor auth for remote connection and tick every other possible "security" box to be compliant. Mobile well it's easy just have an MDM and do what ever the fuck you want, so if you want to use your laptop from the train in a regulated industry you'll have to stand on one foot, hold the laptop over your head while giving a blood sample to authenticate you and on the other hand you can just hope on your tablet/mobile phone connect to your office using VPN on-demand or even a regular web app (as long as it's SSL because dur-dur security!) and you're golden.

clinta 11y ago
I've had to deal with both HIPAA and PCI-DSS and in both cases if the sensitive data is all stored within the web app, and the authentication to the web app is good and communication to the web app is encrypted, you do not have to secure the endpoint. Both of those are about securing the sensitive data, and keeping sensitive data off the endpoint is a perfectly valid method of doing so.
- dogma1138 11y ago
  I don't know what you had to deal with regarding PCI or HIPAA but if the endpoint is in scope you have whole chapters about how you should "secure" it, same goes for remote access (VPN, Jump boxes etc.). If the endpoint was in scope I would like to see the QSA that signed an AOC/ROC which stated that the endpoints weren't secured...
  - clinta 11y ago
    The endpoints don't need to be in scope if they're not storing PII.
    - dogma1138 11y ago
      PCI-DSS the endpoints you use to connect to the CHD environment are in scope, other endpoints that are used to interact with CHD data e.g. POI's or CS terminals are also in scope. HIPAA endpoints that are used to access, view or input patient data are in scope. I am a QSA.
- Spooky23 11y ago
  You received bad advice.

Spooky23 11y ago

We could technically do something like that, but we couldn't meet the compliance requirements. A better alternative in a laptop form factor would be a zero client laptop, but they are very niche devices. I didn't really go into detail about the full use case, they get other benefits from the overall snappy iPad experience in terms of switching apps, etc.