AFEU Memo: Message from the Chief Information Officer: Bring Your Own Device
Subject: [AFEU] Fwd: Message from the Chief Information Officer: Bring Your Own Device …
From: Matt Linton
Date: August 29, 2013
Hello bargaining unit members!
Because a number of folks have asked me “what’s the real meaning” of the OCIO memo below, I wanted to send out a summary to the group.
In short, the agency as of 9/10/13 will automatically gain control of any mobile phone/tablet which connects to the agency’s email servers directly via the email apps (rather than webmail through the web browser). Once the agency has altered the software on that mobile device they will implement security features on it (strong passwords, lockout times, remote wipe, etc). The specific settings and whether or not you get a prompt before this happens will vary depending on your particular model of device.
You should assume, if you connect your personal device in this manner, that the agency will be able to read and access any data you have on your personal device and that the agency will retain the ability to remotely erase everything on that device.
The union has secured an agreement that employees’ personal phones will not be remotely wiped without prior permission from the owner, and I will keep you posted if that policy is altered.
Best Regards;
Matt Linton
AFEU
——– Original Message ——–
Subject: Message from the Chief Information Officer: Bring Your Own
Device and Mobile Computing at NASA.
Date: August 29, 2013
From: Centerwide Announcement
Message from the Chief Information Officer: Bring Your Own Device and Mobile Computing at NASA.
As NASA employees, we expect anytime, anywhere access to our information. New devices, applications and operating systems bring tremendous opportunity for productivity and innovation, but they also bring challenges in protecting, securing, and maintaining NASA information.
The ultimate vision for NASA mobility is: “Anyone will be able to securely and seamlessly access and share any information, anyplace, anytime, using any device.” In order to make this vision real, NASA must focus on devices, communications, information, applications and services, identity and authentication, all at the same time while striving to keep paramount your mission needs and a seamless user experience.
Mobile devices like smartphones and tablets are playing an increasingly important role in our lives. Some of us have access to a mobile device provided by NASA, and many others have personal devices we would like to use to help accomplish our work. To date, NASA has not prevented the use of your personal device to help increase your productivity and to enhance your ability to do business. Of course, we always have the responsibility to take care in handling and securing NASA data. This is especially true on mobile devices.
In the coming months, the NASA Office of the Chief Information Officer (OCIO) will be working to develop a formal policy to govern the use of personal devices, also known as “Bring Your Own Device (BYOD)”. Until then, I have directed the OCIO to enroll every personal mobile device that accesses the NASA email system into a management profile that helps to secure NASA data, just like is currently done on NASA’s government issued devices. This change, effective September 10, 2013, will enforce a minimum set of security requirements on your personal mobile device if you wish to directly access NASA’s email and calendaring resources from your device’s email client. This change will only affect mobile devices, i.e., those running a mobile operating system such as Apple’s iOS, Google’s Android, etc. It will not affect laptops, nor will affect any access to email via webmail.
Unfortunately, we cannot accommodate every single model, brand, and type of personal mobile device that may exist out there. As a result, there is a potential that some older devices may not be able to meet these minimum security requirements, and may not be able to continue accessing NASA email once this change is applied. However, most modern commercially available mobile devices and operating systems should be supported. Our intent is to enable and accommodate the NASA workforce to the best of our abilities, while still ensuring that those devices coming into the NASA email system are able to at least meet a minimum level of security.
The OCIO has published a memo detailing a minimum set of security requirements for the use of personally owned mobile devices, as well as frequently asked questions to help you use your personal device securely to access NASA data and support your work. These documents can be found at: http://inside.nasa.gov/ocio/content/nasa-memoranda (internal NASA site).
Editor’s note: this is the memo behind the NASA firewall: Minimum Security Requirements for Personal Mobile Devices, NASA CIO
I ask that you take a moment to review and familiarize yourself with these requirements. Please keep in mind that any use of personal devices to access NASA data is purely optional. You should refrain from using a personal mobile device to access NASA information and systems if you are uncomfortable, unable or unwilling to comply with these minimum security requirements. As the use of personal mobile devices is purely optional, employees cannot be required or expected to use their own devices to accomplish their assigned tasks if they choose not to do so.
Thank you for all the work you do every day to help us achieve NASA’s mission.
Larry Sweet
NASA Chief Information Officer
This notice is being sent agencywide to all employees by NASA INC in the Office of Communications at NASA Headquarters.
Minimum Security Requirements for Personal Mobile Devices, NASA CIO
