How do I disable security features on a previously owned BlackBerry smartphone?

If a BlackBerry smartphone user is being removed from a BlackBerry® Enterprise Server, the BlackBerry smartphone user or the system administrator may wish to remove the IT policy that was associated with the BlackBerry smartphone.

An IT Policy is a security feature enabled by the IT administrator to enforce something on the smartphone such as a password. To disable an IT policy, you’ need to contact the IT administrator. If you purchased the BlackBerry smartphone used, you’ll need to speak with the BlackBerry Enterprise Server administrator who enforced the setting.

Learn how to remove an IT policy from a BlackBerry smartphone

Is Internet banking on my BlackBerry smartphone secure?

Your BlackBerry smartphone uses SSL encryption to create a secure connection to shopping and banking websites. SSL is the standard encryption protocol used in many online banking, e-commerce and other transactions on mobile devices and computers. Using a secure connection helps protect you against identity theft and unauthorized use of your financial information.

To learn more about security features, read the BlackBerry® Internet Service Security Feature Overview (PDF)

Can I use smart cards with my BlackBerry smartphone?

Yes. The BlackBerry® Smart Card Reader builds on the security, flexibility and mobility of the BlackBerry Enterprise Solution.

Learn about the BlackBerry Smart Card Reader

Are BlackBerry smartphones FIPS certified?

Yes. BlackBerry smartphones are FIPS 140-2 certified.

Learn more about BlackBerry smartphone FIPS 140-2 certificates

What steps should I take before buying or selling a previously owned BlackBerry smartphone?

Before selling, or after buying, a previously owned BlackBerry smartphone, there are important steps to take to make sure personal information is kept secure and the BlackBerry smartphone will function properly for the purchaser.

Learn about the steps to take before buying or selling a previously owned BlackBerry smartphone

Is it necessary to use S/MIME or PGP to make the BlackBerry Enterprise Solution secure?

All messages sent between BlackBerry smartphones and the BlackBerry Enterprise Server are encrypted. However, once a message goes to the mail server outside the corporate firewall, it’s sent over the Internet. This is exactly what happens when you send an unencrypted message from a desktop or laptop computer.

The S/MIME and PGP solutions provide sender-to-recipient security from the moment a message leaves a BlackBerry smartphone to the moment it reaches its destination. This ensures the message can’t be read or modified anywhere along the way.

What are the differences between S/MIME and PGP? Which one should we invest in?

Both S/MIME and PGP allow you to sign and encrypt messages to ensure confidentiality, integrity and authentication. The key difference is they use different trust models. A trust model is a way of representing whether or not someone should be trusted, based on their relationships with other trusted entities.

S/MIME uses a hierarchical tree trust model based on an existing Public Key Infrastructure (PKI). Root Certificate Authorities issue certificates to other Certificate Authorities (CAs) as well as to individuals. Those CAs in turn can issue their own certificates to other CAs and individuals. A person or group is trusted only if the Root CA is trusted.

PGP uses a planar web of trust model. Root CAs issue PGP keys to other CAs and individuals. However, a key doesn’t need to be traceable to a trusted Root CA to be trusted. For instance, a key can be trusted based on its relationship with an intermediary CA or other individuals.

Each trust model has its benefits and drawbacks. The biggest factor in deciding whether to invest in S/MIME or PGP security is your company standards (i.e., what you use on your desktop) and those of your partners and close contacts. Currently, a person using S/MIME can’t send an encrypted message to someone using PGP and vice-versa.

Does my BlackBerry smartphone need anti-virus software?

The BlackBerry solution focuses on containing malicious programs. The BlackBerry software and core applications are digitally signed to ensure integrity and control access to the Application Programming Interfaces (APIs). Thus, the core BlackBerry smartphone functionality can’t be directly accessed by other applications.

You can use the application controls on your BlackBerry smartphone to prevent the installation of specific third-party applications and limit the permissions of third-party applications.

For more information, read the Protecting the BlackBerry device platform against malware Technical Overview (PDF)

Can the security settings on the BlackBerry smartphone be customized?

Yes. The BlackBerry Enterprise Server comes with over 400 IT policies that allow administrators to customize and enforce device-side security settings. IT policies are delivered and enforced wirelessly. They’re digitally signed to ensure integrity and can’t be changed or disabled by BlackBerry smartphone users.

View the BlackBerry Enterprise Server Policy Reference Guide

What happens if a BlackBerry smartphone is lost or stolen?

It’s recommend all users protect their BlackBerry smartphones with a password that must be entered to unlock and use the smartphone. This can be enabled by the user through the Security Options menu on the smartphone or enforced with the Password Required IT policy on the BlackBerry Enterprise Server. The smartphone can be set to automatically lock at specified time intervals (e.g., every 30 minutes) and can also be set to lock whenever it’s holstered.

If Content Protection is enabled on the smartphone, then user data on the smartphone is stored encrypted using AES-256. Thus, even if someone reads the user data directly from the device hardware, there’s no way to decrypt the data without the smartphone password.

Users with the BlackBerry Smart Card Reader enjoy an extra level of protection. The smartphone can be configured to automatically lock when the BlackBerry Smart Card Reader is outside of Bluetooth® communication range (normally around 30 feet). This gives proximity access control for the BlackBerry smartphone.

A lost or stolen BlackBerry smartphone can also be remotely locked or even erased by the BlackBerry Enterprise Server administrator¹, provided the server can communicate with the smartphone. The administrator can also remotely change the smartphone password and delete applications from the smartphone.

What if someone steals a BlackBerry smartphone, changes the software and then returns it?

Each time a BlackBerry smartphone boots up, the Boot ROM checks the authenticity of the Java® Virtual Machine and Operating System. The Java Virtual Machine then checks the integrity of the BlackBerry software. If any of these checks fail, the smartphone doesn’t boot up.

To successfully change the BlackBerry software, an unauthorized user would need to change the Boot ROM, which is non-trivial and requires access to the device hardware. Thus, the device software can’t be changed without access to the hardware. In addition to requiring proprietary knowledge, accessing the hardware leaves behind evidence the smartphone has been tampered with.

Why are BlackBerry messages routed through the BlackBerry Infrastructure?

All messages sent to and from BlackBerry smartphones are routed through the BlackBerry Infrastructure. This helps amortize the cost of multiple redundant connections to carriers of the BlackBerry Enterprise Server around the world. It also helps simplify wireless for customers and optimize protocols for wireless environments.

Some customers aren’t comfortable with the idea of their messages going through the BlackBerry Infrastructure. It’s important to remember all messages sent through the BlackBerry Infrastructure are encrypted using state-of-the-art and industry-certified Triple DES or AES-256 encryption. All messages are encrypted with the customers' own keys, which are stored only in the BlackBerry Enterprise Server and BlackBerry smartphone. The operators of the BlackBerry Infrastructure don’t have access to the customer keys and therefore can’t see the content of any of the messages.

Are BlackBerry smartphones NSA Suite B ready?

Yes. All in-market BlackBerry smartphones support the NSA Suite B algorithms.

Do we need a VPN to secure the BlackBerry Enterprise Solution?

BlackBerry smartphones use mutual authentication and transport encryption to secure the connection to the BlackBerry Enterprise Server. These features provide the confidentiality, integrity and authentication of a Virtual Private Network (VPN).