Comment by Spooky23 | Hacker News Reader

Comment by Spooky23 | Hacker News Reader

Parent Full thread

You're the wrong kind of user. I do end user architecture in a large enterprise, we ran into this with a lot of early adopters.

People who are mobile (as in floating around an office or travel) whose job tasks are easily attributable to specific applications are very happy with iPads. Ideally, the number of applications they use every day on a traditional PC is less than 5. Examples: Sales, Executives, auditors, policemen, medical professionals, case workers.

We had one group of auditors who literally sent my team a $200 fruit basket in appreciation for their iPads. The card said something like "You changed our lives. Thank you!" Executives spend 95% of their day in mail or approving things... again, perfect use case as long as that workflow doesn't require IE6 :)

If you're a consultant, whose specific tasks may change day to day, a full-stack devops guy using any of 15 tools, or a professional writer churning out copy, than an iPad doesn't work. That's ok... a $500 nailgun doesn't make sense for hanging a picture. We have the luxury of choosing tools these days... in 1999, mobile == 12 lb laptop with cable!

Have those users also used a surface pro or a chromebook? I'm wondering if they're just happy to have an extra tablet device or if they have a frame of reference.

Key parts of our stack(s) won't work with Chromebook, so didn't go that route.

I haven't seen anyone, including Microsoft badged people, using a Surface Pro as anything but a nice laptop.

neteng where I work uses one with an external wifi adapter to test our wifi infra.

"We had one group of auditors who literally sent my team a $200 fruit basket in appreciation for their iPads."

Were they using a custom made app for their specific task or something like that?

It was a web app. With a laptop, their compliance requirements required hibernation. So the workflow was:

- Pre-boot authentication. - Windows sign-in - VPN two-factor sign-in - Web Portal access - Find your thing.

Best case, that process took 7-9 minutes, at a customer site using guest wifi or air-card in an office building, with a potentially angry customer. Not fun. The typical user does that 5-10 times a day, and in many cases the workers were actually preparing paper reports on their own time to function.

Enter iPad. Access was a snap, and it performed better with marginal cellular connections. Accessing the web portal did still require a two-factor challenge, but that two factor was effective for ALL of their internal access. We used a web browser that gave them a native iPad browsing experience (vs. an SSL-VPN'd IE) and access to several different systems via app.

From your description it sounds more like process changes were needed rather than hardware. If the sensitive data is all in a web app, you don't really need pre-boot authentication, and could even allow windows to automatically sign in. I'm guessing you exposed your web app to the internet with 2 factor for the iPad, you could have done the same thing for windows clients and eliminated the VPN.

We could technically do something like that, but we couldn't meet the compliance requirements.

A better alternative in a laptop form factor would be a zero client laptop, but they are very niche devices.

I didn't really go into detail about the full use case, they get other benefits from the overall snappy iPad experience in terms of switching apps, etc.

"Sadly" (or not) the compliance requirements for mobile vs PC's are completely fubar.

If you run under any regulation (PCI-DSS, HIPAA etc.) your PC will have to be hardened, have anti-virus, full disk encryption, 2 factor auth for remote connection and tick every other possible "security" box to be compliant.

Mobile well it's easy just have an MDM and do what ever the fuck you want, so if you want to use your laptop from the train in a regulated industry you'll have to stand on one foot, hold the laptop over your head while giving a blood sample to authenticate you and on the other hand you can just hope on your tablet/mobile phone connect to your office using VPN on-demand or even a regular web app (as long as it's SSL because dur-dur security!) and you're golden.

I've had to deal with both HIPAA and PCI-DSS and in both cases if the sensitive data is all stored within the web app, and the authentication to the web app is good and communication to the web app is encrypted, you do not have to secure the endpoint. Both of those are about securing the sensitive data, and keeping sensitive data off the endpoint is a perfectly valid method of doing so.

I don't know what you had to deal with regarding PCI or HIPAA but if the endpoint is in scope you have whole chapters about how you should "secure" it, same goes for remote access (VPN, Jump boxes etc.). If the endpoint was in scope I would like to see the QSA that signed an AOC/ROC which stated that the endpoints weren't secured...

The endpoints don't need to be in scope if they're not storing PII.

PCI-DSS the endpoints you use to connect to the CHD environment are in scope, other endpoints that are used to interact with CHD data e.g. POI's or CS terminals are also in scope.

HIPAA endpoints that are used to access, view or input patient data are in scope.

I am a QSA.

You received bad advice.

Reply on news.ycombinator.com