My last post (and yes, it's been a loooooong time between updates) noted the problem of the device-level encryption support differences in the various models of the iPhone hardware and OS updates. I had started writing an updated post on this, but it got lost in the ether, and I then got to a point where I haven't been doing much updating on this blog, and quite frankly I forgot about it.
That changed yesterday when I implemented a service to auto-tweet blog posts from my various blogs and, not being entirely familiar with how the service worked, it posted the most recent post on each blog that I selected. As a result, it looks like I tweeted about the old post on this topic yesterday, and that tweet got retweeted by several folks, who apparently thought this was new news.
OK, my bad for implementing a solution without fully understanding how it worked. 
So while there is not a *fix* for this issue coming from Apple (according to the information I've been able to uncover), the problem is actually not as prevalent as initially surmised, at least in terms of the numbers of users who will actually be affected.
Here's the issue: In Exchange 2007, there is an option to require users who connect through Exchange ActiveSync to have a device that support device-level encryption. This is a good thing form a security point of view, especially if you have users who will be accessing sensitive e-mail from the corporate Exchange server from their iPhone (I'm ignoring the entire tangent of whether you can really assume that anything in e-mail can be truly secure), having device-level encryption adds another layer of protection on that data should the device get compromised in some way. This setting is a mailbox-level setting and not a server-level setting, meaning that the decision to enable this requirement can be done on an individual level.
The initial concern I heard in the SMB space when this news first came out (and all the facts weren't fully available when I made my initial post) was how this would impact iPhone users connecting to SBS servers. Well, there was good news, as it turns out:
- The issue didn't impact Exchange 2003 at all, and since the vast majority of iPhone users connecting to SBS servers are connecting to SBS 2003, no problem.
- The default settings for Exchange 2007 in SBS 2008 does NOT require device-level encryption for mobile device connections.
So, every one of the customers I had with iPhones and SBS servers were fine. And the vast majority of iPhone and SBS users were also not impacted.
Does that mean that this isn't an issue? No, it doesn't. For companies who have enacted corporate security policies to require device-level encryption for Exchange connectivity, the users who have iPhones will either have to stick with iPhone OS 3.0 (which "faked out" the Exchange server by reporting that device-level encryption was actually in place) , get an iPhone 3Gs with iPhone OS 3.1 which does fully support the device-level encryption standard, or work with the corporate security folks to negotiate an exception for that user/device and have the IT admin change the device security policy for that user's mailbox in Exchange 2007 (which can be done without impacting the security requirements for any other mailboxes on the system).
Hopefully that will clear the air a little from the confusion I inadvertently caused yesterday. And get me back to updating this particular blog on a more regular basis. 