Tag Archives: remote wipe

May 17, 2012

An Overview Of Zenprise Mobile Device Management MDM – Setting Up A Zenprise Lab

Bring Your Own Device (BYOD) has become a hot topic for many industries. Lately security people are using the term BYOD like datacenter folks classify everything as Cloud. My team has advised our customers using a best practice BYOD architecture (more info HERE) and like many consultants feel Mobile Device Management aka MDM is a key factor.

A few months ago I posted about one of the market leaders, MobileIron, HERE. I have received multiple requests for another vendor and chose the current leader Zenprise according to Gartner’s Report “Critical Capabilities for Mobile Device Management”. Plus I really like Zenprise.

Zenprise offers all the popular features expected from leading MDM vendors such as controlled remote wipe, policy enforcement (passwords, etc.), flagging jailbroken devices and enabling location. A few differentiators as of today for Zenprise are the ability to remotely login into phones (similar to remote desktop for windows), secure content distribution and Mobile DLP, application-specific VPN tunnels, and SIEM integration.

The architecture of Zenprise is similar to other MDM vendors. They have a management system (Zenprise Device Manager, or ZDM) and enforcement system (Zenprise Secure Mobile Gateway (SMG)). The Zenprise SMG is what denies email services to devices that violate policy. They also have a component that sits inside the network and does advanced diagnostics and troubleshooting for Microsoft Exchange and BlackBerry Enterprise Server (Zenprise Service Manager, or ZSM). Like many MDM vendors, Zenprise has an agent that sits on endpoints to enforce policy. Most people install both the ZDM and Zenprise SMG since it makes sense to enforce policies. Licensing for cloud or on-premise is based on the number of endpoints and drops as larger quantities are purchased.

To try Zenrpise out, go to https://zencloud.zenprise.com/zencloud/cloudUser/create and fill out the form to gain access to a free trial of the cloud service. You can also request Zenprise software to setup an on-premise trial however you will have to request that from a Zenprise sales person or partner such as World Wide Technology Inc. One you gain access to the management system, login in and you should hit the main dashboard.

After logging in, the main Zenprise landing page will show devices you are managing. Details include Jailbroken / Rooted, Managed / Unmanaged, Serial numbers, IMEI/MEID, last connected, User, OS Version, etc. You can click a device and see details such as what apps are installed, how much battery life is available, installed certificates, etc.

Zenprise policies are pretty easy to setup and can be device specific. The screenshot below shows a blacklist policy for Angry Birds and Dropbox on iOS devices.

You have a few options in Zenprise to add a new device. One option is downloading the Zenprise agent from iTunes / Google Play and enrolling. Enrolling requires the ZDM address, username and password. Once you login, it will prompt you for certificates and any profiles configurations setup by administration.

Once Zenprise is installed, the user can access apps offered by administration and view the agent configuration.

Other methods in Zenprise to add devices include registration using the administration dash (asks for the serial number of the device) and sending out a registration link via email or txt.

There are many options in Zenprise for reports which include inventory, software, jailbroken / rooted and hardware. Below is a screenshot from the next release coming out in June/July 2012. Check out www.zenprise.com for more info on their solution.

Rating: 4.6/5 (10 votes cast)

7 Comments

Filed under Bring Your Own Device BYOD, Host And Mobile Device Security

Tagged as Airwatch, android, android security, bring your own device, byod, Cisco, Critical Capabilities, Data Loss Prevention, DLP, end point management, Enrolling, good technologies, Home, iPad, iPhone, ISE MDM, Joey, Joey Muniz, joseph, joseph muniz, MDM, mobile, mobile cloud, mobile device, mobile device management, Mobile Iron, mobile management, mobile security, Muniz, password security, policy enforcement, remote lock, remote wipe, testing mobile security, windows mobile, windows mobile security, wireless security, World Wide Technology, world wide technology inc., wwt, ZDM, Zenprise, Zenprise Lab, ZSM

January 2, 2012

Mobile Device Management Testing: Setting up a basic Mobile Iron lab

Mobile device security is a hot topic for 2012 and some current industry leaders are Mobile Iron, Airwatch, Good Technologies and Zenprise. There are two approaches to addressing mobile device security, which are a “sandbox” or “application management” approach (more info can be found HERE). My team found the majority of our customers prefer the application management approach offered by Mobile Iron and Airwatch. For those interested in evaluating Mobile Iron, below are some steps to setup a basic lab for testing functions such as remote wipe, policy enforcement, flagging jailbroken devices and other features.

Mobile Iron has two parts to their solution. There is a Mobile Iron VSP (management system) and Sentry (policy enforcement) server that can be a physical appliance or virtual server. The Sentry piece isn’t required but used 95% of the time since it enforces policies built by the VSP. A basic Mobile Iron lab will need ESX4.0 or greater, around 4GB of memory and 40GB of disk space. You can download a Mobile Iron ISO from https://info.mobileiron.com/free-smart-start-trial.html. Mobile Iron will need some ports opened for communicating to devices and data synchronization. Plan to open outside ports 8080 or 8443, 9997, 9998, 443, 2195 / 2196 and inside ports 25, 389 / 636, 9090, 443, 22 and 8443 depending on what services you will be testing. Ports can be changed on the main dashboard if needed.

After booting the Mobile Iron VSP for the first time, you will be prompted to enter basic network information (subnet, gateway, etc.). Fill out the requested information and wait for the VSP to boot up. Access your Mobile Iron system via the domain name you provided plus /admin (IE. mydomain/admin) and you will see a login. Login with the username and password specified during the initial build and you will see the following dashboard.

You can add local users by clicking “Smartphone and users” or a LDAP (under LDAP) for user database integration. At the very top, there is a system link to configure management settings. Make sure to configure SMTP under email settings so you can test alerting. Verify and update basic network info that configured during the initial setup. You can also check for software updates under the maintenance tab.

For those testing Apple products, Mobile Iron recently added an enhanced certificate option that doesn’t require a Apple development license to generate a cert (we learned this the hard way and paid the $299 weeks before the update). For users looking to test custom built applications, a developer license is required however labs testing basic functions such as managing existing apps via the app store, mobile security, etc. won’t need this. Create a certificate and upload it under Smartphones, Settings and Local Certificate Authorities. To read more on generating IOS certificates, go HERE.

At this point, you have a working Mobile Iron VSP and can register a test device a few different ways. One way is to click the Register button in the VSP and fill in the request page. An email will be send to the user you created explaining how to download the Mobile Iron application, server name, user name and password. A second way is to go the user GUI, which is your domain without /admin at the end. Users can log in and register their devices based on accounts created in the Mobile Iron VSP. A third way is having users find the Mobie Iron app using their mobile devices and filling out the server information that is sent via email requests from the VSP. Below are some pictures me registering devices

Labels are used to group device types and policies together. The default labels and new ones can be built under Smartphones & Users, Managed Labels. Policies are checks that can be performed on devices part of Labels. Policies can be found at Security & Policies, All Polices. Compliance Actions are what can be done if a Policy is violated (IE blocking or sending a alert if somebody violates the policy “Downloading Angry Birds”. Test out building a label and apply some policies to that label. Create a few Compliance Actions for each policy such as sending out alerts. Place some users under your test label and register a device. Below is a screenshot of testing a policy against Angry Birds on IOS devices.

This is a very brief crash course on Mobile Iron. Check out http://www.mobileiron.com/ for more information on their solution. I’ll probably do a simliar post for those looking to test AirWatch in the near future. Happy New Year!

Rating: 4.0/5 (4 votes cast)

9 Comments

Filed under Bring Your Own Device BYOD, Host And Mobile Device Security

Tagged as Airwatch, android security, application control, application managemen, bring your own device, bring your own technology, byod, BYOT, end point management, Good Technology, Home, iPad, ipad security, iPhone, iphone security, Joey, Joey Muniz, joseph, joseph muniz, mobile, mobile device, mobile device management, Mobile Iron, Mobile Iron Lab, Mobile Iron Sentry, mobile iron vmware, Mobile Iron VSP, Muniz, network security, remote wipe, Security, Sentry, smartphone security, stop angry birds, tablet security, testing mobile security, VSP, VSP appliance, wireless security, World Wide Technology, world wide technology inc., wwt, Zenprise

December 15, 2011

Addressing Bring Your Own Device (BYOD): How to manage and secure mobile endpoints

The majority of today’s workforce uses multiple devices such as laptops, tablets and smartphones (IE brings their own device or BYOD). Leadership from most industries is being asked to permit these devices on the network in some limited or full fashion. Common BYOD questions are “how do I support growth for users with multiple devices?”, “what type of access should guest and employees use for mobile devices?”, “how do I provision corporate mobile devices?”, and “what security vulnerabilities am I exposed to by permitting mobile devices?”. All are good questions and can be addressed by focusing on three core BYOD concepts: Infrastructure, Access Control and Device Management.

The first thing to consider for BYOD is if your wireless network can support growing from one device per user to potentially 2-4 devices. The best way to find out is by performing a wireless assessment to verify capabilities and potential risks caused by obstacles and nearby rouge networks (IE Starbucks using a similar RFID channel). Security features such as wireless intrusion detection and prevention (WIDS /WIPS) as well as controlling the number of permitted associated devices per user should be considered for BYOD to guarantee scalability and service.

Another common area of concern for BYOD is provisioning access to employees and guests. The first BYOD question typically asked is “should all mobile devices be handled by a separate network or should employee owned mobile devices share the same core network while guest devices use another network?”. However you plan to permit mobile devices, best practice for BYOD is to automate the process based on multiple factors such as device type, user authentication and risk status. Policies permitting employee access using personal devices should have a process to register and track those devices (IE web registration page like in hotels) rather than an “employee wireless password” that could get compromised and not associated to a device. Many solutions such as Cisco Identity Services Engine (ISE) offer self-registration to eliminate the need for employee or guest users to deal with an IT member to gain network access. Solutions that leverage profiling technologies can automatically assigned specific access types based operating system, device type and other details (IE provide different access for iPhones and Androids) so you know who and what is on your network. “Knowing is half the battle”, GI JOE

The final piece to the BYOD puzzle is device management. Most mobile hardware vendors give power to device owners meaning Apple, Android, etc. device users can take themselves out of compliance at anytime (blackberry is the only exception). Solutions such as Mobile Iron and AirWatch provide methods to assess devices for high risk factors such as jailbreaking or using unapproved applications which is crucial for BYOD. Application based endpoint management solutions verify devices and either permit or deny corporate services such as providing email based on policy status (IE no email service while angry birds is installed). Common BYOD policies are enforcing the use of passwords, remote locking devices, denying hacked devices, provisioning specific applications and having the ability to remote wipe only corporate data. The mobile security market leaders offer a breath of operating systems and hardware options as well as easy methods to communicate when end users fall out of compliance.

Addressing Bring Your Own Device (BYOD): How to manage and secure mobile endpoints

Industry leaders for security are focusing on BYOD by developing solutions for mobile devices. RSA and Symantec recently released data loss prevention (DLP) for mobile devices to deny sensitive information such as social security numbers from moving to or from mobile devices. Network vendors such as Cisco are partnering with mobile manufactures to address BYOD by offering VPN technology that encrypt traffic from mobile devices while off the corporate network. There are many options for endpoint security when looking at BYOD, which the investment for mobile security should match protecting laptops and desktops regardless if the employee owns the asset.

Rating: 5.0/5 (1 vote cast)

5 Comments

Filed under Bring Your Own Device BYOD, Host And Mobile Device Security, Network Admission Control

Tagged as 802.1x, Access Control, ACS, ACS5.0, ACS5.1, ACS5.2, air watch, Airwatch, android, angry birds, anyconnect, bring your own device, bring your own technology, byod, BYOT, Cisco, Cisco Identity Services Engine (ISE), Cisco NAC, Clean Access, Data Loss Prevention, DLP, end point management, endpoint management, Good Technology, Guest Server, Identity Services Engine, Infrastructure, iPad, iPad2, iPhone, iphone 4, iphone 4s, ISE, ISE1.0, jailbreaking, jailbroken, Joey, Joey Muniz, joseph, joseph muniz, mobile, mobile device, mobile device management, mobile endpoints, Mobile Iron, Muniz, NAC, NAC appliance, network access control, network security, Profiler, remote password lock, remote wipe, RSA, Security, Symantec, VPN, WIDS, WIPS, wireless security, work from home, World Wide Technology, world wide technology inc., wwt

Tag Archives: remote wipe

An Overview Of Zenprise Mobile Device Management MDM – Setting Up A Zenprise Lab

Mobile Device Management Testing: Setting up a basic Mobile Iron lab

Addressing Bring Your Own Device (BYOD): How to manage and secure mobile endpoints

Search

Topics

Cisco ISE Documentation

Subscribe

Blogroll