Kaspersky Security 10 for Mobile Implementation Guide

Transcription

1 Kaspersky Security 10 for Mobile Implementation Guide APPLICATION VERSION: 10.0 MAINTENANCE RELEASE 1

2 Dear User, Thank you for choosing our product. We hope that you will find this documentation useful and that it will answer any questions that you may have. Note: This document is the property of Kaspersky Lab ZAO (herein also referred to as Kaspersky Lab): all rights to this document are reserved by the copyright laws of the Russian Federation and by international treaties. Illegal reproduction or distribution of this document or parts hereof will result in civil, administrative, or criminal liability under applicable law. Any type of reproduction or distribution of any materials, including translations, may be allowed only with written permission from Kaspersky Lab. This document and related graphic images can be used for informational, non-commercial, or personal use exclusively. This document may be amended without prior notice. You can find the latest version of this document at the Kaspersky Lab website, at Kaspersky Lab assumes no liability for the content, quality, relevance, or accuracy of any third-party materials used herein, or for any potential harm associated with the use of such materials. Document revision date: 6/18/ Kaspersky Lab ZAO. All Rights Reserved

3 CONTENTS ABOUT THIS GUIDE... 6 In this document... 6 Document conventions... 8 SOURCES OF INFORMATION ABOUT THE APPLICATION... 9 Sources of information for independent research... 9 Discussing Kaspersky Lab applications on the Forum Contacting the Sales Department Contacting Technical Writing and Localization Unit by KASPERSKY SECURITY 10 FOR MOBILE What's new Distribution kit Hardware and software requirements COMMON APPLICATION DEPLOYMENT MODELS Application deployment models for Android devices Deployment via link Deployment via SMS link Deployment via workstations Deployment via Google Play Application deployment models for ios devices Application deployment model for ios devices Deployment via Apple Store Application deployment model for Blackberry, Symbian, and Windows Mobile devices PREPARING FOR APPLICATION INSTALLATION Installing the Mobile devices support component Upgrading the version of the Administration Server component Configuring the mobile device connection settings Installing the Administration Plug-in for Kaspersky Security for Mobile Creating a group Creating a rule for device automatic allocating to administration groups Creating a group policy for Kaspersky Security 10 for Mobile Step 1. Choose a group policy name for the application Step 2. Choose an application for creating a group policy Step 3. Configure device scan settings Step 4. Configuring Protection settings Step 5. Configuring Update settings Step 6. Configuring Anti-Theft settings Step 7. Configuring network settings Step 8. Configuring App Control Step 9. Configuring device control Step 10. Configuring additional settings Step 11. Activating the application Step 12. Setting the policy status Preparing for installation on Android devices Mailing settings

4 I M P L E M E N T A T I O N G U I D E Configuring text message delivery methods Creating an installation package Configuring installation package settings Preparing for installation on ios devices Configuring the interface of the Kaspersky Security Center Administration Console Getting the APN certificate Installing the APN certificate on the ios MDM server Creating and sending an ios MDM profile UPGRADING FROM A PREVIOUS VERSION OF THE APPLICATION USING CONTAINERS About containers Creating containers Signing a container to be used on ios devices INSTALLING THE APPLICATION ON ANDROID DEVICES Installing the application via link Creating a stand-alone installation package Sending s to users Installing the application on the mobile device after receiving the Installing the application via SMS Creating a stand-alone installation package Sending text messages to users Installing the application on the mobile device after receiving the text message Installation using the workstation Creating a remote installation task Delivering the application distribution kit to mobile devices using the workstation Application installation on mobile devices using the workstation Installing the application from Google Play INSTALLING THE APPLICATION ON IOS DEVICES Getting the developer certificate Creating a provisioning profile Signing the app distribution kit Installing the application on an ios mobile device Installing the application from Apple Store INSTALLING THE APPLICATION ON BLACKBERRY, SYMBIAN AND WINDOWS MOBILE DEVICES USING WORKSTATIONS PREPARING THE APPLICATION TO BE USED ON THE DEVICE ACTIVATION OF AN APPLICATION REMOVING THE APPLICATION Removing the application from Android devices Permitting users to remove the application Removing the application from the device without the user's involvement Removing the application from BlackBerry, Symbian, and Windows Mobile devices Removing the application from Android devices

5 C O N T E N T S INFORMATION EXCHANGE WITH KASPERSKY SECURITY NETWORK CONTACTING THE TECHNICAL SUPPORT SERVICE How to obtain technical support Technical support by phone Technical Support via Kaspersky CompanyAccount Technical Support by Electronic request to sign APN certificate Online request to the Virus Lab GLOSSARY KASPERSKY LAB ZAO INFORMATION ABOUT THIRD-PARTY CODE TRADEMARK NOTIFICATIONS INDEX

6 ABOUT THIS GUIDE This document represents the Kaspersky Security 10 for Mobile Implementation Guide. The Guide is addressed to the technical specialists whose responsibilities include Kaspersky Security 10 for Mobile (hereinafter referred to as Kaspersky Security) installation and administration, as well as support of the organizations that use the program. This Guide is intended to do the following: Provide the general description of the Kaspersky Security 10 operating principles, system requirements, typical deployment scenarios, the features of integration with other applications. Assist in planning of Kaspersky Security 10 for Mobile deployment across the enterprise network. Describe preparation for Kaspersky Security 10 for Mobile installation, the application installation and activation. Provide recommendations on Kaspersky Security 10 for Mobile support and administration after installation. Describe additional sources of information about the application and ways of receiving technical support. IN THIS SECTION In this document... 6 Document conventions... 8 IN THIS DOCUMENT This document comprises the following sections. Sources of information on the application (see page 9) This section describes sources of information about the application and lists websites that you can use to discuss the application. Kaspersky Security 10 for Mobile (see page 11) This section describes the purpose, key features and structure of Kaspersky Security 10 for Mobile. Typical deployment models for the application (see page 16) This section covers the common Kaspersky Security 10 for Mobile deployment models. Preparing for installation of the application (see page 23) This section describes how to configure mobile device management via Kaspersky Security Center for the Kaspersky Security application deployment. Updating the previous application version (see page 44) This section describes how to update the previous version of Kaspersky Security 10 for Mobile. 6

7 A B O U T T H I S G U I D E Using containers (see page 45) This section describes containers, how to create them, and how to sign them so they can be used on ios devices. Installing the application on Android devices (see page 48) This section describes the options for installing Kaspersky Security 10 for Mobile on Android devices. Installing the application on ios devices (see page 55) This section describes the process of installing Kaspersky Security 10 for Mobile on ios devices. Installing the application on BlackBerry, Symbian, and Windows Mobile devices via workstations (see page 59) This section describes how to install Kaspersky Security 10 for Mobile on BlackBerry, Symbian, and Windows Mobile devices. Preparing the application for use on the device (see page 60) This section describes the initial configuration of the Administration Server connection settings on user devices. Activating the application (see page 61) This section describes how to activate the application. Removing the application (see page 62) This section describes how to remove Kaspersky Security 10 for Mobile form the user mobile device. Information exchange with Kaspersky Security Network (see page 67) This section describes interaction of Kaspersky Security with the Kaspersky Security Network cloud service. Contacting the Technical Support service (see page 68) This section provides information about how to obtain technical support and the requirements for receiving help from Technical Support. Glossary This section contains a list of terms that are mentioned in the document and their definitions. Kaspersky Lab ZAO This section provides information about Kaspersky Lab ZAO. Information about third-party code This section provides information about the third-party code used in the application. Trademark notices This section lists trademarks of third-party manufacturers that were used in the document. 7

8 I M P L E M E N T A T I O N G U I D E Index This section allows you to quickly find required information within the document. DOCUMENT CONVENTIONS The document text is accompanied by semantic elements to which we recommend paying particular attention: warnings, hints, and examples. Document conventions are used to highlight semantic elements. The following table shows document conventions and examples of their use. Table 1. Document conventions SAMPLE TEXT Note that... We recommended that you use... Example: DESCRIPTION OF DOCUMENT CONVENTION Warnings are highlighted in red and boxed. Warnings provide information about possible unwanted actions that may lead to data loss, failures in equipment operation or operating system problems. Notes are boxed. Notes may contain useful hints, recommendations, specific values for settings, or important special cases in operation of the application. Examples are given on a yellow background under the heading "Example".... Update means... The Databases are out of date event occurs. Press ENTER. Press ALT+F4. Click the Enable button. To configure a task schedule: In the command line, type help. The following message appears: Specify the date in DD:MM:YY format. <User name> The following semantic elements are italicized in the text: New terms Names of application statuses and events Names of keyboard keys appear in bold and are capitalized. Names of keys that are connected by a + (plus) sign indicate the use of a key combination. Those keys must be pressed simultaneously. Names of application interface elements, such as entry fields, menu items, and buttons, are in bold. Introductory phrases of instructions are italicized and marked with the arrow sign. The following types of text content are marked with a special font: Text in the command line Text of messages that the application displays on the screen Data that the user must enter. Variables are in angle brackets. It is required to replace each variable by the corresponding value, omitting angle brackets. 8

9 SOURCES OF INFORMATION ABOUT THE APPLICATION This section describes sources of information about the application and lists websites that you can use to discuss the application. You can select the most suitable information source, depending on importance and urgency of the issue. IN THIS SECTION Sources of information for independent research... 9 Discussing Kaspersky Lab applications on the Forum Contacting the Sales Department Contacting Technical Writing and Localization Unit by SOURCES OF INFORMATION FOR INDEPENDENT RESEARCH You can use the following sources of information to research on your own: Application page on the Kaspersky Lab website Application page on the Technical Support website (Knowledge Base) Online help Documentation If you have not found a solution to your problem, we recommend you contacting Kaspersky Lab Technical Support (see the Technical Support by phone section on page 68). An Internet connection is required to use information sources on the Kaspersky Lab website. Application page on the Kaspersky Lab website The Kaspersky Lab website features an individual page for each application. On page ( you can find general information about the application, its features and operation parameters. The page contains a link to the estore. There you can purchase or renew the application. Application page on the Technical Support website (Knowledge Base) Knowledge Base is a section on the Technical Support website that provides advice on using Kaspersky Lab applications. The Knowledge Base consists of reference articles that are grouped by topic. 9

10 I M P L E M E N T A T I O N G U I D E On the application page in the Knowledge Base ( you can find articles that contain useful information, recommendations and answers to frequently asked questions on the application purchasing, installation, and use. The articles answer questions that refer not only to Kaspersky Security, but also to other Kaspersky Lab's applications, and contain news from Technical Support. Online help The online help of the application comprises help files. The Context Help contains information about each window of the application: the list and description of settings and links to the tasks for which these settings are used. Documentation The distribution kit includes documents that help you to install and activate the application on the computers of a local area network, configure its settings, and find information about the basic techniques for using the application. DISCUSSING KASPERSKY LAB APPLICATIONS ON THE FORUM If your question does not require an immediate answer, you can discuss it with the Kaspersky Lab experts and other users in our forum ( In this forum you can view existing topics, leave your comments, and create new discussion topics. CONTACTING THE SALES DEPARTMENT If you have any questions on how to select, purchase, or renew the application, you can contact our Sales Department specialists in one of the following ways: By calling our central office in Moscow by phone ( By sending your message with a question to sales@kaspersky.com. Service is provided in Russian and in English. CONTACTING TECHNICAL WRITING AND LOCALIZATION UNIT BY To contact the Documentation Development Group, please send your message to docfeedback@kaspersky.com. Please specify: "Kaspersky Help Feedback: Kaspersky Security 10 for Mobile" in the message subject line. 10

11 KASPERSKY SECURITY 10 FOR MOBILE Kaspersky Security 10 for Mobile protects Android, ios, BlackBerry, Microsoft Windows Mobile, and Symbian mobile devices against viruses and other malware, unwanted calls and SMS messages, and web threats. The application lets you monitor user network activity and protect confidential information against unauthorized access. Different components are used to provide protection against each type of threat. The application settings can be configured flexibly depending on specific user needs. The availability of protection components listed below depends on the operating system of the mobile device. Kaspersky Security 10 for Mobile supports interaction with the remote Kaspersky Security Center administration system. Using this system, the corporate network administrator can: Install the application on mobile devices Configure the application settings to be used both for a group of devices and for an individual device Generate reports on the performance of components of the application installed on mobile devices Remove the application from Android devices Kaspersky Security 10 for Mobile includes the following protection components: Anti-Virus. It allows you to detect and neutralize threats on your device by using the Anti-Virus databases and the Kaspersky Security Network cloud service. Anti-Virus includes the following components: protection, scan, and update. Protection detects threats in open files, scans new applications, and prevents device infection in real time. Scan is performed on demand for the entire file system, the random access memory, or a folder. Full Scan scans the entire file system for the presence of malicious objects; Folder Scan scans a specific folder. Full Scan and Folder Scan detect threats in files that have been installed but not yet opened, as well as threats in files that are currently open. Memory Scan detects threats only in files that are currently open. Update allows you to download new Anti-Virus databases for the application. Privacy Protection. This allows you to hide confidential user information when other persons are using the device. The component hides or shows all information connected with the specified subscribers' addresses, for example, the contact list, the history of connections, and the SMS correspondence with the contacts. The component also allows you to hide delivery of incoming calls and SMS messages from the specified subscribers' numbers. Anti-Theft. This component protects information on the device against unauthorized access in case the device is lost or stolen. With the component, you can lock or locate the device or delete information from it via an SMS command or via Kaspersky Security Center. Call & SMS Filter. The component blocks unwanted messages and calls in accordance with the selected mode. Filtering messages and calls is carried out using the lists of allowed and blocked contacts. Depending on the settings, the component delivers calls and SMS messages from allowed contacts, and blocks calls and SMS messages from blocked contacts. In addition to the selected mode, using the component you can enable incoming events from all phone numbers in the device address book (Contacts) or block incoming events from the phone numbers that contain letters. Web Protection. This blocks malicious websites that distribute malicious code and fake (phishing) websites that can steal confidential user data, such as online banking passwords, online auction and e-money passwords, and access your financial accounts. The component scans websites before you open them using the Kaspersky Security Network cloud service. Depending on the scan results, Web Protection loads websites that are recognized as genuine, and blocks websites that are considered to be malicious. The component also supports website filtering by categories defined in Kaspersky Security Network. Thus, the administrator can restrict access to certain web pages, for example, the ones from the Gambling or Social Networks categories. 11

12 I M P L E M E N T A T I O N G U I D E Firewall. This component controls network connections on the mobile device. With the component, you can define the connections to be allowed or blocked. App Control. This allows you to modify the settings of application launch on the user mobile device via Kaspersky Security Center. The administrator can specify the applications that must be installed on the user device and can create the lists of allowed and blocked applications. The component blocks attempts to run the forbidden applications; information on the attempts is available in the Kaspersky Security Center reports. The component also lets you create and use the container, which is a special shell for mobile apps that allows you to control actions of the containerized application, thereby protecting corporate data on the device. Containerized apps can be used as allowed or even required applications. Device Management. This component allows you to configure the obligatory password to unlock the mobile device and the minimum password length. With this component, you can prohibit the use of Wi-Fi networks, the camera or Bluetooth functionality on the device. Encryption. This component protects data from being viewed by unauthorized users in the event of unauthorized access to the device. As soon as the device switches to the power-saving mode, the component encrypts the selected non-system folders stored in the device memory or on the memory card. The data in the encrypted folders is available only after the secret code is entered. IN THIS SECTION What's new Distribution kit Hardware and software requirements WHAT'S NEW Kaspersky Security 10 for Mobile differs from the previous application version in the following: The heuristic scan during protection operation has been added. The Call & SMS Filter functionality has been improved: for the lists of allowed and blocked contacts, an option to import data from the call log and SMS list has been added. The list of events recorded in the application performance reports has been added. Support of ios devices is now available: remote installation of the application on ios devices and administration via Kaspersky Security Center. Support of devices running Android 4.0 or later has been added. For devices with the Android operating system (hereinafter "Android devices"): The model of application deployment via Kaspersky Security Center has been added. In this model, an SMS link is sent to users' phone numbers or an link is sent to users' corporate addresses. The app distribution package with settings for connecting to the Administration Server is delivered to the user's device. When the app is installed using this distribution package, the user is not required to specify the connection settings manually. Newly installed apps are now scanned immediately after installation using the Kaspersky Security Network cloud service. Kaspersky Security 10 can now be activated as the Device Administrator. This provides advanced capabilities for the protection of Android devices. 12

13 K A S P E R S K Y S E C U R I T Y 10 F O R M O B I L E The application is now able to detect adware and applications that can be used by intruders to damage the device or corporate data of the user. The Anti-Theft functionality has been improved; now you can start Anti-Theft functions remotely and delete all data from the device by a command sent from Kaspersky Security Center. It is now possible to block websites by categories specified in Kaspersky Security Network, with the option to restrict access to web resources categorized as malicious, phishing or unwanted websites. Now via Kaspersky Security Center, you can specify applications allowed and blocked on the device and applications that must be installed on the user's device. The application now detects access to the device with administrator privileges (root access) and prompts the user for action. The option to create and use the container has been added. The container is a special frame for mobile applications that allows you to control actions of the wrapped application, thereby protecting the corporate data on the device. Containerized apps can be used as allowed or even required applications. You can configure user authorization to be used at the launch of a containerized app. You can now manage the user's device remotely via Kaspersky Security Center: impose restrictions on camera, Wi-Fi module, and Bluetooth usage by the device, and enable or disable the system password prompt when the device is powered on. It is now possible to configure the TouchDown client for user access to corporate . The feature for configuring wireless LANs for connecting the user s mobile devices has been added. The application can now be removed from the device remotely via Kaspersky Security Center. The user can now manually remove the application from the mobile device. For devices with the ios operating system (hereinafter "ios devices"): The option to create and use the container has been added. The container is a special frame for mobile applications that allows you to control actions of the wrapped application, thereby protecting any corporate data on the device. It is now possible to block specific categories of websites. The application now detects access to the ios device with administrator privileges (jailbreak) and prompts the user for action. DISTRIBUTION KIT The Kaspersky Security 10 for Mobile distribution kit includes the following components: The sc_package_en self-unpacking archive containing setup files for all supported systems: adb.exe, AdbWinApi.dll, AdbWinUsbApi.dll are the files required to install the application on Android devices. endpoint_8_0_0_37_en.cab is the application installation file for Windows Mobile. endpoint8_mobile_8_x_xx_en.sisx is the application installation file for Symbian. endpoint8_mobile_8_x_xx_en.zip is the application installation file for BlackBerry. installer.ini is the configuration file that contains the Administration Server connection setting. 13

14 I M P L E M E N T A T I O N G U I D E KSM_10_1_xx_en.apk is the application installation file for Android. kmlisten.exe is the tool for delivering the application installation package using the workstation. kmlisten.ini is the configuration file that contains the settings for the delivery tool of the installation package. kmlisten.kpd is the application description file. klcfginst_en.exe is the setup file of the Kaspersky Security 10 for Mobile plug-in for administering the application via the Kaspersky Security Center remote administration system. KSM_10_1_xx_en.apk is the Kaspersky Security 10 installation file for Android. KSM_10_1_xx_en.zip the Kaspersky Security 10 installation file for ios. endpoint_8_0_0_37_en.cab is the application installation file for Windows Mobile. endpoint8_mobile_8_x_xx_en.sisx is the application installation file for Symbian. blackberry a folder containing a set of files needed to install the app on BlackBerry devices, including the app setup file endpoint8_mobile_8_x_xx_en.zip. sms_utility_ en.apk the Kaspersky SMS Broadcasting utility. SigningUtility.zip an archive containing a utility for signing the app distribution package and containers for ios devices. Documentation: Kaspersky Security 10 for Mobile Implementation Guide Context Help for the Administration Plug-in of Kaspersky Security 10 for Mobile Context Help for Android Context Help for Microsoft Windows Mobile Context Help for Symbian Context Help for BlackBerry Context Help for ios HARDWARE AND SOFTWARE REQUIREMENTS To run Kaspersky Security 10 for Mobile on user mobile devices, the device must meet the following software requirements: Android 2.2, 2.3, 3.0, 3.1, 3.2, 4.0, 4.1, 4.2 Apple ios 4.3, 5.0, 5.1, 6.0, 6.1 BlackBerry 4.5, 4.6, 4.7, 5.0, 6.0, 7.0, 7.1 Symbian OS 9.1, 9.2, 9.3, 9.4 Series 60 UI Symbian^3, Symbian Anna, Symbian Belle (only for Nokia mobile devices) Windows Mobile 5.0, 6.0, 6.1,

15 K A S P E R S K Y S E C U R I T Y 10 F O R M O B I L E To deploy Kaspersky Security 10 for Mobile on Android devices, the administrator's computer must meet the following software requirements: Kaspersky Security Center 10.0 Kaspersky SMS Broadcasting utility To deploy Kaspersky Security 10 for Mobile on ios devices, the administrator's computer must meet the following hardware requirements: Mac OS X or later, Mac OS X 10.7, OS X 10.8 iphone Configuration Utility 3.5 or later for Maс, or iphone Configuration Utility or later for Windows To deploy Kaspersky Security 10 for Mobile on ios devices, the administrator's computer must meet the following software requirements: Kaspersky Security Center 10.0 ios Mobile Device Management (MDM) server Kaspersky SMS Broadcasting utility Key Chain Access utility To install the app on ios devices, you need participant status in the Apple Developer Program or the Apple Developer Enterprise Program. Participants of the Apple Developer Program can install Kaspersky Security 10 for Mobile on no more than 100 devices a year. You need to obtain a separate AppleID to get an Apple Push Notification service (APNs) certificate. To deploy Kaspersky Security 10 for Mobile on Windows Mobile, Blackberry, and Symbian devices, the administrator's computer must meet the following software requirements: Kaspersky Security Center version 9.0 or later. To manage mobile devices via the Exchange ActiveSync protocol, the administrator's computer must meet the following software requirements: Kaspersky Security Center 10.0 Exchange ActiveSync mobile device server component. 15

16 COMMON APPLICATION DEPLOYMENT MODELS This section covers the common Kaspersky Security 10 for Mobile deployment models. The Kaspersky Security deployment model depends on the operating system installed on the user device. IN THIS SECTION Application deployment models for Android devices Application deployment models for ios devices Application deployment model for Blackberry, Symbian, and Windows Mobile devices APPLICATION DEPLOYMENT MODELS FOR ANDROID DEVICES The application can be installed on Android devices in one of the following ways: By ing the link to the application distribution to users (see the section Deployment via links on page 16). By texting the link to the application distribution package to users (via SMS) (see section "Deployment via SMS links" on page 17). Through workstations to which users connect their mobile devices (see section "Deployment via workstations" on page 18). Users can also install the Kaspersky Security distribution package on their mobile devices without the involvement of the administrator (see section "Deployment via Google Play" on page 19) as a standard Android application. IN THIS SECTION Deployment via link Deployment via SMS link Deployment via workstations Deployment via Google Play DEPLOYMENT VIA LINK In the case of application deployment model via , users are provided with a specially configured application distribution package containing the settings of the connection to Administration Server. When the application is installed using this distribution package, users are not required to specify the connection settings manually. This distribution package is known as the standalone installation package. If mobile devices of users are managed by the Exchange Active Sync mobile device server deployed as part of Kaspersky Security Center and mailboxes of such users are connected to a Microsoft Exchange server, you can also install Kaspersky Security using the model described below. 16

17 C O M M O N A P P L I C A T I O N D E P L O Y M E N T M O D E L S This deployment model consists of the following steps: 1. Preparing for application installation: a. Installing the Mobile devices support component in Kaspersky Security Center. The certificate of Administration Server for mobile devices is created at this step (see page 23). b. Configuring the mobile device connection settings. At this step, the mobile device connection settings are configured in the properties of Administration Server to ensure synchronization of mobile devices with Administration Server (see page 24). c. Installing the Administration Plug-in of Kaspersky Security 10 for Mobile on the administrator's workstation (see page 24). d. Creating groups of mobile devices as part of managed computers in the system of Kaspersky Security Center (see page 25). Devices with Kaspersky Security 10 for Mobile installed are moved to these groups either manually or according to automatic transfer rules. e. Creating a rule for allocating mobile devices to a group automatically (see page 25). f. Creating a group policy for managing Kaspersky Security 10 for Mobile settings (see page 27). g. Configuring the Administration Server mailing settings (see page 38). h. Creating the installation package of Kaspersky Security 10 for Mobile (see page 40). i. Configuring the settings of the installation package of Kaspersky Security 10 for Mobile (see page 41). 2. Installing the application on devices: a. Creating a standalone installation package of Kaspersky Security 10 for Mobile (see page 48). At this step, the standalone package contains the settings of the connection to Administration Server and is available in the public folder on the Kaspersky Security Center web server. When creating an , you can select any of the resources and specify the link to the right resource, or attach the standalone installation package to the . b. Creating and sending an with the link to the standalone installation package to users of mobile devices (see section "Sending s to users" on page 49). c. Downloading the standalone installation package to the mobile device. At this step, the user downloads the pre-configured distribution package from the attachment or a public resource. d. Installing the application on a mobile device (see page 50). 3. Preparing the application for use on devices: Activating the application on mobile devices of users (see page 61). This model of application deployment on Android devices is suitable for Kaspersky Security 10 only. The Kaspersky Security Center control plug-in of Kaspersky Security 10 for Mobile also supports management of devices with an older version of the application. Kaspersky Lab recommends upgrading from the older version of the application to be able to use the full functionality of the application (see section "Upgrading from an older version of the application" on page 44). DEPLOYMENT VIA SMS LINK In the case of application deployment model via SMS link, users are provided with a specially configured application distribution package containing the settings of the connection to Administration Server. When the application is installed using this distribution package, users are not required to specify the connection settings manually. This distribution package is known as the standalone installation package. Text messages (SMS) with a link to the standalone installation package can be sent to devices that support transmission of text messages. 17

18 I M P L E M E N T A T I O N G U I D E This deployment model consists of the following steps: 1. Preparing for application installation: a. Installing the Mobile devices support component in Kaspersky Security Center. The certificate of Administration Server for mobile devices is created at this step (see page 23). b. Configuring the mobile device connection settings. At this step, the mobile device connection settings are configured in the properties of Administration Server to ensure synchronization of mobile devices with Administration Server (see page 24). c. Installing the Administration Plug-in of Kaspersky Security 10 for Mobile on the administrator's workstation (see page 24). d. Creating groups of mobile devices as part of managed computers in the system of Kaspersky Security Center (see page 25). Devices with Kaspersky Security 10 for Mobile installed are moved to these groups either manually or according to automatic transfer rules. e. Creating a rule for allocating mobile devices to a group automatically (see page 25). f. Creating a group policy for managing Kaspersky Security 10 for Mobile settings (see page 27). g. Configuring the method of text message (SMS) delivery to users (see page 39). h. Creating the installation package of Kaspersky Security 10 for Mobile (see page 40). i. Configuring the settings of the installation package of Kaspersky Security 10 for Mobile (see page 41). 2. Installing the application on devices: a. Creating a standalone installation package of Kaspersky Security 10 for Mobile (see page 50). At this step, the standalone package contains the settings of the connection to Administration Server and is available in the public folder on the Kaspersky Security Center web server. When creating a text message, you have to select a path to the Kaspersky Security Center web server. b. Creating and sending a text message with the link to the standalone installation package to mobile device users (see page 51). c. Downloading the standalone installation package to the mobile device. At this step, the user downloads the prepared distribution package of the application from the Kaspersky Security Center web server. d. Installing the application on a mobile device (see page 51). 3. Preparing the application for use on devices: Activating the application on mobile devices of users (see page 61). The model of application deployment on Android devices described above is suitable for installation of Kaspersky Security 10 for Mobile only. The Kaspersky Security Center control plug-in of Kaspersky Security 10 for Mobile also supports management of devices with an older version of the application. Kaspersky Lab recommends upgrading from the older version of the application on the device to be able to use the full functionality of the application (see section "Upgrading from an older version of the application" on page 44). DEPLOYMENT VIA WORKSTATIONS Application deployment via workstations is used when users connect their mobile devices to their workstations. This deployment model consists of the following steps: 1. Preparing for application installation: a. Installing the Mobile devices support component in Kaspersky Security Center. The certificate of Administration Server for mobile devices is created at this step (see page 23). b. Configuring the mobile device connection settings. At this step, the mobile device connection settings are configured in the properties of Administration Server to ensure synchronization of mobile devices with Administration Server (see page 24). 18

19 C O M M O N A P P L I C A T I O N D E P L O Y M E N T M O D E L S c. Installing the Administration Plug-in of Kaspersky Security 10 for Mobile on the administrator's workstation (see page 24). d. Creating groups of mobile devices as part of managed computers in the system of Kaspersky Security Center (see page 25). Devices with Kaspersky Security 10 for Mobile installed are moved to these groups either manually or according to automatic transfer rules. e. Creating a rule for allocating mobile devices to a group automatically (see page 25). f. Creating a group policy for managing Kaspersky Security 10 for Mobile settings (see page 27). g. Creating the installation package for the Kaspersky Security 10 for Mobile remote installation task (see page 40). h. Configuring the settings of the installation package for the Kaspersky Security 10 for Mobile remote installation task (see page 41). 2. Installing the application on devices: a. Creating a remote installation task (see page 52) for delivering the Kaspersky Security 10 for Mobile distribution package to users' workstations and installing the utility for uploading the distribution package to mobile devices. b. Uploading the application distribution package to the mobile device. At this step, the user uses the kmlisten.exe utility to copy the application distribution package to the mobile device (see section "Delivering the application distribution kit to mobile devices using the workstation" on page 54). c. Installing the application on the mobile device. At this stage, the user installs the application on the mobile device (see page 54). 3. Preparing the application for use on devices: Activating the application on mobile devices of users (see page 61). DEPLOYMENT VIA GOOGLE PLAY Direct download of the installation file to the device can be used when users find it more convenient to install the application on their own, for example by downloading the installation file from Google Play. In this case, you do not have to prepare the application distribution file, as users specify the settings of the connection to Administration Server on their own at first application startup (see section "Preparing the application for use on the device" on page 60). This deployment model consists of the following steps: 1. Preparing for application installation: a. Installing the Mobile devices support component in Kaspersky Security Center. The certificate of Administration Server for mobile devices is created at this step (see page 23). b. Configuring the mobile device connection settings. At this step, the mobile device connection settings are configured in the properties of Administration Server to ensure synchronization of mobile devices with Administration Server (see page 24). c. Installing the Administration Plug-in of Kaspersky Security 10 for Mobile on the administrator's workstation (see page 24). d. Creating groups of mobile devices as part of managed computers in the system of Kaspersky Security Center (see page 25). Devices with Kaspersky Security 10 for Mobile installed are moved to these groups either manually or according to automatic transfer rules. e. Creating a rule for allocating mobile devices to a group automatically (see page 25). f. Creating a group policy for managing Kaspersky Security 10 for Mobile settings (see page 27). 19

20 I M P L E M E N T A T I O N G U I D E 2. Installing the application on devices: installing the application on a mobile device. At this stage, the user installs the application on the mobile device (see page 54). 3. Preparing the application for use on devices: a. Performing initial configuration of the application. At this step, the user specifies the settings of the mobile device connection to Administration Server (see section "Preparing the application for use on the device" on page 60). b. Activating the application on mobile devices of users (see page 61). APPLICATION DEPLOYMENT MODELS FOR IOS DEVICES The application can be installed on ios devices either by the administrator when connecting such ios devices to the ios MDM server (see section "Application deployment model for ios devices" on page 20) or by users, who can download the app directly from Apple Store (see section "Deployment via Apple Store" on page 21). IN THIS SECTION Application deployment model for ios devices Deployment via Apple Store APPLICATION DEPLOYMENT MODEL FOR IOS DEVICES To install Kaspersky Security on users' ios mobile devices, the ios MDM server must be deployed at Kaspersky Security Center. The ios MDM server is included in the Administration Server installation packages if a license covering the Mobile device management functionality has been purchased. See the Kaspersky Security Center Deployment Guide for details on installing the ios MDM server. Administration Server controls ios mobile devices by means of the ios MDM mobile device server. Centralized management of the app settings is performed using polices applied to groups of managed devices. This deployment model consists of the following steps: 1. Preparing for application installation: a. Installing the Mobile devices support component in Kaspersky Security Center. The certificate of Administration Server for mobile devices is created at this step (see page 23). b. Configuring the mobile device connection settings. At this step, the mobile device connection settings are configured in the properties of Administration Server to ensure synchronization of mobile devices with Administration Server (see page 24). c. Installing the Administration Plug-in of Kaspersky Security 10 for Mobile on the administrator's workstation (see page 24). d. Creating groups of mobile devices as part of managed computers in the system of Kaspersky Security Center (see page 25). Devices with Kaspersky Security 10 for Mobile installed are moved to these groups either manually or according to automatic transfer rules. e. Creating a rule for allocating mobile devices to a group automatically (see page 25). f. Creating a group policy for managing Kaspersky Security 10 for Mobile settings (see page 27). g. Configuring the Kaspersky Security Center interface for managing mobile devices (see page 41). 20

21 C O M M O N A P P L I C A T I O N D E P L O Y M E N T M O D E L S h. Getting the Apple Push Notification Certificate (hereinafter the "APN certificate") (see page 42). i. Installing the APN certificate on the ios MDM server (see page 42). Data from the APN certificate is required to create a correct MDM profile. Only after installing the APN certificate can you be sure that commands will be delivered to devices in a timely manner. j. Creating an ios MDM profile and delivering it to user devices (see page 42). 2. Installing the application on devices: a. Getting a Developer Certificate (see page 55). b. Creating a provisioning profile (see page 55) that allows installation of third-party apps on devices. c. Signing the application distribution kit (see page 56). d. Installing the application on a user's ios device (see page 57). 3. Preparing the application for use on devices: a. Performing initial configuration of the application on user devices. At this step, the user specifies the settings of the connection to Administration Server (see section "Preparing the application for use on the device" on page 60). b. Activating the application on mobile devices of users (see page 61). DEPLOYMENT VIA APPLE STORE Direct download of the installation file to the device can be used when users find it more convenient to install the application on their own, for example by copying the installation file from Apple Store. In this case, the administrator does not prepare the distribution kit, and the user independently configures the connection to Administration Server at first launch of the application. This deployment model consists of the following steps: 1. Preparing for application installation: a. Installing the Mobile devices support component in Kaspersky Security Center. The certificate of Administration Server for mobile devices is created at this step (see page 23). b. Configuring the mobile device connection settings. At this step, the mobile device connection settings are configured in the properties of Administration Server to ensure synchronization of mobile devices with Administration Server (see page 24). c. Installing the Administration Plug-in of Kaspersky Security 10 for Mobile on the administrator's workstation (see page 24). d. Creating groups of mobile devices as part of managed computers in the system of Kaspersky Security Center (see page 25). Devices with Kaspersky Security 10 for Mobile installed are moved to these groups either manually or according to automatic transfer rules. e. Creating a rule for allocating mobile devices to a group automatically (see page 25). f. Creating a group policy for managing Kaspersky Security 10 for Mobile settings (see page 27). 2. Installing the application on devices: installing the application on a mobile device. At this stage, the user installs the application on the mobile device (see page 58). 21

22 I M P L E M E N T A T I O N G U I D E 3. Preparing the application for use on devices: a. Performing initial configuration of the application. At this stage, the user specifies the settings of the mobile device connection to Administration Server (see page 60). b. Activating the application on mobile devices of users (see page 61). APPLICATION DEPLOYMENT MODEL FOR BLACKBERRY, SYMBIAN, AND WINDOWS MOBILE DEVICES Kaspersky Security 10 for Mobile distribution kit contains application distribution packages for different operating systems (see the Distribution kit section on page 13). Version for the BlackBerry, Symbian and Windows Mobile platforms includes Kaspersky Endpoint Security 8.0 for Smartphone distribution packages. The Kaspersky Security 10 for Mobile control plug-in installed in the remote administration system of Kaspersky Security Center supports management of devices with Kaspersky Endpoint Security 8.0 for Smartphone. The application deployment model for Blackberry, Symbian, and Windows Mobile devices consists of the following steps: This deployment model consists of the following steps: 1. Preparing for application installation: a. Installing the Mobile devices support component in Kaspersky Security Center. The certificate of Administration Server for mobile devices is created at this step (see page 23). b. Configuring the mobile device connection settings. At this step, the mobile device connection settings are configured in the properties of Administration Server to ensure synchronization of mobile devices with Administration Server (see page 24). c. Installing the Administration Plug-in of Kaspersky Security 10 for Mobile on the administrator's workstation (see page 24). d. Creating groups of mobile devices as part of managed computers in the system of Kaspersky Security Center (see page 25). Devices with Kaspersky Security 10 for Mobile installed are moved to these groups either manually or according to automatic transfer rules. e. Creating a rule for allocating mobile devices to a group automatically (see page 25). f. Creating a group policy for managing Kaspersky Security 10 for Mobile settings (see page 27). g. Creating the installation package for the Kaspersky Security 10 for Mobile remote installation task (see page 40). h. Configuring the settings of the installation package for the Kaspersky Security 10 for Mobile remote installation task (see page 41). 2. Installing the application on devices: a. Creating a remote installation task for delivering the Kaspersky Endpoint Security 8.0 for Smartphone distribution package to users' workstations and installing the utility for uploading the distribution package to mobile devices. b. Delivery of the application distribution package to the mobile device. At this stage, the user copies the application distribution package to the mobile device by using the utility kmlisten.exe. c. Installing the application on the mobile device. At this stage, the user installs the application on the mobile device. 3. Preparing the application for use on devices: Activating the application on mobile devices of users (see page 61). 22