Enterprise Product Guide

Transcription

1 Enterprise Product Guide BlackBerry Enterprise Software July 2016

2 Published: SWD

3 Contents BlackBerry enterprise products... 5 The BlackBerry Infrastructure...6 BES Architecture: BES BES12 components... 8 BES12 Cloud Architecture: BES12 Cloud BES12 and Good Dynamics integration...14 BES12 and Good Dynamics components...14 Good Secure EMM Suites Good Secure EMM Suite components Enterprise products that enhance BES Strong Authentication by BlackBerry...24 Architecture: Strong Authentication Enterprise Identity by BlackBerry Architecture: Enterprise Identity by BlackBerry BlackBerry Enterprise IM Architecture: BlackBerry Enterprise IM BlackBerry Compression for Enterprise...28 WorkLife by BlackBerry BlackBerry Web Services Architecture: BlackBerry Web Services and BES BlackBerry Resource Kit for BES BlackBerry Work Drives...31 Enterprise products that complement BES BBM Protected...33 WatchDox by BlackBerry...33 SecuSUITE for Enterprise...34

4 AtHoc by BlackBerry...34 Glossary Legal notice...37

5 BlackBerry enterprise products BlackBerry enterprise products 1 The BlackBerry enterprise software platform offers more than the best-in-class cross-platform enterprise mobility management provided by BES12. BES12 can be integrated with Good Dynamics to provide a secure mobile app platform and container managed from within a single interface. Good Secure EMM Suites combine BES12 and Good Dynamics and can add more value-added services to mobilize content, deploy leading business apps, deliver enhanced collaboration, protect your enterprise content everywhere it goes, and ensure document security and compliance. This document shows how BlackBerry enterprise products work together to help you securely mobilize your people, processes, apps, and information. 5

6 The BlackBerry Infrastructure The BlackBerry Infrastructure 2 At the heart of BlackBerry is the BlackBerry Infrastructure. The BlackBerry Infrastructure is a global private data network distributed across multiple regions that enables and secures data in transit between thousands of organizations and millions of users around the world. It is designed to efficiently manage the transport of data between BlackBerry services and end-user devices. The BlackBerry Infrastructure hosts cloud-based products and services, including BES12 Cloud and BlackBerry Identity. It is also the essential, highly secure hub for many BlackBerry products and services, including: BES12 BBM Strong Authentication by BlackBerry Enterprise Identity by BlackBerry SecuSUITE for Enterprise BlackBerry Internet Service for third-party on BlackBerry OS devices For organizations using BES12, the BlackBerry Infrastructure provides a trusted path between the organization and every user based on strong, cryptographic, mutual authentication. Because of the end-to-end encryption that protects data transmitted between the device and BES12, organizations can be sure that data sent to and from devices is safe and secure. BES12 maintains a constant connection to the BlackBerry Infrastructure, meaning that organizations require only a single outbound connection to a trusted IP address to send data to users. 6

7 BES12 BES12 3 BES12 is a multiplatform EMM solution that provides comprehensive device, application, and content management with integrated security and connectivity. With BES12 you can: Manage BlackBerry 10, ios, OS X, Android (including devices that use Android for Work and Samsung KNOX), Windows (including Windows 10 tablets and computers), and BlackBerry OS (version 5.0 to 7.1) devices Use a simple web-based interface to manage BYOD, COPE, and COBO devices and protect business information Manage complex fleets of devices using comprehensive reporting and dashboards, dynamic filters, and robust search capabilities Keep mobile workers connected with the information that they need Architecture: BES12 For more information about the BES12 architecture, see the BES12 Architecture content. Component BES12 BES12 is a multiplatform EMM solution that provides comprehensive device, application, and content management with integrated security and connectivity. 7

8 BES12 Component BlackBerry Infrastructure The BlackBerry Infrastructure registers user information for device activation and validates licensing information for BES12. All the data that travels between the BlackBerry Infrastructure and BES12 is authenticated and encrypted to provide a secure communication channel into your organization for devices outside the firewall. Devices BES12 supports BlackBerry 10, ios, OS X, Android, Windows, and BlackBerry OS (version 5.0 to 7.1) devices. Third-party application and content servers Good Dynamics and BlackBerry plug-ins BES12 connects to content and application servers in your organization's environment, including the company directory, mail server, certificate authorities, and so on. BES12 works with additional BlackBerry enterprise products such as Good Dynamics, Enterprise Identity by BlackBerry, Strong Authentication by BlackBerry, WatchDox by BlackBerry, and WorkLife by BlackBerry to allow you to extend EMM capabilities in your organization. BES12 components The diagram shows the BES12 components that are used to manage BlackBerry 10, Android, ios, OS X, and Windows devices. For information about the components that manage BlackBerry OS (version 5.0 to 7.1 devices), see the BES12 Architecture content. 8

9 BES12 Component name BES12 Core The BES12 Core is the central component of BES12. It has several subcomponents that are responsible for: Logging, monitoring, reporting, and management functions Authentication and authorization services for the BES12 Core local directory and company directories Scheduling and sending commands, IT policies, and profiles to devices If there are multiple installations of BES12 in the domain, all of the BES12 Core instances are active and each of them can connect to the BlackBerry Infrastructure and process traffic. BES12 database BlackBerry Affinity Manager The BES12 database is a relational database that contains user account information and configuration information that BES12 uses to manage devices. You can install the BES12 database on the same computer as a BES12 instance, or on a separate computer. For redundancy or business continuity, you can configure database mirroring. The BlackBerry Affinity Manager is responsible for maintaining an active SRP connection between BlackBerry 10 devices and the BlackBerry Infrastructure when the devices are not using BlackBerry Secure Connect Plus. 9

10 BES12 Component name The BlackBerry Affinity Manager provides the Exchange ActiveSync connectivity and logging settings for the BlackBerry Work Connect Notification Service. It also assigns BlackBerry 10 devices to the BlackBerry Dispatcher using the information in the BES12 database. BlackBerry Collaboration Service The BlackBerry Collaboration Service provides an encrypted connection between your organization's instant messaging server and the BlackBerry Enterprise IM app on BlackBerry 10 devices so that users can start and manage instant messaging conversations on their devices. The BlackBerry Collaboration Service is an optional component and is available as a separate installation. BlackBerry Dispatcher The BlackBerry Dispatcher provides secure connectivity using IPPP for BlackBerry 10 devices. The BlackBerry Dispatcher dynamically updates the devices that it handles based on the list it receives from the active BlackBerry Affinity Manager. BlackBerry Gatekeeping Service BlackBerry MDS Connection Service BlackBerry Secure Connect Plus BlackBerry Secure Gateway Service BlackBerry Work Connect Notification Service Management console and BES12 Self-Service The BlackBerry Gatekeeping Service sends commands to Exchange ActiveSync to add devices to an allowed list when devices are activated on BES12. Unmanaged devices that try to connect to an organization's mail server can be reviewed, verified, and blocked or allowed through the BES12 management console by an administrator. The BlackBerry MDS Connection Service provides a secure connection between BlackBerry 10 devices and your organization's network when devices are not connected to your work Wi- Fi network or using a VPN connection. It is also responsible for providing enterprise data push services for BlackBerry 10 devices. BlackBerry Secure Connect Plus provides a secure IP tunnel between work apps on devices and your organization's network. One tunnel that supports standard IPv4 (TCP and UDP) data is established for each device through the BlackBerry Infrastructure. The BlackBerry Secure Gateway Service provides a secure connection through the BlackBerry Infrastructure and BES12 to your organization's mail server for ios devices with MDM controls activations. The BlackBerry Work Connect Notification Service is a web service responsible for providing new and changed and organizer notifications to ios devices that are using Secure Work Space. The management console is a web-based console that is used to: Complete post-installation configuration settings View and manage users, devices, IT policies, profiles, and apps View and manage system settings, including customizing the activation message and adding an APNs certificate Move IT policies, profiles, groups, and users to BES12 10

11 BES12 Component name The management console also provides access to BES12 Self-Service. Users can access BES12 Self-Service to set an activation password and send device commands, such as set password, lock device, and delete device data to their BlackBerry 10, ios, Android, Windows, or OS X devices. 11

12 BES12 Cloud BES12 Cloud 4 BES12 Cloud is a multiplatform cloud-based EMM solution that helps you manage mobile devices, protect business information, keep mobile workers connected with the information they need, and provide administrators with efficient tools that help keep your business moving. BES12 Cloud provides an easy-to-use, low-cost, and secure solution. BlackBerry hosts this service in the BlackBerry Infrastructure and maintains high availability to minimize downtime. You only need a supported web browser to access the service. With BES12 Cloud you can: Manage BlackBerry 10, ios, OS X, Android, and Windows devices Use a simple web-based interface to manage devices and protect business information Keep mobile workers connected with the information that they need Architecture: BES12 Cloud For more information about the BES12 Cloud architecture, see the BES12 Cloud Architecture content. 12

13 BES12 Cloud Component BES12 Cloud BlackBerry Connectivity Node BES12 Cloud is a service that allows you to manage devices used in your organization's environment. The BlackBerry Connectivity Node is an optional component that you install inside your organization's firewall. It includes four components that add functionality to BES12 Cloud: The BlackBerry Cloud Connector connects your company directory to BES12 Cloud to allow basic attribute synchronization, search functionality, and user authentication services. The BlackBerry Gatekeeping Service sends commands to Exchange ActiveSync to add devices to an allowed list when devices are activated on BES12. BlackBerry Secure Connect Plus provides a secure IP tunnel between work apps on devices and your organization's network. The BlackBerry Secure Gateway Service provides a secure connection through the BlackBerry Infrastructure and BES12 to your organization's mail server for ios devices with MDM controls activations. BlackBerry Infrastructure Devices Notification services The BlackBerry Infrastructure registers user information for device activation and validates licensing information for BES12 Cloud. If you enable BlackBerry Secure Connect Plus or the BlackBerry Secure Gateway Service, data in transit that uses these services passes though the BlackBerry Infrastructure. BES12 Cloud supports BlackBerry 10, ios, OS X, Android, and Windows devices. BES12 Cloud sends notifications to devices to contact BES12 for updates and to report information for your organization's device inventory. These notifications are sent to the BlackBerry Infrastructure, where they are sent to the devices using the appropriate notification service: APNs is a service that Apple provides to send notifications to ios and OS X devices. GCM is a service that Google provides to send notifications to Android devices. WNS is a service that Microsoft provides to send notifications to Windows devices. Company directory BES12 Cloud supports connectivity with your organization's Microsoft Active Directory or LDAP company directory using the BlackBerry Connectivity Node. 13

14 BES12 and Good Dynamics integration BES12 and Good Dynamics integration 5 When you integrate BES12 and Good Dynamics, you get unparalleled features and flexibility. These are some of the benefits you get when you integrate BES12 with Good Dynamics: Best-in-class MDM/MAM/EMM, including Apple DEP and VPP, BlackBerry Secure Gateway Service, and support for Samsung KNOX Workspace and Android for Work Best-in-class secure mobile app platform and container Good Work and collaboration apps optimized for a business-class user experience Ecosystem of more than 2000 secure mobile apps and an Open API SDK Cross-platform support for BlackBerry 10, ios, Android, OS X, and Windows devices, desktops, and wearables Comprehensive EMM platform, that can be extended with a rich portfolio of secure mobile apps and services For more information about integrating BES12 and Good Dynamics, see the Good Dynamics content. BES12 and Good Dynamics components This diagram shows how the BES12 and Good Dynamics components connect together. 14

15 BES12 and Good Dynamics integration Component name BES12 Core The BES12 Core is the central component of the BES12 architecture. It consists of several subcomponents that are responsible for: Logging, monitoring, reporting, and management functions Authentication and authorization services Scheduling and sending commands, IT policies, and profiles to devices BES12 database The BES12 database is a relational database that contains user account information and configuration information that BES12 uses to manage devices. 15

16 BES12 and Good Dynamics integration Component name BlackBerry Work Connect Notification Service BlackBerry MDS Connection Service BlackBerry Collaboration Service The BlackBerry Work Connect Notification Service is a web service that is responsible for providing new and changed and organizer notifications to ios devices that are using Secure Work Space. The BlackBerry MDS Connection Service provides a secure connection between BlackBerry 10 devices and your organization's network when the device is not connected to your work Wi- Fi network or using a VPN connection. The BlackBerry Collaboration Service provides an encrypted connection between your organization's instant messaging server and the BlackBerry Enterprise IM app on BlackBerry 10 devices. BlackBerry Dispatcher The BlackBerry Dispatcher provides secure connectivity using IPPP for BlackBerry 10 devices. BlackBerry Affinity Manager The BlackBerry Affinity Manager is responsible for maintaining an active SRP connection between BlackBerry 10 devices and the BlackBerry Infrastructure when the devices are not using BlackBerry Secure Connect Plus. The BlackBerry Affinity Manager provides the Exchange ActiveSync connectivity and logging settings for the BlackBerry Work Connect Notification Service. BlackBerry Secure Connect Plus BlackBerry Secure Gateway Service BlackBerry Gatekeeping Service Management console and BES12 Self-Service BlackBerry Secure Connect Plus provides a secure IP tunnel between work apps on devices and your organization's network. One tunnel that supports standard IPv4 (TCP and UDP) data is established for each device through the BlackBerry Infrastructure. The BlackBerry Secure Gateway Service provides a secure connection through the BlackBerry Infrastructure and BES12 to your organization's mail server for ios devices with MDM controls activations. The BlackBerry Gatekeeping Service sends commands to Exchange ActiveSync to add devices to an allowed list when devices are activated on BES12. Unmanaged devices that try to connect to an organization's mail server can be reviewed, verified, and blocked or allowed by an administrator using the BES12 management console. The management console and BES12 Self-Service are web-based consoles that provide administrator and user access to BES12. Administrators use the management console to manage system settings, users, devices, and apps. Users use BES12 Self-Service to set an activation password and send commands to devices, such as set password, lock device, and delete device data. 16

17 BES12 and Good Dynamics integration Component name Good Control Good Control database Good Proxy Good Enterprise Mobility Server Good Enterprise Mobility Server databases Good Push Notifications Good Connect Good Presence Good Docs Good Control is the Good Dynamics management and configuration component. Good Control includes user, policy, app, and role management, and infrastructure configuration. The Good Control database is the repository used by Good Control to store user, app, and policy information. Good Proxy maintains the secure connection between your organization and the Good NOC. It also supports Good Dynamics Direct Connect, which allows app data to bypass the Good NOC. GEMS integrates the following services: Good Push Notifications, Good Connect, Good Presence, and Good Docs. The GEMS databases store user, app, policy, and configuration information. Good Push Notifications accepts push registration requests from ios and Android devices and then communicates with Microsoft Exchange to monitor the user's work mail account for changes. Good Connect provides secure instant messaging, company directory look-up, and user presence information to ios and Android devices. Good Presence provides real-time presence status to Good Dynamics applications. Good Docs lets your mobile workers access, synchronize, and share their work file server and SharePoint documents. 17

18 Good Secure EMM Suites Good Secure EMM Suites 6 Good Secure EMM Suites include BES12, Good Dynamics, and value-added services under one license to offer a comprehensive EMM solution that provides mobile collaboration and a trusted end-to-end approach to security. Suite Good Secure Management Suite Features Cross-platform support for BlackBerry 10, ios, OS X, Android (including Android for Work and Samsung KNOX), and Windows 10 devices BES12 with support for Work and personal - Corporate activations for BlackBerry 10 devices, MDM controls, and user privacy activations for most device types, and Work space only activations for Android for Work devices. Good Dynamics with support for MDM, MAM, and Good Access Cloud and on-premise deployment options Good Secure Enterprise Suite All Good Secure Management Suite features Good Work Good Secure Collaboration Suite All Good Secure Enterprise Suite features Advanced BES12 security and connectivity features for management of BlackBerry 10, ios, Android for Work, and Samsung KNOX Workspace devices Secure instant messaging using BlackBerry Enterprise IM and Good Connect Secure access to work content using BlackBerry Secure Connect Plus and Good Docs Unlimited deployment of Good secured apps from third-party software vendors Good Secure Mobility Suite All Good Secure Collaboration Suite features Unlimited deployment of customer-developed Good secured apps Custom shared services app integration Complete cloud service federation and single sign-on solution using Enterprise Identity by BlackBerry Two-factor authentication enabled through users' devices with Strong Authentication by BlackBerry Good Secure Content Suite All Good Secure Mobility Suite features Enterprise file synchronization and sharing, access control, and document rights management with WatchDox by BlackBerry 18

19 Good Secure EMM Suites Good Secure EMM Suite components This diagram shows how the products and services included with Good Secure EMM Suites work together. 19

20 Good Secure EMM Suites Component name BES12 Core The BES12 Core is the central component of the BES12 architecture. It consists of several subcomponents that are responsible for: Logging, monitoring, reporting, and management functions Authentication and authorization services Scheduling and sending commands, IT policies, and profiles to devices BES12 database BlackBerry Work Connect Notification Service BlackBerry MDS Connection Service BlackBerry Collaboration Service The BES12 database is a relational database that contains user account information and configuration information that BES12 uses to manage devices. The BlackBerry Work Connect Notification Service is a web service responsible for providing new and changed and organizer notifications to ios devices that are using Secure Work Space. The BlackBerry MDS Connection Service provides a secure connection between BlackBerry 10 devices and your organization's network when devices are not connected to your work Wi- Fi network or using a VPN connection. The BlackBerry Collaboration Service provides an encrypted connection between your organization's instant messaging server and the BlackBerry Enterprise IM app on BlackBerry 10 devices. The BlackBerry Collaboration Service is part of BlackBerry Enterprise IM and is included with the Good Secure Collaboration Suite, Good Secure Mobility Suite, and Good Secure Content Suite. BlackBerry Dispatcher The BlackBerry Dispatcher provides secure connectivity using IPPP for BlackBerry 10 devices. BlackBerry Affinity Manager BlackBerry Secure Connect Plus BlackBerry Secure Gateway Service BlackBerry Gatekeeping Service The BlackBerry Affinity Manager is responsible for maintaining an active SRP connection to the BlackBerry Infrastructure. BlackBerry Secure Connect Plus provides a secure IP tunnel between work apps on devices and your organization's network. One tunnel that supports standard IPv4 (TCP and UDP) data is established for each device through the BlackBerry Infrastructure. The BlackBerry Secure Gateway Service provides a secure connection through the BlackBerry Infrastructure and BES12 to your organization's mail server for ios devices with MDM controls activations. The BlackBerry Gatekeeping Service sends commands to Exchange ActiveSync to add devices to an allowed list when devices are activated on BES12. Unmanaged devices that try 20

21 Good Secure EMM Suites Component name to connect to an organization's mail server can be reviewed, verified, and blocked or allowed through the BES12 management console by an administrator. Strong Authentication module Strong Authentication by BlackBerry allows you to use your users devices instead of a hardware token as the second factor for two-factor authentication users authenticate with your organization's VPN or with Enterprise Identity by BlackBerry. The Strong Authentication module is a component of the BES12 Core that receives authentication requests from the Strong Authentication server or Enterprise Identity and sends requests users' device. Strong Authentication is included with the Good Secure Mobility Suite and Good Secure Content Suite. Enterprise Identity plug-in for BES12 Enterprise Identity by BlackBerry provides a single sign-on solution to users and unified management for administrators across a number of cloud and SaaS services. The Enterprise Identity plug-in for BES12 allows administrators to manage Enterprise Identity from the BES12 console. Enterprise Identity by BlackBerry is included with the Good Secure Mobility Suite and Good Secure Content Suite. WatchDox plug-in for BES12 The WatchDox plug-in for BES12 integrates WatchDox management into the BES12 management console. The WatchDox plug-in for BES12 is part of WatchDox by BlackBerry and is included with the Good Secure Content Suite. Management console and BES12 Self-Service The management console and BES12 Self-Service is a web-based console that provides administrator and user access to BES12. Administrators can use the management console to manage system settings, users, devices, and apps. Users can access BES12 Self-Service to set an activation password and send commands, such as set password, lock device, and delete device data, to devices. Good Control Good Control database Good Proxy Good Control is the Good Dynamics management and configuration component. Good Control includes user, policy, app, and role management, and infrastructure configuration. The Good Control database is the repository used by Good Control to store user, app, and policy information. Good Proxy maintains the secure connection between your organization and the Good NOC. It also supports Good Dynamics Direct Connect, which allows app data to bypass the Good NOC. 21

22 Good Secure EMM Suites Component name Good Enterprise Mobility Server Good Enterprise Mobility Server databases Good Push Notifications Good Connect Good Presence Good Docs Strong Authentication server GEMS integrates the following services: Good Push Notifications, Good Connect, Good Presence, and Good Docs. The GEMS databases store user, app, policy, and configuration information. Good Push Notifications accepts push registration requests from ios and Android devices and then communicates with Microsoft Exchange to monitor the user's work mail account for changes. Good Connect provides secure instant messaging, company directory look-up, and user presence information to ios and Android devices. Good Presence provides real-time presence status to third-party Good Dynamics applications. Good Docs lets your mobile workers access, sync, and share their work file server and SharePoint documents. Strong Authentication by BlackBerry allows you to use your users devices instead of a hardware token as the second factor for two-factor authentication. The Strong Authentication server communicates with your work VPN and the Strong Authentication service in BES12 to send the request for the second factor to a user's devices. The Strong Authentication server is part of Strong Authentication by BlackBerry and is included with the Good Secure Mobility Suite and Good Secure Content Suite. WatchDox servers WatchDox by BlackBerry is a secure file-sharing service that allows users to securely access, synchronize, edit, and share files and folders from Windows or Mac OS tablets and computers and on ios, Android, and BlackBerry 10 devices. The WatchDox servers are part of WatchDox by BlackBerry, which is included with the Good Secure Content Suite. 22

23 Enterprise products that enhance BES12 Enterprise products that enhance BES12 7 BlackBerry offers several tools and value-added services that your organization can use to add features and functionality to BES12. These products require you to have a BES12 installation. They work with BES12 to provide additional capabilities to your organization, such as identity management and MDM and device capabilities. Component BES12 Strong Authentication by BlackBerry Enterprise Identity by BlackBerry BlackBerry Enterprise IM BES12 is an EMM service that allows you to manage devices used in your organization's environment. Strong Authentication by BlackBerry allows you to use your users devices to provide two-factor authentication to your organization s resources. Target systems can include VPNs, network gateways, and, when deployed with Enterprise Identity by BlackBerry, cloud services. Enterprise Identity by BlackBerry provides single sign-on to cloud services, such as WatchDox, Box, WebEx, and Salesforce, for your users. BlackBerry Enterprise IM connects your organization's instant messaging server and the BlackBerry Enterprise IM app on BlackBerry 10 devices through BES12. Users can start and manage secure instant messaging conversations from their devices. 23

24 Enterprise products that enhance BES12 Component BlackBerry Compression for Enterprise WorkLife by BlackBerry BlackBerry Web Services BlackBerry Resource Kit for BES12 BlackBerry Work Drives BlackBerry Compression for Enterprise is a data compression tool for all inbound to help manage and reduce data costs. WorkLife by BlackBerry is a virtual SIM platform that allows organizations to separate work numbers and personal numbers on BlackBerry 10, ios, and Android devices. The BlackBerry Web Services are a collection of SOAP web services that you can use to create applications to manage your organization's BES12 domain, user accounts, and all supported devices. The BlackBerry Resource Kit for BES12 is a collection of tools that you can use to manage, monitor, and troubleshoot devices that are associated with BES12. BlackBerry Work Drives is an app for BlackBerry 10 devices that allows users to access the files and folders on your organization's network from the work space on their devices. Strong Authentication by BlackBerry Strong Authentication by BlackBerry allows you to use your users BlackBerry 10, BlackBerry OS (version 6.0 to 7.1), ios, or Android devices as the second factor of authentication when users connect to your organization s resources. Strong Authentication prompts users for confirmation on their device when they attempt to access one of your resources. Depending on how you configure Strong Authentication, users may also be asked to provide an additional password on the device. You manage Strong Authentication from the BES12 management console. Strong Authentication can be used with or without installing a Strong Authentication server in your network. If you install a Strong Authentication server, you can leverage services such as a VPN gateway or REST endpoint to provide users with access to those resources. Strong Authentication is integrated with Enterprise Identity by BlackBerry. If you do not install the Strong Authentication server, you can use Strong Authentication to provide a second factor of authentication for the resources that you manage access to with Enterprise Identity. Strong Authentication by BlackBerry can be purchased separately or licensed with the Good Secure Mobility Suite or Good Secure Content Suite. For more information about Strong Authentication, see the Strong Authentication by BlackBerry content. Architecture: Strong Authentication 24

25 Enterprise products that enhance BES12 Component User's computer or device VPN gateway Strong Authentication server Enterprise Identity by BlackBerry Strong Authentication module in BES12 User's device with Strong Authentication The user's computer or device is any device that the user wants to connect to a resource that requires two-factor authentication. The VPN gateway is a computer that accepts VPN connections to your organization's network. The Strong Authentication server connects to the Strong Authentication module in BES12 to find the devices associated with a user and to send authentication requests to the Strong Authentication app that's installed on the devices. Enterprise Identity by BlackBerry provides single sign-on to cloud services, such as WatchDox, Box, WebEx, and Salesforce, for your users. Enterprise Identity can connect directly to the Strong Authentication service in BES12. The Strong Authentication module in BES12 provides the connection to the devices that are used as the second factor for authentication. The device can be managed by BES12 or you can activate devices with BES12 only for Strong Authentication. For ios devices, Strong Authentication is included with the Good for BES12 app. For Android devices, Strong Authentication is included with the BES12 Client. For BlackBerry 10 and BlackBerry OS (version 6 to 7.1) devices, users must install the Strong Authentication app. 25

26 Enterprise products that enhance BES12 Enterprise Identity by BlackBerry Enterprise Identity by BlackBerry is an identity-as-a-service (IDaaS) platform that provides single sign-on, mobile zero-sign-on, and multifactor authentication services for cloud-based SaaS applications. The Enterprise Identity plug-in for BES12 allows administrators to manage Enterprise Identity from the BES12 console. Supported services include WatchDox, Box, Workday, WebEx, Salesforce, Google Apps for Work, and many others. Administrators can also add any custom SaaS provider to Enterprise Identity. Administrators use the BES12 management console to add services, manage users, and to add and manage additional administrators. The integration with BES12 makes it easy to manage users and entitle them to access cloud applications and services from their ios, Android, and BlackBerry devices. Using BES12, cloud services and mobile app binaries can be bundled together and then simply assigned to a user, or group of users. Enterprise Identity can be purchased separately or licensed with the Good Secure Mobility Suite or Good Secure Content Suite. For more information about Enterprise Identity, see the Enterprise Identity by BlackBerry content. Architecture: Enterprise Identity by BlackBerry 26

27 Enterprise products that enhance BES12 Component Devices Enterprise Identity by BlackBerry BlackBerry Infrastructure External cloud applications BES12 with Enterprise Identity plug-in Company directory Internal cloud applications User's device with the Strong Authentication app Users, including employees, employee candidates, partners, suppliers, and customers, who you want to have access to one or more cloud-based applications can authenticate from supported applications and from the browser on any device. Enterprise Identity by BlackBerry is hosted in the BlackBerry Infrastructure. It provides single sign-on, mobile zero-sign-on, and multifactor authentication services for cloudbased SaaS applications. The BlackBerry Infrastructure is the BlackBerry network. It authenticates and authorizes users, devices, and enterprise software. Any cloud application, such as WatchDox by BlackBerry, that you want to provide single sign-on access to for your users. The Enterprise Identity plug-in for BES12 allows administrators to manage Enterprise Identity from the BES12 console. It is installed when you install BES12 version Enterprise Identity supports Microsoft Active Directory and LDAP company directories. Internal cloud applications include any cloud-based application that your users access through your organization's network. If you want to use two-factor authentication with Enterprise Identity, Strong Authentication by BlackBerry allows you to use your users devices as the second factor. BlackBerry Enterprise IM BlackBerry Enterprise IM adds the BlackBerry Collaboration Service to BES12 to provide an encrypted connection between your organization's instant messaging server and the Enterprise IM app on BlackBerry 10 devices so that users can participate in instant messaging conversations on their devices. BlackBerry Enterprise IM is included with the Good Secure Collaboration Suite. BlackBerry Enterprise IM can be purchased with BES12 or licensed with the Good Secure Collaboration Suite, Good Secure Mobility Suite, or Good Secure Content Suite. For more information about BlackBerry Enterprise IM for Enterprise, see the BlackBerry Enterprise IM content. Architecture: BlackBerry Enterprise IM 27

28 Enterprise products that enhance BES12 Component name BlackBerry Collaboration Service BlackBerry MDS Connection Service The BlackBerry Collaboration Service provides an encrypted connection between your organization's instant messaging server and the Enterprise IM app on BlackBerry 10 devices so that users can start and manage instant messaging conversations on their devices. The BlackBerry MDS Connection Service provides a secure connection between BlackBerry 10 devices and your organization's network when the device is not connected to your work Wi-Fi network or using a VPN connection. It is also responsible for providing enterprise data push services for BlackBerry 10 devices. BlackBerry Dispatcher The BlackBerry Dispatcher provides secure connectivity using IPPP for BlackBerry 10 devices. BlackBerry Affinity Manager The BlackBerry Affinity Manager assigns BlackBerry 10 devices to the BlackBerry Dispatcher using the information in the BES12 database. BlackBerry Compression for Enterprise BlackBerry Compression for Enterprise is a data compression tool for organizations that are concerned about data costs. Data cost reduction varies depending on regional data costs, organizations' data plans, and administration of networks. BlackBerry Compression for Enterprise provides the following: Compression of all inbound for all compressible text content (for example, body text, HTML, news articles) IT policy rules to control user access to compression features Compression up to 50% better than other industry-standard compression tools Compatibility with S/MIME bodies Basic logging to measure compression savings BlackBerry Compression for Enterprise requires Microsoft Internet Information Services 7.5 or later and is supported for these devices: 28

29 Enterprise products that enhance BES12 BlackBerry 10 OS version and later Android 5.1 (including BlackBerry PRIV) and later For more information about BlackBerry Compression for Enterprise, see the BlackBerry Compression for Enterprise content. WorkLife by BlackBerry WorkLife by BlackBerry is a virtual SIM platform that allows organizations to separate work and personal phone numbers on BlackBerry 10, ios, and Android devices, making it easy to separate and split the cost of voice minutes, SMS, and data between your organization and your employees. Organizations that use a bring-your-own-device (BYOD) deployment model can easily add a separate work phone number to a personal device brought in by an employee. Organizations can pay for the work line while allowing employees to keep their personal line for personal use. For organizations that use a device deployment model where the company owns the phone and allows employees to personally enable it (corporate owned, personally enabled, or COPE), the organization can allow employees to attach a personal number as a second line to a corporate device and have all the costs associated with personal voice, SMS, and data usage charged directly to the employee. To use WorkLife in your organization, you must obtain the WorkLife software from a carrier that supports it. You manage the WorkLife plug-in for BES12 and deploy the app to devices using the BES12 management console. For more information about WorkLife, see the WorkLife by BlackBerry content. BlackBerry Web Services The BlackBerry Web Services are a collection of SOAP web services that you can use to create applications to manage your organization's BES12 domain, user accounts, and all supported devices. You can use the BlackBerry Web Services to automate many tasks that administrators typically perform using the management console. For example, you can create an application that automates the process of creating user accounts, adds users to multiple groups, and manages users' devices. To use the BlackBerry Web Services to develop custom applications you should be proficient with Java or the Microsoft.NET Framework and in the use of XML, SOAP, and WSDL. You should also be familiar with the configuration and administration of BES12, including the management of user accounts, groups, IT policies, software configurations, and security settings. The BlackBerry Web Services are installed when you install BES12. For more information about the BlackBerry Web Services, see the BlackBerry Web Services for BES12 content. 29

30 Enterprise products that enhance BES12 Architecture: BlackBerry Web Services and BES12 Component BlackBerry Web Services Client application A collection of SOAP web services that you can use to perform administrative tasks in your organization's BES12 domain. A custom app that you can develop and integrate with the BlackBerry Web Services to manage user accounts and devices that are associated with BES12. The client applications you create use the administrator account credentials to authenticate with the BlackBerry Web Services. After an application is authenticated, the BlackBerry Web Services are initialized, and the BWS and BWSUtil web services are ready to receive API calls from the application. BlackBerry Resource Kit for BES12 The BlackBerry Resource Kit is a collection of tools that you can use to manage, monitor, and troubleshoot devices that are associated with BES12. The BlackBerry Resource Kit for BES12 includes the following tools: Tool BES12 Log Monitoring Tool A command-line tool that you can use to monitor the information that is written to the log files for BES12 components. You can specify actions that you want the tool to perform when it encounters specific values. For example, you can configure the tool to run a custom batch file when it finds a specific text string in a log message. 30

31 Enterprise products that enhance BES12 Tool BlackBerry Push Initiator Tool BlackBerry Enterprise Transporter for BES12 An application that you can use to push data to apps installed on BlackBerry 10 devices. For example, you can push mapping information about folders in an organization's network that BlackBerry 10 device users can then access using the BlackBerry Work Drives app without the users needing to configure access to the folders. An application that you can use to move user accounts between BlackBerry Enterprise Server domains, and between BES5 version , and BES12 domains. To download the BlackBerry Resource Kit, visit help.blackberry.com/bes_resource_kit. For more information about the BlackBerry Resource Kit, see the BlackBerry Resource Kit for BES12 content. BlackBerry Work Drives BlackBerry Work Drives is an app for BlackBerry 10 devices that allows users to access the files and folders on your organization's network from the work space on their devices. Users can use apps such as Documents To Go and File Manager in conjunction with BlackBerry Work Drives to create, edit, and manage network files. You can use the BlackBerry Push Initiator Tool in the BlackBerry Resource Kit for BES12 to push drive mapping information to the work space on BlackBerry 10 devices. Users can download the BlackBerry Work Drives app from BlackBerry World. For more information about BlackBerry Work Drives, see the BlackBerry Work Drives user content. 31

32 Enterprise products that complement BES12 Enterprise products that complement BES12 8 BlackBerry offers several other enterprise software products that help secure your content and communications. These products can be implemented independently from BES12. Many of these products can also be integrated with BES12, either on their own or as part of one of the Good Secure EMM Suites. Component BES12 BlackBerry Infrastructure BBM Protected WatchDox by BlackBerry Enterprise Identity by BlackBerry SecuSUITE for Enterprise BES12 is an EMM service that allows you to manage devices used in your organization's environment. The BlackBerry Infrastructure is a global private data network distributed across multiple regions. It is designed to efficiently manage the transport of data between BlackBerry services and end-user devices. BBM Protected provides an additional layer of end-to-end encryption for BBM messages sent between BBM Protected users WatchDox by BlackBerry is an enterprise file synchronization and sharing solution that allows users to share, edit, and control their files on every device, including Windows or Mac OS tablets and computers and ios, Android, and BlackBerry 10 devices. If your organization implements BBM Protected, a legacy, stand-alone version of Enterprise Identity is required and is provided with BBM Protected. SecuSUITE for Enterprise is a software-based solution hosted in the BlackBerry Infrastructure that provides secure calling and text messaging on mobile devices, safeguarding your organization s sensitive conversations against electronic eavesdropping. 32

33 Enterprise products that complement BES12 Component AtHoc by BlackBerry AtHoc by BlackBerry is the leader in networked crisis communication, protecting millions of people and thousands of organizations around the world during critical events. The AtHoc Networked Crisis Communication platform empowers organizations to communicate internally and externally with their people and partnered organizations anytime anywhere across multiple devices. BBM Protected BBM Protected adds a layer of end-to-end encryption for BBM messages sent between BBM Protected users in your organization and other BBM Protected users inside or outside of your organization. BBM Protected uses a FIPS validated cryptographic library. Your organization's BBM Protected encryption keys are owned by your organization and no one else not even BlackBerry can access them. To allow users to use BBM Protected, you must use a legacy, stand-alone version of Enterprise Identity by BlackBerry to assign BBM Protected to users. The required version of Enterprise Identity is provided with BBM Protected. For more information about BBM Protected, see the BBM Protected content. WatchDox by BlackBerry WatchDox by BlackBerry is an enterprise file synchronization and sharing solution that allows users to securely access, synchronize, edit, and share files and folders from Windows or Mac OS tablets and computers and ios, Android, and BlackBerry 10 devices. It provides all users with access to a suite of collaboration tools, so they can manage, view, create, edit, and annotate files from any device. The WatchDox administration console allows you to configure, manage, and enforce security policies on files, regardless of where the files reside and track all document activities and report on them for auditing purposes. If your organization has BES12, you can use the WatchDox plug-in for BES12 to integrate WatchDox management into the BES12 management console. If your organization also implements Enterprise Identity by BlackBerry, you can use Enterprise Identity to manage user entitlement to WatchDox. For more information about Enterprise Identity see the Enterprise Identity by BlackBerry content. WatchDox by BlackBerry can be purchased separately or licensed with the Good Secure Content Suite. For more information about WatchDox, see the WatchDox by BlackBerry content. 33

34 Enterprise products that complement BES12 SecuSUITE for Enterprise SecuSUITE for Enterprise is a software-based solution that provides secure calling and text messaging for ios, Android, and BlackBerry 10 devices. With SecuSUITE for Enterprise, technology that was designed to protect national security has been adapted and optimized to secure your organization s communications against electronic eavesdropping and third-party attacks. SecuSUITE for Enterprise is hosted in the BlackBerry Infrastructure, which provides a direct connection to more than 600 carriers, allowing users to connect securely with the people they need to talk to across networks around the globe. SecuSUITE for Enterprise encryption and authentication processes run safely in the background of the device, without impacting performance or usability. The SecuSUITE for Enterprise app is available for ios, Android, and BlackBerry 10 devices. For BlackBerry 10 devices, the device must be activated with BES10 or BES12. Your organization can use the SecuSUITE for Enterprise app for ios and Android devices without BES10 or BES12. For more information about SecuSUITE for Enterprise, see the SecuSUITE for Enterprise content. AtHoc by BlackBerry AtHoc Networked Crisis Communication enables organizations to communicate and collaborate securely within and across organizations for personnel safety and business continuity during times of crisis. The AtHoc platform empowers your organization to alert the people you care about, collect information from the field for situational awareness, account for people before, during and after an event, and connect with external organizations to enable the connected community to manage events. Using AtHoc by BlackBerry, your leaders can protect your personnel and operations through rapid communications, make informed decisions, and best position your organization to begin the recovery process for business continuity and sustained operational resilience. The AtHoc suite includes four integrated applications that run on a secure cloud platform: AtHoc Alert is a comprehensive end-to-end emergency notification system that unifies all communication modalities to alert everyone your organization cares about with a single click. AtHoc Collect gives personnel in the field the ability to report events with rich geo-tagged media reports, plus a oneclick "duress" button to report emergent situations for rapid response. Your operations center can see what is happening at any incident scene, enabling rapid mobilization for a more effective response. AtHoc Account enables an operations center or your organizational leadership to request status from select groups or the entire populace. For example, account for people post emergencies, recall personnel, and conduct daily mustering. Emergency management is provided an accurate summary view or detailed delivery report of each alert recipient. Users can also provide unsolicited reports of their current status and location. AtHoc Connect bridges the communication gap between organizations during emergencies. It allows organizations to share authoritative information with external targeted organizations, agencies, and the public in real-time during 34

35 Enterprise products that complement BES12 crises, empowering the connected community to collectively assess situations and provide a coordinated response to protect lives and property. For more information about AtHoc by BlackBerry, see the AtHoc product information page. 35