Managing Access and Help Protect Corporate Data on Mobile Devices with Enterprise Mobile Suite

Transcription

1 Managing Access and Help Prtect Crprate Data n Mbile Devices with Enterprise Mbile Suite Last updated: 7/15/15 Balancing prductivity and security Emplyees want t be able t use their wn devices t access cmpany resurces and prductivity tls. IT needs t make sure that emplyees have this ability but sensitive cmpany data is prtected. BYOD (Bring yur wn device) pses a specific challenge in that there needs t be a separatin f persnal and wrk data n persnal devices and prevent intentinal r unintentinal sharing f cmpany data. Studies shw that: 37% f the wrld s wrkfrce is mbile* 53% f ttal pens ccurred n a mbile phne r tablet in Q3 2014** 61% f wrkers mix persnal and wrk tasks in their devices*** Cnsider this: is ften the mst used applicatin n any device. Cntent in and attachments can be cpied, shared, r mved t ther lcatins utside f yur IT department purview, which can lead t cmprmising yur cmpany's security. Since end-users want t d cmpany wrk using their wn persnal devices and is the mst ften accessed applicatin, the first step fr yur IT is t make sure that end-users can access crprate n their devices while making sure that sensitive data in is nt cmprmised. What this article cvers This article starts with an verview f hw yu can prvide data prtectin fr yur cmpany while ensuring that the end-user experience is simple and des nt impact prductivity. Then, we will fcus specifically n hw yu can help prvide secure access t yur crprate and help prtect cmpany data in and attachments using the Micrsft Enterprise Mbility Suite slutin.

2 Overview Micrsft ffers the Enterprise Mbility Suite (EMS), a cmprehensive slutin fr identity, mbile device management, app management, and data prtectin. EMS prvides a layered security mdel which allws yur IT department t manage access t , data, and crprate applicatins frm almst any device. EMS is cmpsed f the fllwing clud services: Using EMS, data is prtected bth inside and utside f yur crprate netwrk: Emplyees have access t crprate , wrk-related applicatins, and cmpany data n the device f their chice withut wrrying abut cmprmising sensitive cmpany infrmatin. Cmpany data is prtected at every level: user, device, applicatin and finally, at the level f the data itself. Yur IT admin can make sure that crprate data is accessed nly by trusted users n managed and cmpliant devices, and in the cntext f managed applicatins. Intune-managed apps include Office mbile apps, which are central t this slutin. With Office mbile apps, yu can help maximize emplyee prductivity while preventing data leakage. Fr example, yur IT admin can set plicies that prevent cpying cmpany data t persnal clud strage like Drpbx. When emplyees mve r change jbs, r lse their device, EMS prvides the ptin t remtely and selectively wipe crprate data frm the device. This can be dne by the end-user r by yur IT admin.

3 Hw EMS can help prtect yur data The 4 layered security mdel fr identity, devices, apps, and data is abut making sure that yur cmpany resurces are nly accessed by the intended user, n a device that meets a set f cmpliance plicies cnfigured by yu, and within the bundaries f managed apps. Prtecting yur data starts with establishing and validating the user identity. Azure AD, an enterprisegrade identity and access management tl delivers single sign-n, multi-factr authenticatin, selfservice passwrds, and mre. It prvides the functinality fr the identity layer f the security mdel. Building n the identity baseline, yur IT admin can use Micrsft Intune t make sure that mbile devices are enrlled, managed and cmpliant with yur crprate plicies. This is the device layer. The third layer is the app management layer with the Intune-managed app ecsystem. This ecsystem, while enabling users t be prductive and use the tls that they need and knw like Office, als enables yur IT t keep sensitive data within the managed app ecsystem. Azure Rights Management (Azure RMS) cmpletes the security mdel by prtecting data at the file level. The security plicies that are applied t the data, travel with the data, help keep the data secure in transit and at rest, regardless f the device that is used t access it. This is the data layer f the security mdel. Managing access t crprate and help prtect cntent: Prtecting crprate invlves tw main bjectives: Allw nly cmpliant devices t access yur cmpany s

4 Prtecting the cntent in and attachments Allw nly cmpliant devices t access yur cmpany s An imprtant step t prtecting crprate data is restricting access t devices that dn t use a strng passwrd, are nt jailbrken, r nt encrypted. Micrsft Intune gives yu the ability t set cnditins that yur users have t meet t gain access t yur cmpany resurces. This is knwn as cnditinal access. Cnditinal access is determined by tw types f plicies yu can set in Intune: Cmpliance plicies determine the cmpliance f a device. They evaluate settings and cnditins like: PIN and passwrds: Yur IT can create rules t require passwrds befre unlcking a device, the cmplexity f the passwrd, passwrd expiratin, and ther passwrd settings. Encryptin: Yur IT can restrict access t devices that are encrypted. Device is nt jailbrken r rted: Intune can detect if an enrlled device is jailbrken, and yur IT can set the plicy t blck access n such devices. Cnditinal access plicies are cnfigured fr a particular service like Exchange Online r SharePint Online. Fr each service, yu can define which grups f users these plicies shuld apply t. Fr example, yu can make sure that everyne in the finance department can nly access cmpany frm enrlled and cmpliant devices. Watch this fur minute vide t see hw cnditinal access affects yur end users. Why Architecture Matters The different cmpnents f EMS and Office 365 are built fr and designed t run in the clud. This brings all the benefits that the clud ffers: scalability, flexibility, and ease f management. Since different businesses have different requirements, EMS is designed t integrate with existing npremises infrastructure such as Active Directry, Exchange Server, r System Center Cnfiguratin Manager. This allws yu t use the credentials already established in yur netwrk fr bth npremises and clud resurces. The fllwing sectins describe the architecture as designed t run in the clud, and tuch briefly n the n-premises ptin. Access Flw Depending n the type f applicatin that yu use t access Exchange nline, the path t establishing secured access t can be slightly different. Hwever, the key cmpnents: Azure Active Directry (Azure AD), Office 365/Exchange Online, and Micrsft Intune, are the same. The IT experience, and end-user experience als are similar. EMS currently supprts native apps and the Micrsft Outlk app fr ios and Andrid.

5 Access cntrl flw fr native applicatins Exchange ActiveSync (EAS) clients attempting t access in Exchange Online will be evaluated fr the fllwing prperties: Is the device managed by Intune? Is the device registered with Azure Active Directry? Is the device cmpliant? Is the client EAS ID mapped t a registered device? T get t a cmpliant state, the device n which the EAS client is running needs t: Enrll with Intune Register with Azure Active Directry, and Be cmpliant with the device plicies set by yur IT admin. On mst platfrms, the Azure Active Directry device registratin happens autmatically during enrllment. The device states are written by Intune int Azure Active Directry, and then read by Exchange Online the next time the EAS client tries t get . If the device is nt registered, the user will get a message in their inbx with instructins n hw t register (als knwn as enrlling). If the device is nt cmpliant, the user will get a different that redirects them t the Intune web prtal where they can get mre infrmatin n the cmpliance prblem and hw t remediate it. Azure AD, authenticates the user and the device, Micrsft Intune manages the cmpliance and cnditinal access plicies, and Exchange Online manages access t based n the device state.

6 Access cntrl flw fr Outlk applicatins Similar t the EAS client, the Outlk app attempting t access mail in Exchange Online will be evaluated fr the fllwing prperties: Is the device managed by Intune? Is the device registered with Azure Active Directry?

7 Is the device cmpliant? The device cmpliance is established in much in the same way as described in the EAS client access cntrl flw. Hwever, fr Outlk apps, the flw between the cmpnents is slightly different. When the Outlk app attempts t get , it is redirected t Azure AD. Azure AD issues a security tken if the device is successfully evaluated t be enrlled and cmpliant. The security tken is then used t get crprate frm Exchange Online. The sync is actually brkered thrugh the Outlk clud service, which gets an EAS service access tken n behalf f the user t cmplete the authenticatin and delivers the . The IT admin experience: There is n cmplex infrastructure setup required fr Azure AD r Exchange t make this happen. Yur IT admins: Cnfigure and deply the cmpliance plices that are used t evaluate the cmpliance status f the device. Cnfigure the Exchange Online cnditinal access plicy, and specify which Azure AD security grups will be affected by, r exempted frm these plicies.

8 Chse t allw r blck devices that are nt capable f enrlling in Intune. The list f supprted perating systems fr mbile devices is listed later in the What yu shuld cnsider when planning yur implementatin sectin. There is an ptinal setup stage that may be needed. The reprting that is used t manage and mnitr device access and status requires the Micrsft Intune service t service cnnectr t be set up. The End-user experience: When the user attempts t access n the device fr the first time, r sync subsequently, the device enrllment and cmpliance status is checked. The prcess f enrlling r fixing cmpliance issues is a guided experience. The end-user is shwn the necessary steps t enrll their device and make it cmpliant withut needing t call yur IT help desk: If the device is nt enrlled, the sign-in page will shw access denied and will prmpt fr enrllment. On enrllment, the device is autmatically registered in Azure Active Directry. Intune checks the device fr cmpliance and prvides remediatin steps t reslve any nncmpliance issues. Once the device is cmpliant, Intune sets the device cmpliance status with Azure Active Directry. If the device is enrlled but is nt in cmpliance, a link with steps t remediate the issues is sent t the device. When the end-user crrects the issue (fr example, set passwrd, encryptin), Intune which manages the cmpliance plicies updates the cmpliance status f the device in Azure AD. Once the device is evaluated as enrlled and cmpliant, the sync shuld happen within a few minutes. Prtect and attachments frm data leakage The previus sectin talked abut hw yu can make sure that nly cmpliant devices can access crprate . Hwever, the cntent in the and attachments is nt prtected just by securing access. The cntent can be cpied, mved, saved t a different lcatin, r shared with anther user. EMS slves this prblem using mbile applicatin management plicies. Managed apps are apps that are deplyed by yur IT admin that cmply with yur cmpanies security requirements. With these apps, IT has direct cntrl ver deplyment, nging management like inventry r updates, and selective wipe f the apps and their assciated data. Additinally, thrugh a set f mbile applicatin management (MAM) plicies, Intune lets yu mdify the functinality f apps, and restricting sharing f data like: Blck cpy and paste, r prevent data transfer frm a managed app t an app withut MAM plicy. Prevent backup t persnal clud strage, preventing Save as, etc. Secure app access by requiring PIN/passcde r crprate credentials n a MAM-prtected app. Cnfigure the applicatin t pen all web links inside the Intune Managed Brwser.

9 Selectively wipe nly data that is assciated with the managed app. When a device is lst, stlen, r is n lnger managed by yur IT, a selective wipe can remve all crprate data frm the apps, leaving nly persnal app data behind. This is knwn as multi-identity. With Azure Rights Management Services, yu can extend prtectin in the fllwing ways: messages can be encrypted s nly the right users can read r view the cntent whether within yur cmpany r utside the cmpany. Users can prtect messages and the recipient can read and use prtected messages sent t them. An administratr can set rules t: Autmatically apply the rules t a specified grup f recipients r create templates fr specific departments. Autmatically detect and apply rules t messages with sensitive cntent. The rule can be based n sender, recipient, message subject, r cntent. Detect sensitive cntent and alert the sender t apply the prtectin rules befre sending the . Managed App Cmpnents Micrsft Intune is where yu cnfigure the plicies, assciate the plicies with the app, r use the app wrapping tl t enable an in-huse app t use mbile applicatin management plicies. The Cmpany prtal is an app that either runs natively n each device r is brwser based. Yur IT deplys the managed apps t users r devices, and end-users can install the app frm the prtal. The plicies assciated with the apps are carried ver t the device with the apps.

10 The IT admin experience: Yur IT admin creates the mbile applicatin management plicies, assciates the plicy t the app, and deplys it t users r devices. When the managed app is installed n the device, the app restrictins take effect. Creating and deplying managed apps invlve little r n additinal effrt: There are existing apps that already have the App SDK which allws yu t apply restrictins t the app. These require n ther prcessing, but just adding a link pinting t an app stre such as itunes r Ggle Play. Read this article t see the list f managed apps. If yu want t manage apps that are created in-huse, yu can repackage the apps with Micrsft Intune App Wrapping tl. The tl repackages the app which allws yu t apply restrictins t the app. The End-user experience: End-users can install managed apps and use them t d their wrk. They will nly be able t mve r share data between managed apps. Any attempt t mve data ut f the managed app ecsystem will be blcked. Operatins and Incidence Respnse Once yu have implemented the slutin, yu need t manage the envirnment and identify ptential security risks. Bth Intune and Azure AD have mnitring and reprting capabilities that can help in mnitring and respnding quickly in case f a security incident.

11 Here are sme f the reprting capabilities: Intune reprts and alerts help yu mnitr the status and health f devices managed by Intune. Azure AD has auditing and activity lgging. Yu can mnitr things like passwrd changes and user management. Azure Active Directry premium includes advanced anmaly security reprts and alerts. These alerts are based n detailed machine learning based reprts shwing sign in activity, incnsistent access patterns, and ptential threat areas. On-premises implementatin If yu have an existing implementatin f System Center Cnfiguratin Manager, Active Directry and/r Exchange Server yu can extend the existing infrastructure by integrating with Intune, Azure AD and Office 365. Using this hybrid implementatin, yu can prvide a cnsistent management experience acrss devices n-premises and in the clud. Intune and Cnfiguratin Manager ffer a similar set f capabilities t allw restricted access based n the device state. Fr Exchange Online Dedicated implementatins, whether yu can take advantage f the clud based slutin described previusly, r the hybrid implementatin depends n what yur current implementatin lks like. Talk t yur accunt team t determine what yur implementatin will invlve. What yu shuld cnsider when planning yur implementatin Device platfrm supprt: Yu must als cnsider if yu want t allw access n platfrms that are nt supprted by Intune. Intune mbile device management supprts the fllwing perating systems: Apple ios 7.1 and later (previusly enrlled ios 6.0 and 7.0 devices remain enrlled but new devices cannt enrll) Ggle Andrid and later (includes Samsung KNOX) Windws Phne 8.0 and later Windws RT and later Windws 8.1 cmputers and later Type f apps: The EMS slutin currently supprts clients that use EAS prtcl, and Outlk apps (previusly Accmpli n ios and Andrid). Plicies: The EMS slutin and its cmpnents have several plicies thrugh which security and access is managed. Determine what plicies yur IT admin needs t cnfigure. The three key plicies t be used fr research and plan when securing access t and data are: Device Cmpliance Plicies: Determine what cmpliance means fr yur cmpany. Intune includes several rules that yu can set, but all f thse rules may r may nt apply t yur cmpany. Yu can change plicies anytime, but it is gd practice t

12 determine a basic set f plicies fr yu cmpany. Cmpliance plicies are targeted at Intune user grups and device grups. Cnditinal Access Plicies: Cnditinal access plicies are targeted at Azure AD Security Grups. Determine which users will be targeted by the plicies and if there are users wh need t be exempt. Cnditinal Access is supprted by bth the clud based slutin and the hybrid implementatin. Mbile Applicatin Management: Determine what apps shuld be managed and the MAM plicies yu need t apply t these apps. Device management cnsideratins: Select the device management ptin that best meets the requirements fr yur rganizatin befre yu implement the slutin. There are tw ptins: Unify System Center Cnfiguratin Manager with Micrsft Intune t manage all devices thrugh a single cnsle. This is called the Hybrid implementatin. Advantages f this apprach: Single management cnsle with rich rights-management cntrls t manage bth n-premises PCs as well as mbile devices Rich targeting and deplyment capabilities High scale fr very large enterprises Manage the mbile devices thrugh Micrsft Intune separately frm the npremises devices using System Center Cnfiguratin Manager. This is called Intune Stand-alne implementatin. Advantages f this apprach Simple web-based cnsle tailred specifically fr mbile device management Rapid access t the latest features While migratin is always pssible, we strngly recmmend that yu make this decisin befre implementing it, since it will influence a lt f the decisins yu will make in the rll ut prcess. Yur Exchange envirnment: Deplyment f Exchange cnnectrs and hw they cnnect when netwrk lad balancers are implemented. Exchange Online is it multi-tenant r dedicated? If it is dedicated, find ut which architecture yur tenant is n. This will determine whether Azure AD-based cnditinal access can be used, r if an n-premises cnnectr is required. Azure AD synchrnizatin and Active Directry Federated Services (ADFS), r anther third-party federated service: Cnditinal Access is designed t wrk fr custmers wh have federated their identity service t ADFS. Client access rules will generally still apply, hwever it is recmmended that full testing be cnducted. Requirements fr directry synchrnizatin and ADFS are n different than fr Office 365.

13 Third-party federatin services like Ping shuld als wrk. Testing befre implementatin is recmmended. Where t g frm here Try/Evaluate: Watch this vide t learn hw t sign up fr a trial accunt and get started. Additinal Resurces EMS Architecture: Intune capabilities: Read the Intune evaluatin guide t learn abut Intune features, chsing an implementatin that wrks fr yur cmpany, and hw t get started n Intune. Azure Active Directry: What is Azure Active Directry Hw des Azure Active Directry supprt Office 365, Micrsft Intune, and ther Micrsft services? Hw des Azure Active Directry help yu manage identities Azure Rights Management Service What is Azure Rights Management? Hw Applicatins supprt Azure Rights Management Autmatically prtecting s with Exchange Online and data lss preventin plicies * IDC: Wrldwide Mbile Wrker Ppulatin Frecast ** Experian Quarterly benchmark reprt (Q3 2014) *** Frrester Research: BT Futures Reprt: Inf wrkers will erase bundary between enterprise & cnsumer technlgies, Feb. 21, 2013