Kaspersky Security for Mobile Administrator's Guide

Transcription

1 Kaspersky Security for Mobile Administrator's Guide APPLICATION VERSION: 10.0 SERVICE PACK 1

2 Dear User, Thank you for choosing our product. We hope that you will find this documentation useful and that it will answer any questions that you may have. Note: This document is the property of Kaspersky Lab ZAO (herein also referred to as Kaspersky Lab): all rights to this document are reserved by the copyright laws of the Russian Federation and by international treaties. Illegal reproduction or distribution of this document or parts hereof will result in civil, administrative, or criminal liability under applicable law. Any type of reproduction or distribution of any materials, including translations, may be allowed only with written permission from Kaspersky Lab. This document and related graphic images can be used for informational, non-commercial, or personal use exclusively. This document may be amended without prior notice. You can find the latest version of this document at the Kaspersky Lab website, at Kaspersky Lab assumes no liability for the content, quality, relevance, or accuracy of any third-party materials used herein, or for any potential harm associated with the use of such materials. Document revision date: Kaspersky Lab ZAO. All Rights Reserved

3 CONTENTS ABOUT THIS GUIDE... 7 In this document... 7 Document conventions... 9 SOURCES OF INFORMATION ABOUT THE APPLICATION Sources of information for independent research Discussing Kaspersky Lab applications on the Forum KASPERSKY SECURITY FOR MOBILE About Kaspersky Security for Mobile What's new Distribution kit Hardware and software requirements APPLICATION ARCHITECTURE About the Administration Plug-in of Kaspersky Endpoint Security About Kaspersky Mobile Device Management plug-in About Kaspersky Endpoint Security mobile apps COMMON DEPLOYMENT MODELS FOR THE INTEGRATED SOLUTION Kaspersky Endpoint Security management plug-in deployment model Kaspersky Mobile Device Management plug-in deployment model Models of Kaspersky Endpoint Security mobile app deployment on Android devices Model of deployment via SMS link Model of deployment via workstations Model of deployment via Google Play Models of Kaspersky Safe Browser mobile app deployment on ios devices Model of deployment via the ios MDM server Deployment via Apple Store Model of Kaspersky Safe Browser mobile app deployment on Windows Phone devices PREPARING FOR INTEGRATED SOLUTION DEPLOYMENT Installing the Mobile devices support component Upgrading the version of the Administration Server component Configuring Administration Server settings for connection of mobile devices Displaying the Mobile devices folder in the Administration Console Configuring text message delivery Configuring delivery Creating an administration group Creating a rule for device automatic allocating to administration groups Creating an installation package Configuring installation package settings Creating a standalone installation package of Kaspersky Endpoint Security for Android Creating a general certificate UPDATING THE PREVIOUS VERSION OF KASPERSKY SECURITY FOR MOBILE INSTALLING THE INTEGRATED SOLUTION Installation of Administration Plug-in for Kaspersky Endpoint Security for Mobile Installing the plug-in for managing EAS and ios MDM devices

4 A D M I N I S T R A T O R ' S G U I D E Installation of Kaspersky Endpoint Security for Android mobile app Installation via link Sending notifications to users Installing the mobile app on the device after receiving an notification Installation via text message link Sending text messages to users Installing the mobile app on the device after receiving the text message Installation using the workstation Creating a remote installation task Delivering the application distribution kit to device using the workstation Installing the mobile app on a device Installing the application from Google Play Installation of Kaspersky Safe Browser for ios mobile app Installation via the ios MDM server Getting the developer certificate Creating a provisioning profile Signing the app distribution kit Installing the mobile app a device Installing the application from Apple Store Installation of Kaspersky Safe Browser for Windows Phone mobile app PREPARING KASPERSKY ENDPOINT SECURITY MOBILE APPS FOR OPERATION ON DEVICES Installing a general certificate Configuring the settings of mobile device connection to Administration Server Mobile apps activation Creating a mail certificate Creating a certificate for VPN GROUP POLICIES FOR MANAGING MOBILE DEVICES About a group policy About a group policy for managing KES devices About a group policy for managing EAS and ios MDM devices Creating a group policy Step 1. Choose a group policy name Step 2. Choose an application for creating a group policy Step 3. Select the policy state CONFIGURING A GROUP POLICY FOR MANAGING KES DEVICES Restricting configuration rights Configuring synchronization settings Configuring anti-virus protection components Configure device scan settings Configuring file system protection settings Configuring update settings Configuring unauthorized access protection Configuring Anti-Theft settings Configuring settings for sending commands to a mobile device Configuring the use of the one-time code for unlocking the device Configuring Web Protection settings Configuring device control Configuring the system password

5 C O N T E N T S Configuring Wi-Fi, camera, and Bluetooth usage Configuring TouchDown settings Configuring Advanced Options Configuring Call & Text Filter settings Configuring Kaspersky Endpoint Security removal settings Configuring the connection to wireless networks Configuring App Control Configuring app startup settings Configuring third-party app installation settings Configuring the installed apps report Managing third-party mobile apps About containers Creating containers Signing apps in a container to be used on ios devices Configuring group policy compliance control for mobile devices About Compliance control Creating compliance check rules Configuring application activation Configuring management of Samsung devices Configuring general settings for Samsung KNOX Configuring Firewall for Samsung KNOX Configuring a virtual private network for Samsung KNOX Configuring Microsoft Exchange settings for Samsung KNOX CONFIGURING A GROUP POLICY FOR MANAGING EAS DEVICES Restricting configuration rights Configuring unlock password strength Configuring synchronization settings Configuring device feature restrictions Configuring app restrictions CONFIGURING A GROUP POLICY FOR MANAGING IOS MDM DEVICES Restricting configuration rights Configuring unlock password strength Configuring ios MDM device feature restrictions Setting a global HTTP proxy Configuring Single Sign-On Configuring access to websites Connection to a wireless network Configuring user data protection with EAP protocols Creating a list of trusted certificates Configuring the VPN connection Configuring an L2TP connection Configuring a PPTP connection Configuring an IPSec connection (Cisco) Configuring a connection with Cisco AnyConnect Configuring a Juniper SSL connection Configuring an F5 SSL connection Configuring a connection with SonicWALL Mobile Connect Configuring a connection with Aruba VIA

6 A D M I N I S T R A T O R ' S G U I D E Configuring a Custom SSL connection Connecting to AirPlay devices Connecting to an AirPrint printer Adding an account Adding an Exchange ActiveSync account Adding an LDAP account Adding a calendar account Adding a contacts account Configuring calendar subscription Adding web clips Adding fonts Adding security certificates Configuring the SCEP profile Configuring the access point (APN) REMOVING A GROUP POLICY REMOVING OF KASPERSKY ENDPOINT SECURITY MOBILE APPS FROM DEVICES Removing of Kaspersky Endpoint Security for Android mobile app Permitting users to remove the app Removing the application from a device Removing of Kaspersky Safe Browser for ios mobile app Removing of Kaspersky Safe Browser for Windows Phone mobile app INFORMATION EXCHANGE WITH KASPERSKY SECURITY NETWORK CONTACTING THE TECHNICAL SUPPORT SERVICE About Technical Support Technical support by phone Technical Support via Kaspersky CompanyAccount Electronic Certificate Signing Request ANNEX. RESTRICTIONS FOR IOS MDM DEVICES GLOSSARY KASPERSKY LAB ZAO INFORMATION ABOUT THIRD-PARTY CODE TRADEMARK NOTIFICATIONS INDEX

7 ABOUT THIS GUIDE The Administrator's Guide for Kaspersky Security for Mobile Integrated Solution is intended for professionals who install and administer Kaspersky Security for Mobile or provide technical support for companies that use Kaspersky Security for Mobile. You can use this guide to: Prepare Kaspersky Security for Mobile for installation, install and activate the application. Configure and use Kaspersky Security for Mobile. This Guide also lists sources of information about the application and ways to get technical support. IN THIS SECTION In this document...7 Document conventions...9 IN THIS DOCUMENT This document comprises the following sections. Sources of information on the application (see page 10) This section describes sources of information about the application and lists websites that you can use to discuss the application. Kaspersky Security for Mobile (see page 12) This section describes the purpose, functionality, and composition of Kaspersky Security for Mobile integrated solution. Application architecture (see page 17) This section describes the Kaspersky Endpoint Security components and their interactions. Basic integrated solution deployment models (see page 20) This section covers the common for the integrated solution Kaspersky Security for Mobile: Preparing to deploy the integrated solution (see page 27) This section describes the preparatory steps to be taken before deploying Kaspersky Endpoint Security 10 mobile apps on user devices. Updating the previous version of Kaspersky Security for Mobile (see page 36) This section describes how to update the previous version of Kaspersky Security for Mobile. 7

8 A D M I N I S T R A T O R ' S G U I D E Installing the integrated solution (see page 37) This section describes the process of installing the components of the integrated solution Kaspersky Security for Mobile. Preparing Kaspersky Endpoint Security mobile apps for operation on devices (see page 48) This section describes how to configure Kaspersky Endpoint Security mobile apps on user devices and assign devices to administration groups. Group policies for managing mobile devices (see page 51 ) This section describes policies that the administrator can use for central management of mobile devices of users. Configuring a group policy for managing KES devices (see page 56) This section provides instructions on configuring a group policy for KES devices. Configuring a group policy for managing EAS devices (see page 79) This section provides instructions on configuring a group policy for EAS devices. Configuring a group policy for managing ios MDM devices (see page 83) This section provides instructions on configuring a group policy for ios MDM devices. Removing a group policy (see page 110) This section describes the actions to be performed in order to remove a group policy. Removing of Kaspersky Endpoint Security mobile apps from devices (see page 111) This section describes how to remove Kaspersky Endpoint Security 10 mobile apps from user devices. Information exchange with Kaspersky Security Network (see page 116) This section describes interaction of Kaspersky Endpoint Security with the Kaspersky Security Network cloud service. Contacting the Technical Support service (see page 117) This section provides information about how to obtain technical support and the requirements for receiving help from Technical Support. App (see page 119) This section describes restrictions on ios MDM devices, which the administrator can configure in the group policy. Glossary (see page 121) This section contains a list of terms that are mentioned in the document and their definitions. Kaspersky Lab ZAO (see page 124) This section provides information about Kaspersky Lab ZAO. 8

9 A B O U T T H I S G U I D E Information about third-party code (see page 125) This section provides information about the third-party code used in the application. Trademark notifications (see page 126) This section lists trademarks of third-party manufacturers that were used in the document. Index This section allows you to quickly find required information within the document. DOCUMENT CONVENTIONS This document uses the following conventions (see table below). Table 1. Document conventions SAMPLE TEXT DESCRIPTION OF DOCUMENT CONVENTION Note that... We recommended that you use... Example: Warnings are highlighted in red and enclosed in frames. Warnings show information about actions that may have unwanted consequences. Notes are boxed. Notes provide additional and reference information. Examples are given on a yellow background under the heading "Example".... Update means... The Databases are out of date event occurs. Press ENTER. Press ALT+F4. Click the Enable button. To configure a task schedule: In the command line, type help. The following message appears: Specify the date in DD:MM:YY format. <User name> The following elements are italicized in the text: New terms Names of application statuses and events The names of keyboard keys appear in bold and are capitalized. Names of keys that are connected by a + (plus) sign indicate the use of a key combination. Those keys must be pressed simultaneously. Names of application interface elements, such as entry fields, menu items, and buttons, are in bold. Introductory phrases of instructions are italicized and are accompanied by the arrow sign. The following types of text content are set off with a special font: Text in the command line Text of messages that the application displays on the screen Data to be entered using the keyboard. Variables are in angle brackets. It is required to replace each variable by the corresponding value, omitting angle brackets. 9

10 SOURCES OF INFORMATION ABOUT THE APPLICATION This section lists the sources of information about the application. You can select the most suitable information source, depending on importance and urgency of the issue. IN THIS SECTION Sources of information for independent research Discussing Kaspersky Lab applications on the Forum SOURCES OF INFORMATION FOR INDEPENDENT RESEARCH You can use the following sources to search for information about Kaspersky Endpoint Security on your own: Kaspersky Endpoint Security page on the Kaspersky Lab website Kaspersky Endpoint Security page on the Technical Support website (Knowledge Base) Online help Documentation If you cannot find a solution for your issue on your own, we recommend contacting Kaspersky Lab Technical Support. An Internet connection is required to use online information sources. Kaspersky Endpoint Security page on the Kaspersky Lab website On the Kaspersky Endpoint Security page ( you can find general information about the application, its features and operation parameters. The page Kaspersky Endpoint Security contains a link to the estore. There you can purchase or renew the application. Kaspersky Endpoint Security page in the Knowledge Base Knowledge Base is a section on the Technical Support website. On the Kaspersky Endpoint Security page in the Knowledge Base ( you can find articles that contain useful information, recommendations and answers to frequently asked questions on the application purchasing, installation, and use. Knowledge Base articles can answer questions relating to not only to Kaspersky Endpoint Security but also to other Kaspersky Lab applications. Knowledge Base articles can also include Technical Support news. 10

11 S O U R C E S O F I N F O R M A T I O N A B O U T T H E A P P L I C A T I O N Online help The online help of the application comprises help files. Context help provides information about Kaspersky Endpoint Security windows: a description of Kaspersky Endpoint Security settings is followed by links to descriptions of the tasks that use these settings. Full help provides information on how to configure and use Kaspersky Endpoint Security. Documentation Application documentation consists of the files of application guides. The administrator guide provides instructions on: Preparing Kaspersky Endpoint Security for installation, installing and activating the application Configuring and using Kaspersky Endpoint Security DISCUSSING KASPERSKY LAB APPLICATIONS ON THE FORUM If your question does not require an immediate answer, you can discuss it with the Kaspersky Lab experts and other users in our forum ( In this forum you can view existing topics, leave your comments, and create new discussion topics. 11

12 KASPERSKY SECURITY FOR MOBILE This section describes the features, components, and distribution kit of the Kaspersky Security for Mobile integrated solution, and contains a list of hardware and software requirements for Kaspersky Security for Mobile. IN THIS SECTION About Kaspersky Security for Mobile What's new Distribution kit Hardware and software requirements ABOUT KASPERSKY SECURITY FOR MOBILE Kaspersky Security for Mobile is an integrated solution for protecting and managing corporate mobile devices and also personal mobile devices used by company employees for corporate purposes (hereinafter "the app"). The Kaspersky Security for Mobile comprehensive solution includes the administration plug-in Kaspersky Endpoint Security 10 Service Pack 1 for Mobile (see page 17), the administration plug-in Kaspersky Mobile Device Management 10 Service Pack 1 (see page 17), and the mobile apps package Kaspersky Endpoint Security for various operating systems (see page 18). The Administration Plug-ins are integrated into the Kaspersky Security Center remote administration system. The administrator can use a single Administration Console of Kaspersky Security Center to manage all mobile device on the corporate network as well as client computers and virtual systems. The Kaspersky Endpoint Security 10 for Mobile Service Pack 1 administration plug-in (hereafter called the "Kaspersky Endpoint Security administration plug-in") lets you connect mobile devices to the company's Administration Server and configure their security policies. After you connect mobile devices to the Administration Server, they become managed. The administrator can remotely monitor managed devices. The Kaspersky Mobile Device Management 10 Service Pack 1 administration plug-in (hereinafter the "Kaspersky Mobile Device Administration plug-in") lets you specify configuration settings for ios devices and devices connected to the corporate server via the Exchange ActiveSync protocol, without using iphone Configuration Utility and the Exchange ActiveSync management profile. Kaspersky Endpoint Security mobile apps support ios, Android, and Windows Phone mobile device operating systems. Kaspersky Endpoint Security mobile apps let you keep corporate security of mobile devices and data stored on them up to date. The components of the Kaspersky Security 10 for Mobile solution enable the administrator to: Remotely connect mobile devices of users to the corporate server Remote configuration of anti-virus protection of mobile devices. Remote configuration of mobile devices according to corporate security requirements. Prevention of leaks of corporate data stored on mobile devices when such devices get lost or stolen. Monitor compliance with corporate security requirements Monitoring of Internet usage on mobile devices. Remote installation of third-party mobile apps on user devices with the possibility of using a special mechanism for protecting corporate data (containers). 12

13 K A S P E R S K Y S E C U R I T Y F O R M O B I L E Configure corporate on mobile devices on the network, including at companies with a Microsoft Exchange server Configuring the settings of corporate network usage on mobile devices. Configuring usage of corporate calendars on mobile devices. Configuring synchronization of corporate contacts. Configure functional and hardware restrictions on mobile devices, and usage restrictions on mobile apps and media content. Configure administrator notifications about events on user devices via and text messages WHAT'S NEW Kaspersky Security for Mobile offers the following new features: Support of general certificates on mobile devices for identifying users in Kaspersky Security Center and securing the data exchange with the Administration Server. Support of commands sent from Kaspersky Security Center to protect data against unauthorized access when the device gets lost or stolen. Support of corporate Self Service Portal that the user can use to: Download the distribution package of Kaspersky Endpoint Security for Android Download a provisioning profile for ios devices Manage the device using special commands. Support of a new system of rights for accessing the application features in the Administration Console of Kaspersky Security Center. Managing mobile devices via the Exchange ActiveSync protocol (hereinafter "EAS devices"). The administrator can configure the following settings of EAS devices in policy properties: System password requirements; Settings of device synchronization with the Microsoft Exchange server. EAS device features restrictions. EAS device applications restrictions. For devices with the Android operating system (hereinafter "Android devices"): Restrictions on the operation of system applications. Restriction of access to all websites except for those specified in the policy. Support of the Android operating system, version 5.0. Support of the Google Cloud Messaging service. 13

14 A D M I N I S T R A T O R ' S G U I D E Administration of Samsung devices that support KNOX 1 and KNOX 2. The administrator can configure the following settings of Samsung devices in policy properties: Firewall operation settings VPN settings (only for KNOX 1) Access point (APN) settings Microsoft Exchange mail server settings. For devices with the ios operating system (hereinafter "ios devices"): Switching between corporate and user modes of Kaspersky Safe Browser. Support of the ios operating system, versions 7.0, 7.1, 8.0. Specifying configuration settings of ios devices. Managing mobile devices via the ios MDM protocol (hereinafter "ios MDM devices"). For devices with the Windows Phone operating system (hereinafter "Windows Phone devices"): Switching between corporate and user modes of Kaspersky Safe Browser. Support of the Locate command sent from Kaspersky Security Center. DISTRIBUTION KIT The Kaspersky Security for Mobile distribution kit includes the following components: The sc_package_en self-unpacking archive containing setup files of mobiles apps for all supported systems: adb.exe, AdbWinApi.dll, AdbWinUsbApi.dll a set of files needed to install Kaspersky Endpoint Security 10 for Android; installer.ini is the configuration file that contain the Administration Server connection setting KSM_10_5_11_xxx.apk a setup file for Kaspersky Endpoint Security 10 for Android; kmlisten.exe is the tool for delivering the application installation package using the workstation. kmlisten.ini is the configuration file that contain the settings for the installation package delivery tool kmlisten.kpd is the application description file klcfginst_en.exe is the setup file of the Kaspersky Endpoint Security 10 for Mobile plug-in for administering the application via the Kaspersky Security Center remote administration system. klmdminst.exe is the setup file of the Kaspersky Mobile Device Management plug-in for managing the application via the Kaspersky Security Center remote administration system. KSM_10_5 11_xxx.apk a setup file for Kaspersky Endpoint Security 10 for Android. KSM_10_3_xx_en.zip a setup file for Kaspersky Endpoint Security 10 for ios. sms_utility_ ru.apk the Kaspersky SMS Broadcasting utility. 14

15 K A S P E R S K Y S E C U R I T Y F O R M O B I L E SigningUtility.zip an archive containing a utility for signing the mobile app distribution package and containers for ios devices. Documentation: Administrator's Guide for Kaspersky Security for Mobile Integrated Solution Context Help for the Administration Plug-in of Kaspersky Endpoint Security 10 for Mobile Context help of Kaspersky Mobile Device Management plug-in Context help for Kaspersky Endpoint Security 10 for Android; HARDWARE AND SOFTWARE REQUIREMENTS Kaspersky Endpoint Security has the following hardware and software requirements: To deploy the comprehensive solution Kaspersky Security for Mobile, the administrator's computer must meet the hardware requirements of Kaspersky Security Center. For more details on using the hardware requirements of Kaspersky Security Center, see the Kaspersky Security Center Administrator's Guide. To support deployment of the Kaspersky Mobile Device Management plug-in, the administrator's computer must meet the following software requirements: Kaspersky Security Center 10 Service Pack 1; Exchange ActiveSync mobile device server component; ios Mobile Device Management (MDM) server. To support deployment of the Administration Plug-in of Kaspersky Endpoint Security, the administrator's computer must meet the following software requirements: Kaspersky Security Center To deploy Kaspersky Endpoint Security mobile apps, the administrator's computer must meet the following software requirements: For deployment on Android devices: Kaspersky Security Center 10.0 Kaspersky SMS Broadcasting utility. For deployment on ios devices: Kaspersky Security Center 10.0 ios Mobile Device Management (MDM) server Kaspersky SMS Broadcasting utility. Key Chain Access utility. To deploy Kaspersky Safe Browser for ios mobile app via the ios MDM server, you need a separate Apple ID on the Apple website and have to be a participant of the Apple Developer Program or the Apple Developer Enterprise Program. Participants of the Apple Developer Program can install Kaspersky Safe Browser on no more than 100 devices a year. Participation in the Apple Developer Enterprise Program lets you install Kaspersky Safe Browser on an unlimited number of devices on your corporate network. 15

16 A D M I N I S T R A T O R ' S G U I D E To be able to sign the distribution kit of Kaspersky Safe Browser for ios and third-party mobile apps in a container, the administrator needs a computer that meets the following requirements: Mac OS X or later, Mac OS X 10.7, OS X 10.8 iphone Configuration Utility 3.5 or later for Maс, or iphone Configuration Utility or later for Windows To deploy Kaspersky Endpoint Security mobile apps on devices managed via the Exchange ActiveSync protocol, the administrator's computer must meet the following software requirements: Kaspersky Security Center 10.0 Exchange ActiveSync mobile device server component Kaspersky Endpoint Security mobile apps can be installed on mobile devices of users running the following operating systems: Android 2.3, 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 4.3, 4.4, 5.0. Apple ios 7.0, 7.1, 8. Windows Phone

17 APPLICATION ARCHITECTURE This section describes the Kaspersky Endpoint Security components and their interactions. IN THIS SECTION About the Administration Plug-in of Kaspersky Endpoint Security About Kaspersky Mobile Device Management plug-in About Kaspersky Endpoint Security mobile apps ABOUT THE ADMINISTRATION PLUG-IN OF KASPERSKY ENDPOINT SECURITY The Administration Plug-in of Kaspersky Endpoint Security provides the interface for managing mobile devices and mobile apps installed on them via Kaspersky Security Center. The Administration Plug-in of Kaspersky Endpoint Security can be used to: Create group security policies for mobile devices Remotely configure the settings of Kaspersky Endpoint Security apps on user mobile devices Create installation packages and standalone installation packages of mobile apps in Kaspersky Security Center Receive reports and statistics on the operation of Kaspersky Endpoint Security mobile apps on user devices For more details on using the Administration plugins of Kaspersky Security Center, see the Kaspersky Security Center Administrator's Guide. ABOUT KASPERSKY MOBILE DEVICE MANAGEMENT PLUG-IN The Kaspersky Mobile Device Management plug-in provides the interface for managing mobile devices via the Administration Console of Kaspersky Security Center. The Kaspersky Mobile Device Management plug-in can be used to: Remotely configure configuration settings of devices connected to an Exchange ActiveSync mobile device server via Exchange ActiveSync protocol (hereinafter EAS devices ). Remotely configure configuration settings of devices connected to an ios MDM server via ios MDM protocol (hereinafter ios MDM devices ). Receive reports and statistics on the operation of mobile devices of users. For more details on using the Administration plugins of Kaspersky Security Center, see the Kaspersky Security Center Administrator's Guide. 17

18 A D M I N I S T R A T O R ' S G U I D E ABOUT KASPERSKY ENDPOINT SECURITY MOBILE APPS Kaspersky Security mobile apps can be installed on mobile devices running Android, ios, Windows Phone operating systems. Kaspersky Endpoint Security mobile apps protect mobile devices against viruses and other threats, unwanted calls and texts, and web threats. Kaspersky Endpoint Security mobile apps also make it possible to monitor the user's network activity and protect confidential information against unauthorized access. Different app components provide protection against various threats. This makes it possible to configure app settings flexibly depending on specific user needs. Each mobile app included in the suite of Kaspersky Endpoint Security mobile apps is described below. Kaspersky Endpoint Security for Android mobile app This app is designed to protect Android devices. The app consists of the following components: Anti-Virus. It allows you to detect and neutralize threats on your device by using the Anti-Virus databases and the Kaspersky Security Network cloud service. Anti-Virus includes the following components: Protection detects threats in open files, scans new applications, and prevents device infection in real time. Scan is performed on demand for the entire file system, the random access memory, or a folder. Full Scan scans for the presence of malicious objects in the whole file system; Folder Scan scans a specific folder. Full Scan and Folder Scan detect threats in files that have been installed but not yet opened, as well as threats in files that are currently open. Memory Scan detects threats only in files that are currently open. Update allows you to download new Anti-Virus databases for the application. Anti-Theft. This component protects information on the device against unauthorized access in case the device is lost or stolen. This component lets you lock or locate the device or wipe device data remotely via an SMS command or from Kaspersky Security Center. Call & Text Filter. This component blocks unwanted incoming calls and texts in accordance with the selected mode. Incoming calls and texts are filtered using lists of allowed and blocked contacts. The component can block or allow incoming calls and texts from blocked and allowed contacts. Depending on the mode selected, the component can also allow incoming calls and texts from all numbers on the device contact list or block incoming calls and texts from all numbers that contain letters. Web Protection. This component blocks malicious sites designed to spread malicious code. The component also blocks fake (phishing) website designed to steal confidential data of the user (passwords to online banking or e- money systems) and access the user's financial info. The component scans websites before you open them using the Kaspersky Security Network cloud service. Depending on the scan results, Web Protection loads websites that are recognized as genuine, and blocks websites that are considered to be malicious. The component also supports website filtering by categories defined in Kaspersky Security Network. Thus, the administrator can restrict access from certain web pages, for example, the ones from the Gambling or Social networks categories. Containers. This component controls the activity of apps started on the user device. It lets you place a thirdparty app in a special shell. The shell makes it possible to control the activity of the app contained in it, thereby protecting personal and corporate data on the user device. This component also makes it possible to configure encryption of the data of the containerized app or configure user authorization at app launch. The component also controls transmission of data to other apps and restricts device access to the Internet. You can specify containerized apps as recommended or required for installation on user devices. Device Management. This component lets you configure the obligatory prompt for password needed to unlock the mobile device and also specify the minimum password length. It also lets you prohibit the use of Wi-Fi networks, the camera or Bluetooth functionality on the device and configure the TouchDown profile. The component also lets you use Kaspersky Security Center to configure the settings of device connection to the wireless network. App Control. This allows you to modify the settings of application launch on the user mobile device via Kaspersky Security Center. You can specify the apps that are recommended or required for installation on the user device, and also create lists of allowed and blocked apps. The component blocks attempts to run the forbidden applications ( information on the attempts is available in the Kaspersky Security Center reports). This component also supports the use of containers a special shell for mobile apps, which makes it possible to control the activity of the containerized app. You can specify containerized apps as recommended or required for installation on user devices. 18

19 A P P L I C A T I O N A R C H I T E C T U R E Corporate security policy compliance monitor. This component detects violations of the corporate security policy on user mobile devices and impose restrictions on devices if their settings are found to violate the policy. Quarantine. This component moves files detected during device scanning or during real-time protection to a dedicated isolated storage. Quarantine stores files as archives, so they cannot harm the device. The component lets you delete or restore files that were moved to Quarantine. Reports. This component lets you obtain information about the operation of Anti-Virus, Call&Text Filter, and Web Protection on the user's mobile device. The component groups reports chronologically. Reports can contain up to 200 entries. Once the number of report entries exceeds 200, the component overwrites older entries with new ones. Advanced. Configure advanced Kaspersky Endpoint Security settings: pop-up notifications with app events, sound notifications about app events, and the widget on the home screen of the device. This component lets you decrypt data that remains decrypted after encryption of containerized data was disabled, obtain certificates for accessing resources on the corporate network, and remove Kaspersky Endpoint Security from the mobile device. The component also lets you receive license information about general information about Kaspersky Endpoint Security. Manage Samsung device. It lets you use Kaspersky Security Center to configure the settings of the access point (APN), Firewall, and the settings of mobile device connection to the virtual private network (VPN) and the Exchange mail server. Settings can be configured on Samsung Android devices that support Samsung KNOX. Kaspersky Safe Browser for ios mobile app The app is a safe web browser for ios devices. This app provides safe access to the Internet from ios devices connected to the corporate network. The app includes the following components: Web Protection. This component blocks malicious sites designed to spread malicious code. The component also blocks fake (phishing) website designed to steal confidential data of the user (passwords to online banking or e-money systems) and access the user's financial info. The component scans websites before you open them using the Kaspersky Security Network cloud service. Depending on the scan results, Web Protection loads websites that are recognized as genuine, and blocks websites that are considered to be malicious. The component also supports website filtering by categories defined in Kaspersky Security Network. Thus, the administrator can restrict access from certain web pages, for example, the ones from the Gambling or Social networks categories. Containers. This component controls the activity of apps started on the user device. This component places a third-party app in a special shell that lets you control the activity of the containerized app and thus protect personal and corporate data on the user device. This component also makes it possible to configure encryption of the data of the containerized app or configure user authorization at app launch. The component also controls transmission of data to other apps and restricts device access to the Internet. Kaspersky Safe Browser for Windows Phone mobile app The app is a safe web browser for Windows Phone devices. This app provides safe access to the Internet from Windows Phone devices connected to the corporate network. The app includes the following components: Web Protection. This component blocks malicious sites designed to spread malicious code. The component also blocks fake (phishing) website designed to steal confidential data of the user (passwords to online banking or e-money systems) and access the user's financial info. The component scans websites before you open them using the Kaspersky Security Network cloud service. Depending on the scan results, Web Protection loads websites that are recognized as genuine, and blocks websites that are considered to be malicious. The component also supports website filtering by categories defined in Kaspersky Security Network. Thus, the administrator can restrict access from certain web pages, for example, the ones from the Gambling or Social networks categories. Anti-Theft. This component protects information on the device against unauthorized access in case the device is lost or stolen. The component lets you locate a mobile device using an SMS command or via Kaspersky Security Center. For more details on using Kaspersky Endpoint Security mobile apps with Kaspersky Security Center, see the Kaspersky Security Center Administrator's Guide. 19

20 COMMON DEPLOYMENT MODELS FOR THE INTEGRATED SOLUTION This section covers the common for the integrated solution Kaspersky Security for Mobile: Deployment model for the Administration Plug-in of Kaspersky Endpoint Security (see page 20); Deployment model for the administration plug-in Kaspersky Mobile Device Management (see page 17) Deployment of Kaspersky Endpoint Security for Android mobile app (see page 21); Deployment model for the mobile app Kaspersky Safe Browser for ios (see page 24); Deployment model for the mobile app Kaspersky Safe Browser for Windows Phone (see page 26). KASPERSKY ENDPOINT SECURITY MANAGEMENT PLUG-IN DEPLOYMENT MODEL This management plug-in deployment model consists of the following steps: 1. Preparing to install the Administration Plug-in of Kaspersky Endpoint Security for Mobile. a. Upgrading the version of the Administration Server component (see section "Upgrading the version of the Administration Server component" on page 28). b. Configuring the interface of the Administration Console of Kaspersky Security Center. c. Creating administration groups for mobile devices as part of managed computers in the system of Kaspersky Security Center. Devices with Kaspersky Endpoint Security app installed are moved to these groups either manually or according to automatic transfer rules. 2. Installation of the Kaspersky Endpoint Security for Mobile plug-in (see section "Installation of the Management Plug-in for Kaspersky Endpoint Security for Mobile" on page 37). KASPERSKY MOBILE DEVICE MANAGEMENT PLUG-IN DEPLOYMENT MODEL This deployment model consists of the following steps: 1. Preparing to install the Kaspersky Mobile Device Management plug-in. a. Upgrading the version of the Administration Server component (see section "Upgrading the version of the Administration Server component" on page 28). b. Configuring the interface of the Administration Console of Kaspersky Security Center. c. Creating administration groups for mobile devices as part of managed computers in the system of Kaspersky Security Center. Devices with Kaspersky Endpoint Security app installed are moved to these groups either manually or according to automatic transfer rules. 2. Installing the Kaspersky Mobile Device Management plug-in (see section "Installing the plug-in for managing EAS and ios MDM devices" on page 37). 20

21 C O M M O N D E P L O Y M E N T M O D E L S F O R T H E I N T E G R A T E D S O L U T I O N MODELS OF KASPERSKY ENDPOINT SECURITY MOBILE APP DEPLOYMENT ON ANDROID DEVICES The Kaspersky Endpoint Security mobile app can be installed on Android devices in one of the following ways: By sending users messages with a link to the mobile app distribution kit; By sending users text messages with a link to the mobile app distribution kit; Through workstations to which users connect mobile devices; Through Google Play, in which case the user downloads the installation package as a regular Android application. IN THIS SECTION Model of deployment via SMS link Model of deployment via workstations Model of deployment via Google Play MODEL OF DEPLOYMENT VIA SMS LINK When Kaspersky Endpoint Security for Android is deployed via SMS link, users are provided with a specially configured distribution kit containing the settings of the connection to Administration Server. When they install the mobile app, users are not required to specify the connection settings manually. Text (SMS) messages with a link to the standalone installation package can be sent only to end-user devices with a GSM module. This deployment model consists of the following steps: 1. Preparing for installation of the mobile app: a. Installing the Mobile devices support component in Kaspersky Security Center. The certificate of Administration Server for mobile devices is created at this step. b. Upgrading the version of the Administration Server component. c. Configuring the interface of the Administration Console of Kaspersky Security Center. d. Configuring the mobile device connection settings. At this step, the mobile device connection settings are configured in the properties of Administration Server to ensure synchronization of mobile devices with Administration Server. e. Creating administration groups for mobile devices as part of managed computers in the system of Kaspersky Security Center. Devices with Kaspersky Endpoint Security app installed are moved to these groups either manually or according to automatic transfer rules. f. Creating a rule for allocating mobile devices to a group automatically. g. Installing the Administration Plug-in of Kaspersky Endpoint Security on the administrator's workstation. h. Configuring the method of delivery of text messages to users. i. Creating the installation package for the Kaspersky Endpoint Security 10 for Mobile remote installation task. 21

22 A D M I N I S T R A T O R ' S G U I D E j. Configuring the settings of the installation package for the Kaspersky Endpoint Security 10 for Mobile remote installation task. k. Creating a standalone installation package of Kaspersky Security 10 for Mobile. The standalone installation package includes the settings of the connection to Administration Server. The standalone package is available in the shared folder on the web server of Kaspersky Security Center. When creating a text message, you have to select a path to the Kaspersky Security Center web server. l. Creating a general certificate for a user account (see page 35). At this step, a certificate is issued for a user account for the purpose of identifying the mobile device user. 2. Installing the mobile app on devices. a. Creating and sending a text message with the link to the standalone installation package to mobile device users. b. Downloading the standalone installation package to the mobile device. At this step, the user downloads the prepared distribution package of the app from the Kaspersky Security Center web server. c. Installing the app on the mobile device. d. Downloading a general certificate to the user's mobile device. At this step, the user downloads the certificate issued for the user to the mobile device. 3. Preparing the app to be used on the device: a. Creating a group policy for managing Kaspersky Endpoint Security settings. b. Activating the application on mobile devices of users. MODEL OF DEPLOYMENT VIA WORKSTATIONS Deployment of the Kaspersky Endpoint Security mobile app for Android via workstations is used when users connect their mobile devices to their workstations. This deployment model consists of the following steps: 1. Preparing for installation of the mobile app: a. Installing the Mobile devices support component in Kaspersky Security Center. The certificate of Administration Server for mobile devices is created at this step. b. Upgrading the version of the Administration Server component. c. Configuring the interface of the Administration Console of Kaspersky Security Center. d. Configuring the mobile device connection settings. At this step, the mobile device connection settings are configured in the properties of Administration Server to ensure synchronization of mobile devices with Administration Server. e. Creating administration groups for mobile devices as part of managed computers in the system of Kaspersky Security Center. Devices with Kaspersky Endpoint Security app installed are moved to these groups either manually or according to automatic transfer rules. f. Creating a rule for allocating mobile devices to a group automatically. g. Installing the Administration Plug-in of Kaspersky Endpoint Security on the administrator's workstation. h. Creating the installation package for the Kaspersky Endpoint Security 10 for Mobile remote installation task. i. Configuring the settings of the installation package for the Kaspersky Endpoint Security 10 for Mobile remote installation task. 22

23 C O M M O N D E P L O Y M E N T M O D E L S F O R T H E I N T E G R A T E D S O L U T I O N 2. Installing the mobile app on devices. a. Creating a remote installation task for delivering the Kaspersky Endpoint Security for Android distribution package to users' workstations and installing the utility for uploading the distribution package to mobile devices. b. Uploading the app distribution package to the mobile device. At this step, the user copies the app distribution package to the mobile device by using the utility kmlisten.exe. c. Installing the app on the mobile device. At this step, the user installs the app on the mobile device. 3. Preparing the app to be used on the device: a. Creating a group policy for managing Kaspersky Endpoint Security settings. b. Activating the application on mobile devices of users. MODEL OF DEPLOYMENT VIA GOOGLE PLAY The app can be deployed via Google Play when it is more convenient for users to download the distribution kit of the mobile app from Google Play and install the app. App deployment via Google Play does not require creating an app distribution kit with settings of the connection to Administration Server. The user manually specifies the settings of the connection to Administration Server at the first launch of the mobile app on the device. This deployment model consists of the following steps: 1. Preparing for installation of the mobile app: a. Installing the Mobile devices support component in Kaspersky Security Center. The certificate of Administration Server for mobile devices is created at this step. b. Upgrading the version of the Administration Server component. c. Configuring the interface of the Administration Console of Kaspersky Security Center. d. Configuring the mobile device connection settings. At this step, the mobile device connection settings are configured in the properties of Administration Server to ensure synchronization of mobile devices with Administration Server. e. Creating administration groups for mobile devices as part of managed computers in the system of Kaspersky Security Center. Devices with Kaspersky Endpoint Security app installed are moved to these groups either manually or according to automatic transfer rules. f. Creating a rule for allocating mobile devices to a group automatically. g. Installing the Administration Plug-in of Kaspersky Endpoint Security on the administrator's workstation. h. Creating a general certificate for a user account (see page 35). At this step, a certificate is issued for a user account for the purpose of identifying the mobile device user. 2. Installing the mobile app on devices. At this step, the user installs the application and downloads the certificate to the mobile device. 3. Preparing the app to be used on the device: a. Creating a group policy for managing Kaspersky Endpoint Security settings. b. Activating the application on mobile devices of users. c. Performing initial configuration of the app. At this step, the user specifies the settings of the mobile device connection to Administration Server. 23