Mobile Device Management horizons for CERN Managed ios and Mac Self-Service. Maciej Muszkowski, Michal Kwiatek, Vincent Bippus (IT-OIS)

Transcription

1 Mobile Device Management horizons for CERN Managed ios and Mac Self-Service Maciej Muszkowski, Michal Kwiatek, Vincent Bippus (IT-OIS)

2 Today s agenda Introduction MDM market CERN numbers and trends CERN use cases How MDM works and what it can do for us Technical details of MDM MDM tests at CERN Proposed solutions for the CERN use cases New IT Services based on MDM 22/05/2015 MDM at ITTF 2

3 What is MDM? Mobile Device Management (MDM) is an industry term for the administration of mobile devices, such as smartphones, tablets, laptops and desktop computers. MDM is usually implemented with the use of a third party product that has management features for particular vendors of mobile devices. 22 May 2015 MDM at ITTF 3

4 MDM Market Apple ProfileManager (ios, Mac) Absolute Manage (ios, Android, Mac) Microsoft InTune + SCCM (ios, Android, Mac) JAMF Casper Suite (ios, Mac, Android) FileWave (ios, Android, Mac) MobileIron (ios, Android, Mac) 22 May 2015 MDM at ITTF 4

5 Mobile vs PC market Smartphone usage surges while PCs show startling decline in new worldwide study PC market to face more pain in 2015 Fourth consecutive decline according to IDC Is the PC market in terminal decline? Latest data from IDC and Gartner suggest the PC market is not doing as badly as previously forecast Tablet growth has slowed to a crawl PC market poised for growth after more than two years of decline 22 May 2015 MDM at ITTF 5

6 Meanwhile, at CERN 22 May 2015 MDM at ITTF 6

7 Personal computers at CERN 22 May 2015 MDM at ITTF 7

8 Resources and supportability Big growth in use of smartphones and tablets Functionality gap in IT services No significant decline in use of laptops/desktops No manpower liberated to fill in the gap 22 May 2015 MDM at ITTF 8

9 BYOD or COPE? User-owned CERN-owned Personal Shared Smart phone PC or Mac PC or Mac from CERN Stores Android phone from the CERN Stores ipad of an RP techician FB ipad professional use private use COPE: Corporate Owned, personally enabled 22 May 2015 MDM at ITTF 9

10 CERN Use Cases 1. Self-service for Mac 2. Delegated-management solution for professional tablets Managed ios 3. CERN app store for personal mobile devices 22 May 2015 MDM at ITTF 10

11 How MDM works and what it can do for us Maciej Muszkowski, IT-OIS 22 May 2015 MDM at ITTF 11

12 Mobile Device Management Remotely managing mobile devices Installing/updating/removing applications Applying configuration Erase Lock Inventory Considered: ios, Android, Mac 22 May 2015 MDM at ITTF 12

13 Implementation ios: built-in MDM protocol, no agent app Mac: built-in MDM protocol, agent running in the background Android: agent app using the OS APIs and GCM 22 May 2015 MDM at ITTF 13

14 Applications distribution (ios) AppStore apps Need Apple ID to be installed Automatic updates from the AppStore After review visible for any ios user Enterprise apps (.ipa) No Apple ID needed to install Specific apps: only for CERN affiliated users Distributed through link, MDM or USB cable Manual updates Not possible to install untrusted apps 22 May 2015 MDM at ITTF 14

15 Applications distribution (Android) Google Play apps (same as ios) Need Google account to be installed Automatic updates Other stores From file (.apk) Needs enabling the option Unknown sources After that, any apps can be installed 22 May 2015 MDM at ITTF 15

16 Applications distribution (Mac) From file Image (.dmg) Installer (.pkg) You can install untrusted apps AppStore apps (same as ios) Needs Apple ID to be installed Automatic updates from the AppStore Can be automatically uninstalled with Launchpad 22 May 2015 MDM at ITTF 16

17 Volume Purchase Program (VPP) Allows CERN to buy ios/mac apps from AppStore Needs MDM (for creating the user-licence assignment) Needs Apple ID You can revoke the assignment to recover the licence One user can use a single licence to install the app on multiple devices More details in Vincent s part 22 May 2015 MDM at ITTF 17

18 Configuration (ios) Using profiles (.mobileconfig files) or MDM WiFi (including EAP) Exchange (mail, calendar, contacts) Certificates: PKCS1 or PKC12 Restrictions, passcode WebClips (links/web apps) SSO (ios 7+) ManagedAppConfig preconfiguring installed app Disabling/enabling data/voice roaming ios has built-in encryption (whole FS) 22 May 2015 MDM at ITTF 18

19 Configuration (Android) Emulation inside agent app using OS APIs Installing certificates (not silent) WiFi cfg (EAP starting from 4.4) Passcode, disable camera Enabling encryption Putting/reading files from the device Custom APIs from different vendors and devices models (Samsung, Lenovo) 22 May 2015 MDM at ITTF 19

20 Configuration (Mac) Using profiles (.mobileconfig files) or MDM WiFi (including EAP) Exchange (mail, calendar, contacts) Certificates: PKCS1 or PKC12 Restrictions, passcode ActiveDirectory bind FileVault2 disk encryption Using scripts anything 22 May 2015 MDM at ITTF 20

21 What MDM cannot do (ios) It cannot read/write files from/to the device Except putting ibooks (pdf, epub) It cannot read your private data like messages/mails It cannot geolocate your phone Install Find My iphone/ipad.app Enable in icloud It cannot update your OS 22 May 2015 MDM at ITTF 21

22 What MDM cannot do (Android) During the evaluation time It cannot install the application silently No VPP, no paid Google Play apps It cannot configure Exchange It cannot update your OS Android for Work (5.0+, Mar 2015) Finally copying the ideas from Apple MDM Silent app install and removal, apps sandboxing 22 May 2015 MDM at ITTF 22

23 CERN test criteria Functional For each OS: ios, Android, Mac OS Which versions supported for each OS family Ownership models: Privately owned CERN owned, but used by a single user CERN owned, but shared Management models User-managed Centrally-managed, but with the user in full control Centrally-manager with some items enforced Delegated administration Integration with volume purchasing programs and software vendors licence models Apple VPP, including licences floating between users Support for concurrent licences Self-service app store Updates For OS For apps Configurations ex. WiFi, EduRoam, CERN certificates, data roaming as preferences or forced Hardware and software inventory Extras file sharing, encryption Technical CERN login integration AD, SSO or OAUTH For end-users and admins Load balancing, high availibility Initial deployment effort Basic configuration Integration (with AD, Network DB, etc.) Ease of use For the End-user For the administrators Update cycle effort Time before next OS versions are supported Upgrade procedures Commercial Licencing model Per device? Per registered user? Per FTE? Cost During staged deployment After the deployment is completed and we get CERN users on board Contract policy The risk of the cost sky-rocketing after we complete the deployment 22/05/2015 MDM at ITTF 23

24 Our tests Deployment in CERN environment Products tested Apple ProfileManager (ios, Mac) Absolute Manage (ios, Android, Mac) Microsoft InTune + SCCM (ios, Android, Mac) JAMF Casper Suite (ios, Mac, Android) FileWave (ios, Android, Mac) MobileIron (ios, Android, Mac) and a few more 22 May 2015 MDM at ITTF 24

25 MDM test results No single product can reliably serve Android, ios and Mac JAMF Casper Suite works well for ios and Mac Mature (13 years experience) Large community of sys admins (20000) Key player for Mac OS and ios Just entered the Android market Flexible, reliable and adapted to CERN scale 22 May 2015 MDM at ITTF 25

26 Our proposal Deploy JAMF Casper Suite for Managed ios and Mac Self-Service Provide curated lists of CERN-recommended Apps&Settings on ios and Android community web sites as CERN app store for personal mobile devices 22 May 2015 MDM at ITTF 26

27 Managed ios Maciej Muszkowski, IT-OIS 22 May 2015 MDM at ITTF 27

28 Managed ios Real life example Fire Brigade 5 ipads, shared, auto-setup, fully managed by their admin: Restrictions Preconfigured mail Enterprise app EAM mobile Set of AppStore apps Set of WebClips (links/web apps) ~200 PDFs with maps ~15 iphones personal, similar setup, but ondemand Delegated administration 22 May 2015 MDM at ITTF 28

29 Managed ios - enrolment Registers user s device in our system Creates user-device association Gives user the access to resources 2 ways to enroll: Using webpage USB cable for supervised devices, gives MDM more privileges Silent app installation Applying more restrictions to the device Installation of some cfgs (e.g. Single app mode) 22 May 2015 MDM at ITTF 29

30 Enrolment - using webpage 22 May 2015 MDM at ITTF 30

31 Enrolment - using webpage 22 May 2015 MDM at ITTF 31

32 Enrolment - using webpage 22 May 2015 MDM at ITTF 32

33 Enrolment - using webpage 22 May 2015 MDM at ITTF 33

34 Enrolment - using webpage 22 May 2015 MDM at ITTF 34

35 Enrolment using USB cable Gives us more priviledges ( supervised device) USB cable + Mac (done only once) Apple Configurator.app Configuration profiles MDM server CA certificate WiFi Erases the device You open the device ready for use (almost) 22 May 2015 MDM at ITTF 35

36 Self-Service for Mac Vincent Bippus, IT-OIS 22 May 2015 MDM at ITTF 36

37 Current situation on Macs Mac users can get recommended software from: DFS Appstore The whole process of installation is manually executed 22 May 2015 MDM at ITTF 37

38 New Self-service experience Easy enrolment User friendly interface 22 May 2015 MDM at ITTF 38

39 Demo 22 May 2015 MDM at ITTF 39

40 New Self-service experience Easier installation process Dependencies between packages Easier access to specific configurations 22 May 2015 MDM at ITTF 40

41 New Self-service experience Easier access to licensed software Different types of packages 22 May 2015 MDM at ITTF 41

42 Demo 22 May 2015 MDM at ITTF 42

43 New way to purchase applications With the MDM, we can use Apple Volume Purchasing Program (VPP): Purchase individual licences from Apple App Store for Education Trace and reassign licences acquired through this channel Volume discounts for 20+ licences 22 May 2015 MDM at ITTF 43

44 How to purchase from the Apple App Store Ask for software through the Service Desk Agree on the price and provide the budget code Sign the TID Accept the VPP invitation in the Self Service Install the software from the App Store 22 May 2015 MDM at ITTF 44

45 Mac Self-Service deployment plan April Beta June October 15 th Pilot 15 th Production 15 th 22 May 2015 MDM at ITTF 45

46 Summary Easy to get started: User friendly to install common software and configurations New way to procure applications 22 May 2015 MDM at ITTF 46

47 Overall We have tested at CERN several MDM products, exploring synergies among Mac OS, ios and Android We have identified CERN use cases: 1. Self-service for Mac 2. Managed ios 3. CERN app store for personal mobile devices Using the selected MDM product, we will exetend our services to cover Mac Self-service and Managed ios We will further explore the Community Support model for the CERN app store for personal mobile devices 22 May 2015 MDM at ITTF 47

48 Questions, comments? Join Mac Self-Service beta: Give your feedback: 22 May 2015 MDM at ITTF 48

49 22 May 2015 MDM at ITTF 49