MTP. MTP AirWatch Integration Guide. Release 1.0

Transcription

1 MTP MTP AirWatch Integration Guide Release 1.0

2 FireEye and the FireEye logo are registered trademarks of FireEye, Inc. in the United States and other countries. All other trademarks are the property of their respective owners. FireEye assumes no responsibility for any inaccuracies in this document. FireEye reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Copyright 2015 FireEye, Inc. All rights reserved. Mobile Threat Prevention AirWatch Integration Guide Release 1.0 Revision 1 FireEye, Inc. Website: Support [email protected] Phone: United States: 877.FIREEYE ( ) United Kingdom: Other: (Undefined variable: Other.Year) (Undefined variable: Other.CompanyName) 1

3 Contents About the FireEye MTP Service 1 About FireEye Mobile Threat Protection Platform 1 About AirWatch 1 About Unified Mobile Threat Policy Enforcement 2 Applying Policy to Enforce Malware Removal 2 Restoring Functionality When Malware is Removed 2 Deploying the MTP Service with AirWatch 4 Types of Deployment 4 AirWatch Managed Client Communication 4 MTP Managed Client Communication 4 Deployment Requirements 4 Integrating MTP with AirWatch 6 Connecting MTP to the AirWatch Server 6 Prerequisites 7 What To Do Next FireEye, Inc. i

4 Contents ii 2015 FireEye, Inc.

5 About the FireEye MTP Service FireEye has partnered with AirWatch by VMware to provide a unified mobile threat detection and policy enforcement solution. FireEye Mobile Threat Prevention (MTP) service monitors mobile devices on your network and detects threats that can be used to exploit your network. AirWatch Mobile Device Management uses this information to restrict network access to compromised mobile devices. About FireEye Mobile Threat Protection Platform The MTP service detects malware found on mobile devices. MTP is made up of three components: FireEye MTP appliance or cloud service. A hardware appliance or cloud service that manages the communication between the MTP cloud service, mobile devices and the AirWatch appliance. FireEye MTP Cloud service. A cloud-based service that tests mobile apps for security threats and maintains an up-to-date database of all known threats associated with tested mobile apps. The MTP cloud service extends the FireEye Malware Prevention Platform to mobile devices. FireEye Mobile Security App. An application that resides on each mobile device on the network. This application detects any new or updated applications on the mobile device and forwards this new or updated application to the MTP appliance for processing. About AirWatch AirWatch Mobile Device Management allows IT administrators to remotely manage and configure mobile phones and tablets. Administrators can also manage compliance with security policies to reduce the risk of accidental or improper disclousure of data to anyone outside your organization FireEye, Inc. 1

6 About the FireEye MTP Service MTP AirWatch Integration Guide About Unified Mobile Threat Policy Enforcement The Mobile Threat Prevention service monitors and detects malware on mobile devices on a network. Each time a user adds or updates a app to his or her device, the client app scans the device and sends the scan data to the MTP appliance. The MTP forwards the app information to the FireEye Mobile Threat Protection (MTP) cloud service, which sends analysis data through MTP to AirWatch. AirWatch uses the analysis data to enforce security policies. Applying Policy to Enforce Malware Removal One possible use case for unified mobile threat policy enforcement is to require users to remove malware from their devices. With unified mobile threat policy enforcement, MTP will alert AirWatch of any malicious apps on a device, and AirWatch can then enforce a policy, such as blocking Wi-Fi. If a user downloads a malicious app, MTP analyzes the device and reports the incident to AirWatch, which then blocks the user's service on that device. Restoring Functionality When Malware is Removed When a user removes a malicious app, MTP scans the app, and sends the scan data to AirWatch. AirWatch then restores to the device FireEye, Inc.

7 Release 1.0 About Unified Mobile Threat Policy Enforcement 2015 FireEye, Inc. 3

8 Deploying the MTP Service with AirWatch MTP AirWatch Integration Guide Deploying the MTP Service with AirWatch This section will guide you through the steps required to successfully add the Mobile Threat Protection service to your network. Types of Deployment There are two ways to deploy the MTP service with the AirWatch system: AirWatch managed client communication MTP managed client communication AirWatch Managed Client Communication With AirWatch managed client communication, you do not deploy the FireEye MTP client application on each user s mobile device. To specify AirWatch managed client communication select the Periodic Sync checkbox within the AirWatch Settings section of the Web UI Settings tab. MTP Managed Client Communication With MTP managed client communication, the MTP server communicates directly with user s mobile devices over the network s WiFi network. MTP managed client communication is recommended. To use MTP managed client communication, each user s mobile device needs to have the FireEye MPT client application installed. To specify MTP managed client communication deselect the Periodic Sync checkbox within the AirWatch Settings section of the Web UI Settings tab. Deployment Requirements Before you can add the FireEye MTP service on your network, you need the following: FireEye, Inc.

9 Release 1.0 Deployment Requirements An AirWatch server running on your network with a current AirWatch license The AirWatch client application installed on all mobile devices to be protected by the FireEye MTP solution An AirWatch user account and password to be used by the FireEye MTP appliance to access the AirWatch instance A FireEye MTP appliance installed on your network with a active connection to the MTP Cloud service (only required for MTP Managed Client Communication) The following licenses installed on the MTP appliance: A current FireEye MTP appliance license A current FireEye support license A current FireEye Content Update license 2015 FireEye, Inc. 5

10 Integrating MTP with AirWatch MTP AirWatch Integration Guide Integrating MTP with AirWatch This section describes how to integrate an existing installation of the FireEye MTP Management console with AirWatch. The following information is covered: Connecting MTP to the AirWatch Server 6 If you have not yet installed the FireEye MTP management console, you can integrate with AirWatch as part of the initial login and setup procedure. See the following documents: FireEye MTP Management Appliance System Administration Guide FireEyeMTP Management Cloud System Administration Guide Connecting MTP to the AirWatch Server You should use the MTP Management console Web UI to configure the AirWatch connection FireEye, Inc.

11 Release 1.0 Connecting MTP to the AirWatch Server Prerequisites The AirWatch server installed on the network. An AirWatch user account and password to be used by the MTP management console. The AirWatch API Key used to authenticate access the AirWatch APIs An AirWatch App Group defined on the AirWatch appliance A compliance policy that uses a blacklist to block malicious apps associated with the AirWatch App Group defined on the AirWatch appliance The MTP management console installed on the network with a direct network access to the AirWatch server. Follow the steps in this section to connect to the AirWatch server. To connect to AirWatch: 1. In the MTP Web UI, click the Settings tab. 2. Enter the hostname or URL of the AirWatch API port. 3. Enter the pre-defined AirWatch user name and password. 4. Enter the AirWatch API Key. 5. Enter the HighRisk App group name. This HighRisk App group name should match the App Group added to th eairwatch console. 6. Select the Active checkbox. The Active checkbox enables the connection between AirWatch and the MTP management console. 7. If you are not deploying the FireEye Mobile Security app on each mobile device, select the Periodic Sync checkbox. 8. Click Test to test your configuration FireEye, Inc. 7

12 What To Do Next MTP AirWatch Integration Guide What To Do Next After reviewing this document, see the FireEye Mobile Threat Protection documentation for further information about keeping your enterprise safe from mobile threats. For technical support, contact FireEye in the following ways: us at Call us at FIREEYE (USA); (UK); (Outside the USA) Visit the FireEye Customer Support Portal (login required): FireEye, Inc.