Better Mobility for the Enterprise: Windows Phone 8.1 and MobileIron

Transcription

1 Better Mobility for the Enterprise: Windows Phone 8.1 and MobileIron

2 Table of Contents Executive Summary 3 Windows Phone 8.1: The Right Choice for the Enterprise 3 Unparalleled Productivity 3 Uncompromising Security 4 Rich Management 4 Device Diversity 5 How MobileIron Supports Windows Phone 8.1 in the Enterprise 6 Improved Experience for Business Users 7 Device Enrollment and Configuration 7 Federated Authentication 7 Application Deployment 7 Wi-Fi Configuration 8 VPN Configuration 8 Expanded Security Controls for the Enterprise 10 Certificate Management 10 Policy Management 10 Improved Application Security 12 Enhanced Management Options for IT 13 Streamlined Application Delivery 13 Push Notifications 13 Remote Assistance 13 Extended Inventory 14 Storage Management 14 Conclusion MOBILEIRON. ALL RIGHTS RESERVED. 2

3 Executive Summary Windows Phone 8.1 is a game changer for smartphones in the enterprise. For users, it provides business-savvy features like the Cortana personal assistant and seamless support for Microsoft Office, allowing access to productivity tools anywhere, anytime. For businesses, it offers something even more important the ability to provide enterprise-scale management and security for devices both inside and outside of their networks. With native support for Mobile Device Management (MDM), Windows Phone 8.1 allows you to easily incorporate these devices into corporate-owned or Bring Your Own Device (BYOD) programs. Devices can quickly and easily be enrolled with your MDM system like MobileIron to provide unprecedented control over device security and compliance. This document explains how Windows Phone 8.1 and MobileIron can enable a more manageable, secure mobility experience for enterprise users and IT operations teams. Windows Phone 8.1: The Right Choice for the Enterprise Businesses want to allow workers to choose the mobile devices they feel will make them most productive. At the same time, IT must have enough control over those devices to ensure they meet corporate compliance and security requirements. Windows Phone 8.1 meets both objectives while also integrating with existing Windows-based IT infrastructure. Unparalleled Productivity Windows Phone 8.1 was designed to work seamlessly with the very powerful and familiar Microsoft Office productivity toolset, as well as new technologies like the Cortana personal assistant. These along with the other applications available on every device running the Windows 8.1 platform make it easier to accomplish everyday business tasks. Microsoft Office. Built into every Windows Phone, Microsoft Office gives you mobile productivity. Outlook automatically syncs , calendar, contacts, and tasks across devices. Word, Excel, PowerPoint, OneNote, and SharePoint, make it easy to access, edit, and share your documents on the go. OneDrive. OneDrive gives you mobile access to all your important documents in a single place, from any Windows device. Skype and Skype for Business (Lync). Staying connected to the office is much easier with Skype and Lync. You can attend online meetings or collaborate with colleagues while traveling or working remotely. Cortana. Your Windows Phone personal assistant, Cortana keeps you up to date on the things that matter most to you. Cortana is voice-activated and can provide information, reminders, and alerts based on calendar, location, contacts, and other personal data MOBILEIRON. ALL RIGHTS RESERVED. 3

4 Uncompromising Security Windows Phone 8.1 comes with a complete security platform from a secure boot process all the way to full device encryption. It also ensures that you can securely connect to corporate resources by supporting auto-triggered VPN, enterprise Wi-Fi, and two-factor authentication, and offers Information Rights Management for better protection of sensitive data over . Device Encryption. Windows Phone 8.1 provides full BitLocker encryption to protect both data and credentials on your device. Application and Browser Security. Trusted Boot and App Sandboxing help prevent malicious apps from gaining unauthorized access to data. All apps in the Windows Phone Store are screened for malware before being published, and Internet Explorer warns you if you are trying to visit a harmful website. Secure Connections. Windows Phone 8.1 can auto-trigger VPN and Wi-Fi connections, giving you seamless access to corporate networks and resources on your device. Data Protection. Information Rights Management (IRM) and S/MIME signed and encrypted protect your organization s intellectual property from unauthorized disclosure. Two-factor authentication and full-certificate lifecycle management help ensure that only authorized users are gaining access to data and corporate resources. Rich Management Windows Phone 8.1 natively supports MDM, helping put IT in control of the mobile environment. Organizations can provision, update, inventory, and remotely service devices to keep them in compliance with corporate policies. Configuration Policies. Windows Phone 8.1 allows you to set more than 50 hardware and software policies to limit organizational risk and enforce compliance. Application Management. IT departments can remotely deploy, update, and retire custom enterprise line-of-business apps under your control without requiring any user intervention. Mobility IT Support. With Remote Assistance, you can wipe, lock, or reset passwords on Windows Phone 8.1 devices. You can also can remotely inventory devices so that support professionals have the in-depth information needed to troubleshoot device issues MOBILEIRON. ALL RIGHTS RESERVED. 4

5 Device Diversity There are a wide range of Windows Phone 8.1 devices to choose from, in different screen sizes, colors, and storage capabilities. This mix of features and pricing options can meet the specific needs of any business meaning users don t need to compromise when it comes to choosing the device that s right for them MOBILEIRON. ALL RIGHTS RESERVED. 5

6 How MobileIron Supports Windows Phone 8.1 in the Enterprise MobileIron has worked closely with Microsoft to ensure all security and management features available in Windows Phone 8.1 are easy to implement and maintain on an enterprise scale. Because of these efforts, organizations can take full advantage of Windows Phone 8.1 user enablement, security, and device management features using our Enterprise Mobility Management (EMM) platform. Key capabilities enabled through MobileIron are listed below: User Enablement VPN Configuration Wi-Fi Configuration Federated Authentication Security Certificate Management Policy Management Application Whitelisting/Blacklisting Management Streamlined Application Delivery Client Push Support Remote Assistance Extended Inventory Storage Management Users can automatically connect to a VPN to access corporate resources with support for Microsoft, Juniper, F5, and SonicWALL. VPN connections can also be automatically triggered for specific applications, IP ranges, or domains. IT can configure, manage, and enable devices to connect to corporate Wi-Fi networks. IT can use a Web Authentication Broker to provide customized user authentication during the enrollment process. Organizations that rely on certificates for enhanced security can use MobileIron to manage certificate provisioning. IT can enable or disable device hardware, system, security, and application controls to ensure devices comply with corporate policies. IT can create allow and deny lists for individual applications to prevent non-compliant applications from being downloaded or run on user devices. IT organizations can silently install and uninstall applications on employee devices no user action required. All application types are supported, including.appx,.appx bundles, and.xap. IT can initiate a management session with any user s device to update applications or apply new policies. To prevent loss of corporate and personal data, IT can remotely lock a device that has been lost or stolen. The Help Desk can also remotely reset a user s PIN, eliminating the need for a complete system reset if a user forgets their PIN. IT can troubleshoot device issues more easily with expanded inventory data. This helps in determining when devices need updates or hardware refresh. IT can manage encrypted SD card loaded applications and prevent SD card use or application sideloading. Let s take a closer look at each of these areas showing how Windows Phone 8.1 and MobileIron work together to improve enterprise mobility for both users and IT organizations MOBILEIRON. ALL RIGHTS RESERVED. 6

7 Improved Experience for Business Users For any corporate-owned device or BYOD program, it is imperative that employees can use their device to securely access corporate resources and data anywhere, at any time. Windows Phone 8.1 makes this possible with rapid enrollment and automated VPN configuration, allowing enterprises to provide their employees with a seamless, secure connection to corporate resources. Device Enrollment and Configuration As an enterprise-ready operating system, Windows Phone 8.1 helps organizations control access and comply with corporate policies. Before enabling these features, devices must first be connected to a management server like MobileIron that can manage all of these interactions. The onboarding process for users is quick and easy, requiring only five taps of the phone and three input fields. That makes the typical enrollment time less than one minute. This simplified enrollment capability makes it extremely easy for users to access corporate resources like Wi-Fi and applications. Federated Authentication Windows Phone 8.1 has the ability to use federated authentication as part of the enrollment process. With federated authentication, a Web Authentication Broker (WAB) can be leveraged to provide customized user authentication. The WAB start page URL is provided to the client, which then downloads a security token. That security token is used as authentication during the enrollment process. All of this is completely transparent to the user no separate action is required. Application Deployment As soon as the device is enrolled using either federated or standard authentication methods MobileIron automatically loads the Apps@Work application to provide immediate user access to the Enterprise AppStore. This will allow IT to quickly designate in-house applications that should be pushed to devices upon enrollment, as well as recommend external thirdparty applications that the user can select from the AppStore as needed MOBILEIRON. ALL RIGHTS RESERVED. 7

8 Wi-Fi Configuration Once enrolled, Windows Phone 8.1 can be remotely configured to allow users to automatically connect their mobile devices to internal wireless networks for secure, high-speed access to corporate resources. To create these connections, MobileIron sets up Simple Certificate Enrollment Protocol (SCEP) URLS and pushes out the SCEP configurations that are needed by the device for certificate enrollment. The device uses these SCEP configurations to request a certificate from the MobileIron Core, which then connects to Active Directory, serving as a reverse SCEP proxy. Active Directory connects to the certificate authority to obtain the necessary signed certificate, which is delivered back to the device. With the certificate in place, the device can then connect to the Wi-Fi access point. All of this is accomplished automatically without requiring the user to perform any actions. No changes are required to existing PKI infrastructure and there is no need to open additional firewall ports making security simpler and more effective. For added security, MobileIron makes it possible to prevent users from manually configuring any Wi-Fi connection other than those specifically defined in the MobileIron console. VPN Configuration With Windows Phone 8.1, IT administrators can configure policies that allow devices to automatically connect to a corporate VPN including third-party VPNs from Juniper, F5, and SonicWALL. MobileIron administrators can manage these configurations with the same familiar interface they use to manage their Windows 8.1 laptops and tablets. Application-triggered VPN support is also available, allowing IT to define how individual applications, domains, or IP ranges connect to VPN solutions. For example, a user may have an expense report application that connects to the corporate VPN and a time-tracking spreadsheet managed by a vendor. With Windows Phone 8.1, connecting to the appropriate network 2015 MOBILEIRON. ALL RIGHTS RESERVED. 8

9 becomes fully automated. By simply clicking on the desired application, it will seamlessly connect to either the corporate VPN or the third-party s VPN. These application-triggered VPN configurations can be defined in the MobileIron console, which then pushes the configuration settings to the device. When the user launches the application or accesses a specific domain or IP range, they will automatically be connected to the correct VPN. If another VPN is already active, it will shut down that connection and open the appropriate VPN. All of this gets executed in the background and does not require any user action. When you consider the alternative manually selecting a VPN, entering multiple usernames and passwords this is not only a better experience for users, but it also provides a significant productivity benefit as well MOBILEIRON. ALL RIGHTS RESERVED. 9

10 Expanded Security Controls for the Enterprise First and foremost, enterprise mobility requires that mobile devices interact safely with corporate resources. Part of that interaction is establishing VPN and Wi-Fi connections and being able to remotely lock a lost device. But there is a much broader set of features required to keep both user and corporate information safe whether that is from malicious code, confidential data loss, legal liabilities, or simply productivity loss. From enrollment to ongoing administration, MobileIron incorporates the components and APIs available in Windows Phone 8.1 to make it as simple as possible for organizations to provide secure mobility in the workplace. Certificate Management Providing increased security for mobile devices, certificates are particularly important in highly regulated industries, such as finance, government, and healthcare. Certificates ensure that no username or password is stored on the device. If lost or stolen, unauthorized users can not gain access to information that could allow them to breach corporate networks. Perhaps more important to users, certificates allow them to avoid repeatedly re-entering various usernames and passwords to access corporate resources. Windows Phone 8.1 supports root, certificate authority (CA) chain, and client certificates, allowing all of these to be configured by the MobileIron console to secure Wi-Fi, VPN, , and browser use. Policy Management One of the most significant improvements in Windows Phone 8.1 is around device policy management. The policy control updates in Windows Phone 8.1, listed in the chart below, have all been incorporated into the MobileIron platform, providing a high degree of control over management and security for Windows Phone devices. Most of these policies are enforced device-wide rather than being application-specific. For example, it will not be possible to disable Copy and Paste for a specific application like , but allow it in Microsoft Word. There is one 2015 MOBILEIRON. ALL RIGHTS RESERVED. 10

11 exception: you can turn off Save As and Sharing capabilities for all Microsoft Office applications. These Office-specific features help limit data leakage, while still keeping users productive on their Office applications. Category Policy Area Functionality System Near Field Communication Allow or disable communications with NFC devices, such as parking meters or credit card scanners. (NFC) Hardware Reset Disable or enable hardware reset, preventing users from removing or subverting corporate control. Un-enrollment Disable or enable the ability to un-enroll from the MDM server. This can prevent users from removing their device from corporate control. Bluetooth Allow or disable ability to use Bluetooth devices. Can also disable Bluetooth, but allow the configuration of hands-free profiles. Telemetry Allow or prevent the device from sending telemetry information, such as SQM or Watson. Action Center Allow or disable Action Center alerts. Alerts Camera Disable or enable device camera. SyncMySettings Allow or disable ability to sync settings to or from One Drive or other Windows devices. Cortana Allow or disable the Cortana service. Voice recording Allow or disable voice recording. GPS Allow or disable GPS capability to share device location with applications. Connectivity Wi-Fi Allow or disable Wi-Fi connection. Can also limit ability to manually set up Wi-Fi connections outside of MDM-server installed networks. Internet Sharing Allow or disable Internet sharing. HotSpots Allow or disable the device from automatically connecting to Wi-Fi hotspots and social networks or report on hotspot information to Microsoft. Roaming Prevent the device from using data, profile, or VPN when roaming to avoid unwanted carrier charges. VPN over cellular Allow or disable VPN from running over cellular networks. Device Alphanumeric Set requirement for alphanumeric password configuration. Security password Password length Set minimum password length. Password Set minimum complex characters in a password. complexity Password Set length of time before password expires. expiration Password history Prevent reuse of past passwords. Device wipe threshold Set number of failed password attempts that will trigger a device wipe. Inactivity timeout Set length of time for inactivity before device requires password reentry. Return without Allow or disable to return without password. password Root certificate install Allow or disable manual root certificate install. Identity certificates Allow or disable ability to store identify certificates on device TPM chip MOBILEIRON. ALL RIGHTS RESERVED. 11

12 Data Protection USB Allow or disable the ability for a desktop to access phone storage via USB. OneDrive/Live Allow or disable Microsoft OneDrive or Windows Live Accounts. Accounts Non-Microsoft Allow or disable addition of non-microsoft accounts. Accounts Encryption Allow enterprise to turn on internal storage encryption. (Once turned on, cannot be turned off). Copy and Paste Allow or disable the ability to Copy and Paste data from a device. Storage Card Allow or disable the use of SD storage card. Screen Capture Allow or disable the ability to take screen captures. Applications Browser Allow or disable Internet Explorer on a device. Manual setup Allow or prevent users from manually configuring accounts on a device. Microsoft Office Allow or disable Save As functionality and/or Sharing in Microsoft Office. Microsoft Store Specify whether app store is allowed on the device. Developer Unlock Allow or disable application sideloading. Search Disable search from using location or storing images from Visual Search. Improved Application Security On corporate networks, preventing rogue applications from running on devices is extremely important. Inappropriate applications can introduce malware, compromise confidential information, or open up companies to legal liabilities. The new application security features in Windows Phone 8.1 make it even easier to prevent these risks. Using the MobileIron console, IT administrators can configure a list of applications that can be allowed or denied on any device or group of devices. Different types of applications, such as a Windows Phone Store app or an enterprise line-of-business app, can easily be blocked if necessary. The only applications that cannot be blocked are native applications published by Microsoft. The two exceptions to this are Internet Explorer and Windows Phone Store, which can be disabled via policy (as mentioned in the previous section). The Allow list or application whitelist ensures that only those applications explicitly listed by IT will be available for use or install by the user. If a user does attempt to download or run an unapproved application, they will get an administrator message explaining why the download or use was denied. The Deny list or application blacklist defines a set of applications that cannot be installed or run (if the application already exists on the device). Enterprises often use this capability to prevent the use of non-compliant applications on mobile devices. For example, DropBox is very popular, but enterprises concerned with protecting confidential data do not want employees saving corporate documents to this application. To prevent this, DropBox can be added to the Deny list and users will not be able to install or launch the app (if the app was installed prior to the policy being initiated) MOBILEIRON. ALL RIGHTS RESERVED. 12

13 Enhanced Management Options for IT Helping organizations better manage, control, and troubleshoot through the complete device lifecycle is a key element of Windows Phone 8.1. IT can more easily ensure user devices are up-to-date, accessing corporate resources appropriately, and meeting corporate guidelines for hardware. As IT gains a broader set of capabilities to support users on those devices, they can become more efficient at troubleshooting. MobileIron supports all of these Windows Phone 8.1 management features, giving IT insight into the status of device applications, settings, and hardware to ensure that users can stay productive and corporate assets remain secure. Streamlined Application Delivery Ensuring that the newest, most up-to-date applications are accessible on employee phones is important to business productivity. With Windows Phone 8.1 and MobileIron, IT has the ability to silently install and uninstall applications on corporate-controlled devices. No user action is required. Push Notifications With push notifications, IT administrators can make sure the latest policies are applied to devices. Windows Phone 8.1 will automatically check every four hours for updates and policy changes. However, if IT is troubleshooting a device, they may want to see policy changes take effect immediately. Just like it does for Windows 8.1 laptops and tablets, the MobileIron console allows IT to force check-in for the device in real-time. This can be especially useful if IT needs to push critical application downloads to end-user devices. Remote Assistance IT organizations have always been able to require that Windows Phone users have a PIN for phones to access corporate resources, such as . Previously, if users forgot that PIN, the only remedy was to do a complete phone reset which could mean hours of reconfiguring settings and reloading applications MOBILEIRON. ALL RIGHTS RESERVED. 13

14 Windows Phone 8.1 includes Remote Lock functionality that allows IT to lock a device or reset a PIN (even if it was never previously set). If a device is locked, users can contact the Help Desk, which can use the MobileIron console to easily reset their PIN. The Help Desk forces the device to generate a new PIN that complies with the PIN complexity policies already established on the device. (If a PIN policy has not been set on the device, the device will generate an eight-digit numeric PIN.) This allows the user to simply log back into their device and find all of their applications and data are still in place, eliminating major work disruptions. If a device is lost or stolen, IT can use the MobileIron console to remotely lock the device to prevent anyone else from accessing either personal or corporate data. Extended Inventory MobileIron can also help IT identify when Windows Phone 8.1 devices should be scheduled for updating or hardware refresh using extended inventory capabilities. Building on the attributes that could be queried in Windows Phone 8, IT can now access attributes like phone number, roaming status, IMEI, and Wi-Fi MAC. This information can help with troubleshooting, as well as more easily identify which devices are accessing corporate resources. Storage Management Many Windows Phone devices have an SD card slot that allows users to externally store apps and data. In Windows Phone 8.1, users can install apps on an SD card that are then encrypted on the SD card partition that is specifically designated for apps. This feature is always enabled so there is no need to explicitly set a policy to gain this level of protection. Any apps installed from the SD card must be signed by the Windows Phone Store or your organization s certificate. The apps installed via SD are accessible via the MobileIron console. For those organizations not wanting to allow app sideloading via SD cards, MobileIron can help in two ways. First, you can use either the Disable Removable Storage Card policy, which would prevent users from ever using SD cards. Or if you wanted to still allow users to have access to personal content (like photos and videos) via SD card, you can prevent sideloading by setting the Disable Development Unlock (sideloading) policy MOBILEIRON. ALL RIGHTS RESERVED. 14

15 Conclusion With MobileIron and Windows Phone 8.1, enterprises can ensure user productivity and implement device controls that help IT minimize risks to corporate information and resources. This complete solution provides the unparalleled productivity, uncompromising security, and device diversity required for enterprises to fast track their Mobile First plans. Using Windows Phone 8.1 and the MobileIron platform, organizations can re-evaluate existing mobility infrastructure. Enterprises using BlackBerry Enterprise Server (BES), for example, can examine how MobileIron and Windows Phone 8.1 can replace legacy BlackBerry deployments for a more flexible enterprise-scale solution. For more information on managing Windows Phone 8.1, contact your MobileIron sales representative or visit MobileIron 415 East Middlefield Road Mountain View, CA USA Tel Fax info@mobileiron.com 2015 MOBILEIRON. ALL RIGHTS RESERVED. 15