Cloud Services MDM. Management Admin Guide

Transcription

1 Cloud Services MDM Management Admin Guide 10/27/2014

2 CONTENTS Management Compliance Policies Policies... 4 Attachment Security Policies... 8 Attachment Security Policies ios Devices... 8 Attachment Security Policies Other Devices Unmanaged Devices Attachment Control Management Dashboard Keep in Mind

3 Management is one of nine sections of the overall Admin Guide for Mobile Device Manager. The following is the complete list of MDM Admin Guide components: MDM Overview and Setup Device Management Profile Management Geofencing Application Management Content Management Management Telecom Management Reports and Alerts MANAGEMENT MDM provides administrators with several options for configuring secure integration with corporate services. The most robust and extensible solution is through the Secure Gateway, which allows the administrator to secure, monitor, and manage both the smart device fleet and corporate access, all from the Admin Console. MDM simplifies and secures management by allowing the administrator to perform the following tasks: Quickly monitor and troubleshoot server requests through the Secure Gateway Dashboard. Gain visibility and control on top of the existing corporate structure to ensure that corporate actions are secure and compliant. Create and edit compliance rules, including Blacklist and Whitelist policies. 2

4 Control access for both managed devices and unmanaged devices. o For devices under MDM, the data collected from the Secure Gateway can be correlated to the device s existing record to show you how the managed devices are interacting with your server. o For devices not under MDM, the data can be viewed on the dashboard to help the administrator track rogue devices and gain a more complete picture of the mobile deployment. Configure integration with a number of corporate services, including (but not limited to): o o Microsoft Exchange o Google Apps for Business o Microsoft BPOS o Microsoft Office365 o Lotus o Novell Groupwise versions COMPLIANCE POLICIES compliance policies allow the administrator to block access to corporate servers for enhanced security based on pre- defined compliance policies. You can configure compliance policies in either of the two following ways: Navigate to Dashboards Management and then select Policies on the left. Navigate to Profiles & Policies Compliance and then select Policies from the Compliance view on the left. 3

5 POLICIES Depending upon your Mobile Management (MEM) deployment, the Policies screen provides three categories of compliance policies: General Policies, Managed Device Policies, and Attachment Security Policies. Within each category, there is a list of current compliance policies (shown below). NOTE: Policies can be configured only at the Location Group at which MEM is configured. By default, all child Location Groups inherit the created policies. The circles under the Active column indicate whether the policy is active (green) or inactive (red). Checking the Disable Compliance option forces Mobile Management (MEM) to function in Bypass mode. This option is applicable for all the MEM configuration models (i.e., for Proxy, PowerShell, and Google). NOTE: In Bypass mode, no compliance policy will be applied against the devices. To make changes to a policy, hover over the pencil icon under the Actions column and click Edit Policy. If a window is open, click [Save] to finish editing the policy, or [Cancel] to return the values to the last saved state. General Policies General Policies are applicable to MEM deployments involving the Secure Gateway (SEG) and the PowerShell Integration. 4

6 Managed Device This policy allows you to determine the outcome if an unmanaged device attempts to contact the corporate server. 1. Open the policy and specify whether to Allow or Block an unmanaged device. 2. Click [Save]. Mail Client This policy allows you to control access to a list of mail clients. 1. Open the policy and click [Add Rule]. 2. Select an option from the Client Type drop- down menu: Pre- Defined The known mail clients stored in the MDM database. Discovered The mail clients that connect through the gateway, but are not currently stored in the MDM database. Custom Specified mail clients (i.e., Apple or Android). 3. Select the Mail Client from the drop- down menu; if you selected Custom, enter the mail client in the field. 4. Choose to either Allow or Block the specified mail client and type. 5. Specify the default policy (Allow or Block) for all other mail clients not currently listed. This applies to all known mail clients that are not currently listed in the policy. 6. Specify the default policy (Allow or Block) for all new or discovered mail clients not currently listed. This applies to all mail clients that are not currently stored in the MDM database. 7. Click [Save]. 5

7 User This policy allows you to list specific users who are allowed or denied access to the server and receive corporate on their mobile device. 1. Select a User Type from the drop- down menu: o User Account Select a registered device user from the Admin Console database. o Discovered Choose the users that are connecting through the gateway and are not currently stored in the database. o Custom Choose the specific users. 2. Select a User Name from the drop- down menu. 3. Make a selection to Allow, Block, or Whitelist the specified user. 4. Specify a default policy (Allow or Block) the default action for all other usernames not currently listed. This applies to all known usernames that are not currently listed in the policy. 5. Specify the default policy (Allow or Block) for all new or discovered usernames not currently listed. This applies to all usernames that are not currently stored in the MDM database. 6. Click [Save]. Managed Device Policies Managed Device Policies are only enforced on devices currently enrolled in MDM. Inactivity This policy allows you to specify if you allow or deny inactive devices to access the server, as well as the policy for the number of days a device has not been managed before it is considered inactive. 1. Open the policy and specify whether to Allow or Block inactive devices from connecting to the server. 2. Enter the number of days of inactivity before a device is considered inactive. 3. Click [Save]. 6

8 Device Compromised Compliance This policy allows you to determine the outcome if a compromised device attempts to contact the corporate server. 1. Open the policy and select whether to Allow or Block compromised devices to access their server. 2. Click [Save]. Encryption Compliance This policy allows you to determine the outcome if a device does not have data protection turned On while attempting to access the corporate server. 1. Open the policy and select whether to Allow or Block devices that do not data protection enabled. 2. Click [Save]. Platform/Model Compliance This policy allows you to define which platforms and models you want to either access or be blocked from the corporate server. 1. Open the policy and click [Add Rule]. 2. Select an option from the Platform and Model drop- down menus. 3. Make a selection to Allow or Block the specified platform and model. 4. Specify the default policy (Allow or Block) for all platforms and models not currently listed. 5. Click [Save]. 7

9 Operating System Compliance Administrators might want to block a version of an OS used by a particular mobile device for many different reasons. For example, an admin might decide to temporarily block an OS (until the admin can resolve the problem) because it is stressing an server due to a bug or other technical issue. Another scenario might be to only allow specific platforms and OS(s) ranges that you want to access the corporate server, and block all others from receiving their Open the policy and click [Add Rule]. 2. Select the type of device from the Platform drop- down menu. 3. Select the minimum and the maximum operating system for the device from the Min OS and Max OS drop- downs. 4. Specify the default policy (Allow or Block) for all OS versions not currently listed. 5. Click [Save]. ATTACHMENT SECURITY POLICIES Attachment Security Policies are used to secure attachments being downloaded onto mobile devices. Attachment Security is available for deployments involving the SEG proxy server. In order to prevent misuse of corporate attachments, MDM s SEG has been enhanced to encrypt and secure individual attachment files. These security policies ensure that only compliant devices enabled with the Secure Content Locker (SCL) application can decrypt and view the attachment. Managed Devices Managed Device policies are enforced only on devices that are enrolled in MDM. You can configure the file attachments that need to be encrypted and secured via SCL and set policies that can be enforced on files that cannot be viewed on the SCL via the console. Select ios Devices to configure attachment settings for ios devices. OR Select Other Devices to configure attachment settings for Android devices. ATTACHMENT SECURITY POLICIES IOS DEVICES 8

10 The following screen illustrates the features available for configuring the attachment security policy for managed ios devices. Use Recommended Settings Enabling this option defaults the policy to the recommended settings, where pre- defined settings are enforced on devices. You may choose to customize the policy based on your corporate requirements. Actions on Specific file types Selecting the radio buttons facilitates MDM to communicate with the SEG the actions to be performed on attachments of specific file types. o Encrypt & Allow Attachments Implies that the SEG will encrypt attachments of specific file type(s), and these can be decrypted and read only via the SCL application on the device. o Block Attachments Implies that the SEG will block attachments of the specific file type(s). o Allow Attachments without Encryption Implies that the SEG will allow attachments of the specific file type without encryption. The attachments can be opened/saved/edited on the device through the native readers. Enabling/disabling the Allow Attachments to be saved in Secure Content Locker check box allows you to decide whether or not to allow the device user to save the attachment locally in the SCL. 9

11 Select the radio button actions under the Other Files area to update settings for the file types other than the standard file categories that are currently supported. o You can exclude specific file types from MDM's attachment setup under the Exclusion section. For example, you can block all other file types while excluding AUTOCAD files of type.dwg. o You can also set a message to be displayed in s on devices for the blocked attachments file types under the Custom Message for Blocked section. For example, "One or more attachments have been blocked per Acme's corporate policy." ATTACHMENT SECURITY POLICIES OTHER DEVICES The below screen describes the features available for the configuring attachment security policy for other managed devices. NOTE: With the Encrypt & Allow Attachments option, attachments downloaded on other managed devices will be encrypted, but cannot be viewed on the device. However, the device users will be able to forward these s with the encrypted attachment from their devices. 10

12 UNMANAGED DEVICES Unmanaged Device policies are enforced only on devices that are not enrolled and managed in MDM. Use Recommended Settings Enabling this option defaults the policy to MDM recommended settings, where pre- defined settings are enforced on devices. You may choose to customize the policy based on your corporate requirements. Actions on Specific file types Selecting the radio buttons facilitates MDM to communicate with the SEG the actions needed on attachments of specific file types. o Encrypt & Allow Attachments Implies that the SEG will encrypt attachments of specific file type(s), and these can be decrypted and read only via the SCL application on the device. o Block Attachments Implies that the SEG will block attachments of the specific file type(s). o Allow Attachments without Encryption Implies that the SEG will allow attachments of the specific file type without encryption. The attachments can be opened/saved/edited on the device through the native readers. You can exclude specific file types from MDM's attachment setup under the Exclusion section. You can also set a message to be displayed in s on devices for the blocked attachments file types under the Custom Message for Blocked section. Apply Compliance Policies After you create or edit compliance policies, the policies will be automatically applied when SEG is refreshed (configure the refresh interval in System Settings Advanced). To instantly apply the policy, click the [Provision Policy Changes] button at the bottom of the Compliance Policies page. 11

13 ATTACHMENT CONTROL MDM offers complete control as an option for all devices accessing corporate . This aspect of mobile access allows organizations advanced security settings otherwise unavailable through native clients. More than simply denying access to send and receive attachments, you can manage attachment settings with flexible encryption and access policies based on file type, including the option to decrypt and open securely in the Content Locker. Manage all of these attachment settings from the Admin Console. Prerequisites MDM's attachment control features leverage two aspects of MDM. The following prerequisites must be in place: Secure Gateway (SEG) v6.3 or higher: The SEG allows a secure connection from internal mail servers and each mobile device. Content Locker v1.6 or higher: The Content Locker serves as the secure area for viewing and managing attachments. Upon receiving an , the Content Locker detects attachment presence and immediately sends the content to the secure viewing area. o To begin, purchase the MDM Mobile Content Management module. o Then deploy the Content Locker as a public managed application. Accessing Attachment Settings Once the SEG and Content Locker infrastructure is properly established, manage attachments settings alongside all other MDM features and settings in the Admin Console. Create customized attachment settings for both managed and unmanaged devices by navigating to Profiles & Policies Compliance Policies. Select the Edit Policy option to the right of each device type in the Attachment Security Policies area. For more details on configuring attachment settings, refer to Compliance Policies. Accessing Protected Attachments Once Attachment Protection has been enabled, end- users are able to access attachments as established in the Admin Console. These options include the following: Allowed & Unencrypted Attachments Attachments display normally within the mailbox. Blocked Attachments Attachments are removed and replaced with a message notifying the user that the attachments have been blocked. Encrypted Attachments Attachments display in the mailbox as an encrypted *.awsec file type that can only be decrypted and read from within the Content Locker. 12

14 Opening Encrypted Attachments To open encrypted attachments in the Content Locker: 1. Select the attachment. 2. Select Open in Content Locker. 3. Authenticate with corporate credentials. The attachment automatically decrypts and opens. NOTE: The file cannot be opened or transferred outside of the Content Locker. MANAGEMENT DASHBOARD Each time a device attempts to connect to your mobile server through the Secure Gateway (SEG), the gateway gathers statistics about the request. This information is presented on a dashboard in the MDM console and can be used to assess the health of your mobile deployment. To access the Management Dashboard, do the following: 1. Navigate to Dashboards Management. 2. Click the Location Group drop- down and select the group that connects to the SEG in your corporate environment. 3. Click All under Request Time. NOTE: The basic Management Dashboard is available as a view under the main Dashboard, but it does not contain time interval view options or editing capabilities. 13

15 Graphs and Grid The Management Dashboard view is controlled by the three graphs at the top of the screen and a grid below the graphs, which display the data from the selected graph or data group. Device Activity The total number of devices communicating through the gateway and the number of blocked and allowed devices. Devices The total number of devices communicating through the gateway and the number of managed and unmanaged devices. Non- Compliant Devices The number of noncompliant devices communicating through the gateway according to the compliance criteria, as specified in Compliance Policies. Grid The devices that have accessed the SEG. Request Time Views The Request Time views allow the administrator to adjust the dashboard view for all time periods, or for time intervals throughout the last 24 hours. Click All or select a time interval to update the charts and grids with the time selection. Compliance in the Dashboard To edit compliance policies, click Policies. For more information about creating compliance policies, see Compliance Policies. 14

16 Override an Compliance Policy After compliance policies are in place for the Secure Gateway, the administrator may find the need to make Blacklist or Whitelist exceptions, or to remove a device from the list of exceptions. To override a compliance policy: 1. Select Policy Override List to view the current override status for all of the devices that are communicating through the gateway. This page also provides the ability to add, remove, or change an override to any of the devices listed in the grid. 2. Select a device from the grid to perform a policy override on that device by checking the box on the left. The device selected in the screen is a Whitelisted device. 3. Click any one of the following to override the current policy: Whitelist Allow the device to override compliance policies. Blacklist Block the device, even if there are policies that allow (or whitelist) the device. Default Remove the device from the override list and apply the configured compliance policies to that device. Dashboard Test Mode Test mode allows mobile devices to communicate through the gateway even when restrictive compliance policies are currently enabled. The Dashboard displays the noncompliant reason code(s) for a device to indicate all applicable restrictions if the test mode was not enabled. To enable test mode, check the Test Mode checkbox in the upper right corner of the dashboard. To disable test mode, uncheck the Test Mode checkbox and the compliance policies are applied again to each device that communicates through the gateway. The Dashboard displays the noncompliant reason code(s) for a device to indicate all applicable restrictions that are now being applied. 15

17 KEEP IN MIND... Use filter views and searches to view devices in the Secure Gateway dashboard grid according to compliance criteria. The administrator can filter the devices displayed on the grid based upon override status. Select a filter to view Blacklisted, Whitelisted, or All devices. The filter functionality provides the ability to search the grid within the displayed results. o Enter the full or partial search term in the Search box. 16