Mobile Device Management

Transcription

1 Mobile Device Management The objective of this document is to provide you with context about mobile device management, for both ipad and Mac, to enable you to have a relevant conversation with your customer around the benefits of an organisation utilising your MDM solutions. The Top Considerations Management or no management. Administrators have a choice: management or no management. There are many variant degrees and methods to manage ipad and Mac. In most enterprise solutions, the devices will have security and management requirement that will require the devices to be constantly managed over the air wherever they are. Also, data protection is a major concern, so passcode, particular wifi confirmation and remote wipe options are usually required. This scenario is very different to Education where the devices may remain in the classroom but will need to be reset up for a different user or class at the end of the day. This solution does not need to be over the air. A major consideration is personally owned devices being introduced to an educational or enterprise network. This is a source of frustration for IT administrators as they will require some features on the network, but there will be a lack of con roll of the devices. Alternatively, corporate/education owned but personally enabled devices are purchased via the organisation and provided to the end user and this enables the organisation to achieve the initial setup, increased control, reduce security risk and but ongoing management might not be required. Mobile Strategy. Organisations are beginning to truly embrace Mobility as a strategy and there are numerous ways this is can be achieved. Mobile Device Management (MDM) software configures, monitors, manages and secures mobile devices deployed across educational institutions and enterprises. In order to have a successful MDM deployment, the organisation must have a mobile strategy and have a clear plan of what permissions and profiles the end users will require from a security perspective. A few examples of these include: Enforcing a Passcode Setting up , VPN and WiFi remotely Managed App Deployment Web Restrictions Removing applications off the device - Eg Removal of Camera

2 This is key to a successful role out of mobile devices is that the organisation will address security and control while enabling the user to be more productive, efficient by using these devices. Security. Network administrators need to carefully evaluate several aspects of security, access, and performance when considering deployment of ipad and Mac into enterprise networks. The Scenarios Education Educational institutions have a different requirements when it comes to actual deployment and management of mobile devices along with different budget restraints. With that in mind, a couple of ways these organisations deploy devices and make sure the devices are configured to gain access to corporate networks and data, deploy specific Apps etc. Apple Configurator This is a free software downloadable from the Mac App Store for Mac and allowed for further security controls/configuration profiles and even restrictions that at present, MDM vendors were unable to meet for ipad. Apple Configurator is typically used in Education or when a single device is shared across many users. Apple Configurator is not an over the air solution. It requires devices to be plugged in a USB charge trolley. On top of the trolly, will be a Mac running Apple Configurator to confiture the ipads. Apple Configurator enables IT departments to mass configure devices (up to 30 at a time) prior to them being handed to the end use. This is ideal of the following situations: A single device will be used by many people on a day to day basis but utilising the same set up such as Apps and restrictions (although ideal for education, this could be used for a shop assistant in a supermarket for example) It could be that the device is set up in single App mode (also useful for restaurant menus or kiosks) It could be that a single device will be used by numerous people on different days, however, at the end of each day, their data is required to be backed up and then no matter which one they are provided the following day, their data is restored to that device (Education for Example) Apple Configurator has three different settings. 2 of 5

3 Prepare Allows organisations to install multiple corporate owned devices with a single configuration profile such as ios version, Exchange, VPN, WiFi settings and Apps. Also, devices can be updated to the latest version of ios and settings and App data can be backed up and restored. This can also be used to enrol them with an MDM vendor so that moving forward they can be managed remotely (over the air) and even enrol Apple TV so that this can be remotely managed by an MDM vendor. Supervise Supervising devices (these will have to be prepared prior to been supervised) allow the devices to be configured how an organisation wishes whilst constantly being in direct control and typically, these devices are be handed back and this profile will be re-applied when the devices are plugged back into Apple Configurator providing consistency and control to IT. This set up works perfectly in deployment scenario s whereby the device is shared amongst users across such as; retail, hotel or even education. Assign This is where a supervised device can be allocated to a user. This could be particularly ideal if the deployment of such device be for a longer term or that the user in question needs certain Apps or even requires data being saved. Using an Assign deployment via Apple Configurator when the device is plugged into the cart, this will back up all the users data. The benefit here is that no matter which device the user is given the next time, their data can be restored to that device and so can continue where they left off. A USB charging trolley with 30 cables, a MacBook Pro, Apple Configurator and of course cases for all the ipads is a great solution for Education (with great margin!). However, if true mobility is required, so perhaps the ipads need to be taken home by students, so they need to be managed over-the-air, there are a few MDM solutions that can be considered. Enterprise Mobile Device Management Choosing an MDM vendor is no longer just down to IT making sure it aligns with business security and infrastructure requirements but it is to improve productivity and gain adoption by understanding how these devices are going to be used by the end user. MDM is ideal for vast amounts of remote users where the business is required to apply control, security and get business applications on to these devices over-the-air (no touch required!) In the first instance of setting up an MDM solution, the first thing is to get a profile from the MDM server onto the devices. This can be accomplished in a couple of ways. The profiles can be sent to the end user and installed by them, Apple Configurator can install the profile or they can enrol their own devices through a web portal. Once this profile has been installed on the device all the settings, permissions, restrictions, Apps will all take place without the user having to do anything else. 3 of 5

4 Profile Manager is Apple s Mobile Device Management (MDM) Solution included in Mac OS X Server. It comes preinstalls on the Mac mini Server. Like running any other service in-house, this gives more control to the business. Another benefit is that the business does not need to pay per device or user for MDM. This can be a cost-effective, scalable solution. It can be used to manage Macs and ios devices in an Education or Enterprise environment. The Specifics Security. An administrator is responsible for the health and integrity of an organisation s network has many responsibilities, often including the integration of new devices into the network environment. Traditionally, this involved corporate owned or issued devices. In the corporate-issued case, the network administrator can deploy the ipad and impose a number of restrictions, such as blocking user access to the itunes store and app store, or limit access to certain built-in applications, such as YouTube or even the built-in camera. However, these policies may not be well received by users and also require the administrator to review, approve, and deploy any applications deemed to be desirable and allowed for users to access. Some organisations may deploy corporate-owned ipads and issue them to employees, but others may consider how to integrate user-owned ipads. In either case, prudent network administration considers several aspects of device and network security and access. These can be categorised into the following topics: Device security Data security Network security Application security Apple integrates security measures into the ipad that directly address each of these areas, so it s worthwhile to understand the device s capabilities and options for deployment so that the administrator can best decide how to integrate the device into the network. Once the device is on the network, data and network resources should not be compromised. The use and load on the network also need to be considered, especially with emerging applications and enterprise usecases. For more information, please see the security document. Network. Access to the corporate network via the ipad is normally via WiFi - there are no wired ports at all. While the ipad is available with a 3G cellular connection, the connection is slower than WiFi, its use requires a data plan, and the quality of cellular service is not under the control of the network administrator. Therefore, it is imperative that the wireless infrastructure be ready for the ipad. These can be categorised into the following main topics: Preparing the wireless infrastructure Considering network traffic types 4 of 5

5 Enabling the proper network experience Infrastructure Security and authentication Traffic shaping and analysis Reporting and monitoring tools For more information, please see the ipad Networking Deployment document. What Questions Should I Be Asking My Customers? Will the devices be for Education or Enterprise? How are devices currently managed? Will the devices be truly mobile? How will they ensure the devices are secure? What happens if a user s device is lost or stolen? Will users share the devices? Will the institution want to enforce certain restrictions i.e. removal of applications, passcode etc? Is scalability and cost a concern? Has the institution considered Apple Profile Manager? Did you know that you will need a Mac to use with the USB charge trolley? 5 of 5