www.nvell.cm/dcumentatin System Security ZENwrks Mbile Management 2.6.x Nvember 2012
Legal Ntices Nvell, Inc., makes n representatins r warranties with respect t the cntents r use f this dcumentatin, and specifically disclaims any express r implied warranties f merchantability r fitness fr any particular purpse. Further, Nvell, Inc., reserves the right t revise this publicatin and t make changes t its cntent, at any time, withut bligatin t ntify any persn r entity f such revisins r changes. Further, Nvell, Inc., makes n representatins r warranties with respect t any sftware, and specifically disclaims any express r implied warranties f merchantability r fitness fr any particular purpse. Further, Nvell, Inc., reserves the right t make changes t any and all parts f Nvell sftware, at any time, withut any bligatin t ntify any persn r entity f such changes. Any prducts r technical infrmatin prvided under this Agreement may be subject t U.S. exprt cntrls and the trade laws f ther cuntries. Yu agree t cmply with all exprt cntrl regulatins and t btain any required licenses r classificatin t exprt, re-exprt r imprt deliverables. Yu agree nt t exprt r re-exprt t entities n the current U.S. exprt exclusin lists r t any embarged r terrrist cuntries as specified in the U.S. exprt laws. Yu agree t nt use deliverables fr prhibited nuclear, missile, r chemical bilgical weapnry end uses. See the Nvell Internatinal Trade Services Web page (http://www.nvell.cm/inf/exprts/) fr mre infrmatin n exprting Nvell sftware. Nvell assumes n respnsibility fr yur failure t btain any necessary exprt apprvals. Cpyright 2012 Nvell, Inc. All rights reserved. N part f this publicatin may be reprduced, phtcpied, stred n a retrieval system, r transmitted withut the express written cnsent f the publisher. Nvell, Inc. 1800 Suth Nvell Place Prv, UT 84606 U.S.A. www.nvell.cm Online Dcumentatin: T access the latest nline dcumentatin fr this and ther Nvell prducts, see the Nvell Dcumentatin Web page (http://www.nvell.cm/dcumentatin). Nvell Trademarks Fr Nvell trademarks, see the Nvell Trademark and Service Mark list (http://www.nvell.cm/cmpany/legal/trademarks/ tmlist.html). Third-Party Materials All third-party trademarks are the prperty f their respective wners.
Table f Cntents Architecture 4 ZENwrks Mbile Management System Security 6 Server-t-Server Data Transmissin Security... 6 Database Security: Data-at-Rest Encryptin... 6 Server Lg Security... 7 Device-t-Web/HTTP Server Data Transmissin Security... 9 Implementatin Guidelines: Device-t-Server Data Transmissin Security... 9 Device Security... 10 Implementatin Guidelines: Preventing Device Breaches... 13 ZENwrks Mbile Management 2.6.x System Security Guide Architecture 3
Architecture ZENwrks Mbile Management cnsists f an SQL Database Cmpnent and a Web/HTTP Server Cmpnent. The cmpnents might be installed n a single server r multiple servers. The architecture yu chse depends n system size and cmplexity. In additin t the setups illustrated belw, a reverse prxy setup is als supprted if the prxy is sufficiently scalable. Fr the lng term, redundant prxies might be advisable t help ensure high availability. Achieving redundancy thrugh SQL and Web clusters is a gd way t ensure high availability. Single Server Cnfiguratin Diagram Typical cnfiguratin suitable fr general-purpse deplyment where a single server meets all the requirements needed fr installatin. ZENwrks Mbile Management 2.6.x System Security Guide Architecture 4
Multiple Server Cnfiguratin Diagram Deplyment ptins fr larger, mre cmplex deplyments where a single server des nt meet all the requirements needed fr installatin. See related tpics: System Perfrmance: Sizing/Tuning High Availability Cnfiguratin T simplify a descriptin f the ZENwrks Mbile Management security system, we have gruped the security features int several categries, which we refer t as the layers f security. Server-t-Server Data Transmissin Security Database Security: Data-at-Rest Encryptin Server Lg File Security Device-t-Server Data Transmissin Security Device Security ZENwrks Mbile Management 2.6.x System Security Guide Architecture 5
ZENwrks Mbile Management System Security Terms: SSL Encryptin: Secure Scket Layer Security. Using SSL t secure data exchanges prvides an encrypted tunnel between the ZENwrks Mbile Management servers and ther servers r devices. TLS Encryptin: Transprt Layer Security Encryptin. TLS is a FIPS 140-2 cmpliant encryptin prtcl that prvides an encrypted tunnel thrugh which sensitive data can travel. Yu can enable TLS thrugh IIS. Hwever, this might limit the types f devices that can cnnect t the ZENwrks Mbile Management server because nt all devices supprt TLS. Server-t-Server Data Transmissin Security ZENwrks Mbile Management requires the use f SSL r TLS with the servers where the ZENwrks Mbile Management Web/HTTP cmpnent is installed, t meet best practices fr security. ZENwrks Mbile Management supprts the use f SSL r TLS certificates frm trusted Certificatin Authrities t ensure secure server-t-server data transmissin. Server-t-server cnnectins within the Internal Private Netwrk might include cnnectins between: ActiveSync server and ZENwrks Mbile Management server LDAP/AD server and ZENwrks Mbile Management server SCEP server and ZENwrks Mbile Management server Cnnectins frm ZENwrks Mbile Management server t servers utside the Internal Private Netwrk includes: ZENwrks Mbile Management server t ZENwrks Mbile Management Custmer Center (prduct updates, etc.) ZENwrks Mbile Management server t Apple Data Center Database Security: Data-at-Rest Encryptin Sensitive data-at-rest is secured in the ZENwrks Mbile Management database by using the AES encryptin algrithm. ZENwrks Mbile Management servers use a 256-bit encryptin key size t encrypt user infrmatin in the database. ZENwrks Mbile Management s prcedures fr key strage and key derivatin are FIPS cmpliant. Encrypted database infrmatin includes: Passwrds User Encryptin Key Authenticatin Passwrd (stred nly if authenticating via ZENwrks Mbile Management, nt ActiveSync) Text Message Lg (can be disabled s it is nt sent t the server) Lcatin Data (can be disabled s it is nt sent t the server) ZENwrks Mbile Management 2.6.x System Security Guide ZENwrks Mbile Management System Security 6
Phne Lg (can be disabled s it is nt sent t the server) Device Lgging (can be disabled s it is nt sent t the server) File Archive (can be disabled s it is nt sent t the server) The ZENwrks Mbile Management database cmpnent itself is secured by using built-in SQL Server security features. By default, ZENwrks Mbile Management creates a single SQL Server lgin with access t the ZENwrks Mbile Management database. Permissins can be set within SQL Server, as desired, t access the database by ther SQL Server lgins r by using Windws Authenticatin. Server Lg Security ZENwrks Mbile Management Server errr lgging is intended t be used as a diagnstic tl by the Nvell Technical Supprt staff. Servers where the lg files reside shuld be secured. In additin, administratrs shuld limit access t the directry where the lgs are cntained. Server lgs are displayed in the ZENwrks Mbile Management Dashbard and access t these views can be restricted via administrative lgin credentials. The data displayed in the Server Lgging page f the dashbard is system-level data and has n user assciatins. Displayed lgging infrmatin that is assciated with users is limited t ZENwrks Mbile Management and ActiveSync synchrnizatin data. There is als a lg file stred n the server that is nt dependent n access t the database tables. This is secured by standard Windws authenticatin and file system security cnfiguratins. Under Device Lgging fr users, there is als a way t request a lg frm the device. The table shwn belw displays the time the request was made, wh the request was made by, whether it was received r nt, if received then what time, and if nt received what was the errr. It des nt display the actual lgs; the actual lgs can be seen by selecting a rw in the table and clicking the Dwnlad Lg buttn. User Prfile: Device Lg ZENwrks Mbile Management 2.6.x System Security Guide ZENwrks Mbile Management System Security 7
Fr BlackBerry (with NtifySync fr BlackBerry), ios, Symbian, and Windws Mbile platfrms, a lg file nly has ZENwrks Mbile Management-specific lg-entries. Examples f lg entries fr BlackBerry (with NtifySync fr BlackBerry), ios, Symbian, and Windws Mbile: Beginning Sync Ending Lcatin Sync Beginning Device Lg Sync Ending Device Lg Sync Registratin status cde: 200 Reg - Accunt Remved DeviceStats returned: 200 GetAppListCnnectin returned: 200 Accunt lading Fr Andrid, a lg file has lg-entries encmpassing ZENwrks Mbile Management-specific lgs, device lg, and the lg entries frm Tuchdwn (if TuchDwn is installed and registered). Examples f lg entries fr Andrid: CnnectivityChange fr mbile: CONNECTING/CONNECTING CnnectivityChange fr mbile: CONNECTED/CONNECTED DISABLE_CLOCK: yes DISABLE_NAVIGATION: yes Attempting t switch t WIFI Attempting t switch t BLUETOOTH_TETHER Scheduling restart f crashed service SyncHandler: Attempting t send device lcatin cmmand ZENwrks Mbile Management 2.6.x System Security Guide ZENwrks Mbile Management System Security 8
Device-t-Web/HTTP Server Data Transmissin Security Device-t-Web/HTTP server data transmissin must be secured by emplying SSL r TLS. With SSL r TLS enabled, ZENwrks Mbile Management transmits data-in-mtin (infrmatin riginating n a device r server) in an encrypted tunnel s it is secure in transit. With SSL r TLS disabled, ZENwrks Mbile Management still wrks and transmits data-in-mtin as plain text. Data-in-mtin includes bth ZENwrks Mbile Management traffic and ActiveSync server traffic that is prxied by the ZENwrks Mbile Management server. T further secure the Web/Http server, yu can lck dwn the virtual directries except fr User Self Administratin Prtal pages, ZENwrks Mbile Management dashbard pages, and pages accessed by the mbile devices. Fr a list f the PHP pages that need t be left pen, cntact Nvell Technical Supprt. Cnnectins t the ZENwrks Mbile Management server made by users might als include: Administrative access frm surces either inside r utside the Internal Private Netwrk via the Webbased ZENwrks Mbile Management Dashbard t a ZENwrks Mbile Management server. Desktp r mbile access frm surces either inside r utside the Internal Private Netwrk via the Web-based ZENwrks Mbile Management User Self Administratin Prtal t a ZENwrks Mbile Management server. These cnnectins can als be secured using SSL r TLS. All data-in-mtin can be secured using the SSL r TLS prtcls. The device side has SSL and the server side has the ptins f SSL r TLS (the server autmatically negtiates the best ptin, and hence uses TLS mst f the time). Implementatin Guidelines: Device-t-Server Data Transmissin Security Enable SSL fr Device- t- Web/Http server cmmunicatin. Install an SSL certificate n the server where the ZENwrks Mbile Management Web/HTTP cmpnent resides and enable SSL (r TLS) in IIS. Use the Require SSL ptin thrugh IIS and instruct users t enrll with SSL enabled r enable it in the device settings. ZENwrks Mbile Management 2.6.x System Security Guide ZENwrks Mbile Management System Security 9
Device Security ZENwrks Mbile Management device security implements practive features that can help deter security breaches. It als includes reactive security ptins that can be implemented when a device is lst r stlen and therefre mre vulnerable t a breach. This sectin highlights ZENwrks Mbile Management s cre device security features. Practive Device Security Optins Device Data-at-Rest Encryptin Data-at-rest encryptin n the device strage disk is supprted by several device types and can be enfrced thrugh the ZENwrks Mbile Management Plicy Suite. Andrid with TuchDwn Encrypts TuchDwn data (email, calendar, cntacts, tasks) nly Versins 7.x and higher AES 256-bit Andrid (Native) devices - OS versin 3.0; manufacturer/mdel dependent fr OS versins less than 3.0 AES 128-bit BlackBerry (with NtifySync fr BlackBerry) encrypts the NtifySync email Secure (AES 128-bit) Mre Secure (AES 192-bit) Mst Secure (AES 256-bit) ios Devices AES 256 bit ios4 (3GS and 4) and ios5 devices have hardware encryptin that is always enabled. The ActiveSync plicy is nt used t enable/disable. Symbian S60 3 rd editin devices 256 bit Windws Mbile 6.1 and 6.5 AES 128-bit Windws Phne 7 This device des nt currently supprt Data-at-Rest encryptin. Device Rules: Lck Rules Inactivity Timeut BlackBerry(with NtifySync fr BlackBerry), iphne/ ipd tuch/ ipad, Windws Mbile, Symbian, Andrid Native, Andrid with TuchDwn, and Windws Phne 7 platfrms The maximum inactivity timeut can be enfrced by the server and an interval that des nt exceed this maximum can be set n the device. Challenge Timeut BlackBerry (with NtifySync fr BlackBerry) The ZENwrks Mbile Management Challenge Timeut lck is initiated regardless f inactivity and is intended t challenge the use f the device if it is lst r stlen. It must be greater than the Inactivity Timeut. iphne/ ipd tuch/ ipad, Windws Mbile, Symbian, Andrid Native Andrid with TuchDwn, and Windws Phne 7 platfrms Nt supprted Duress Ntificatin ZENwrks Mbile Management 2.6.x System Security Guide ZENwrks Mbile Management System Security 10
BlackBerry (with NtifySync fr BlackBerry) If enabled, this ptin allws the user t activate the duress ntificatin if he/she is frced t unlck the device under duress by entering the passwrd in an altered frmat (shift all characters t the left). Fr example: If lck passwrd is guarddg, the duress passwrd is uarddgg. A high pririty email ntificatin is sent t the specified email address with the Subject: ZENwrks Mbile Management Duress Ntificatin. The ntificatin is cmpletely hidden frm view. It des nt appear in the Outbx, Sent Items, r Deleted Items flders. iphne/ ipd tuch/ ipad, Windws Mbile, Symbian, Andrid Native Andrid with TuchDwn, and Windws Phne 7 platfrms Nt supprted Device Rules: Passwrd Rules Device Passwrd Expiratin BlackBerry (with NtifySync fr BlackBerry), ios Device, Windws Mbile, Andrid Native (sme mdels), Andrid with TuchDwn, and Windws Phne 7 Platfrms If enabled, user is prmpted t create a new passwrd after a specified number f days. When the passwrd expires, the device lcks. The user must unlck it with the current passwrd and then create a new passwrd at the prmpt. Symbian S60 3 Devices Nt supprted Device Passwrd Histry BlackBerry (with NtifySync fr BlackBerry), ios Device, Windws Mbile, Andrid Native (sme mdels), Andrid with TuchDwn, and Windws Phne 7 Platfrms If enabled, this feature prevents users frm reusing passwrds t sn. On BlackBerry (with NtifySync fr BlackBerry), ios, Windws Mbile, and Windws Phne 7 devices, the server can enfrce the number f passwrds a device shuld stre (1 t 50). Fr example, if the number f stred passwrds is 10, yu cannt use the past ten passwrds. When yu create the eleventh passwrd, the ldest stred passwrd becmes available fr use again. Symbian S60 3 Devices Nt supprted Reactive Device Security Optins ZENwrks Mbile Management supprts remte WIPE and LOCK executins and lcal (device) WIPE executins (where applicable). Remte WIPE and LOCK are cntrlled via the ZENwrks Mbile Management dashbard and wrk when wireless is n. Full Wipe Administratrs r end users can issue a Full Wipe cmmand. Functinality varies by device. Andrid with native ActiveSync accunt (requires OS v2.2 r greater) The device returns t factry settings. This entails deleting all data and applicatins frm the device. The device returns t the state it was in when purchased. The SD card is nt erased. Andrid with TuchDwn (requires OS v2.2 r greater) The device returns t factry settings. This entails deleting all data and applicatins frm the device. The device returns t the state it was in when purchased. This des nt erase the SD card. When the Clean SD card n Remte Wipe ptin in the TuchDwn Advanced Settings is enabled, the SD card is cmpletely erased. Andrid w/tuchdwn using OS v2.0 r 2.1 - Yu can use Selective Wipe because Full Wipe is nt available. BlackBerry (with NtifySync fr BlackBerry) - Remves the ZENwrks Mbile Management accunt and lcks the device if Require Passwrd is enabled. It als erases the entire SD card, including saved attachments. ZENwrks Mbile Management 2.6.x System Security Guide ZENwrks Mbile Management System Security 11
ios - Deletes all data and applicatins frm the device. The device returns t the state it was in when purchased (factry settings). Symbian - Deletes all data and applicatins frm the device. The device returns t the state it was in when purchased (factry settings). Sme mdels (N95 and 6120c) wipe nly Mail fr Exchange data. This als erases the SD card. WM - Deletes all data and applicatins frm the device. The device returns t the state it was in when purchased (factry settings). This erases the SD card nly n Prfessinal devices. WebOS and WP7 - Deletes all data and applicatins frm the device. The device returns t the state it was in when purchased (factry settings). Selective Wipe Administratrs r end users can issue a selective wipe cmmand. Functinality varies by device. Andrid w/ native ActiveSync accunt (requires OS v2.2 r greater) - Remves the ZENwrks Mbile Management accunt infrmatin. Andrid w/ TuchDwn (using any supprted OS) - Remves all mail and PIM (calendar, cntact, tasks) data assciated with the TuchDwn applicatin and returns TuchDwn t a pre-registratin state. It erases TuchDwn data frm the SD card and remves the ZENwrks Mbile Management accunt infrmatin. When the Clean SD card n Remte Wipe ptin in the TuchDwn Advanced Settings is enabled, the SD card is cmpletely erased. BlackBerry (with NtifySync fr BlackBerry) - Remves all mail and PIM data assciated with ZENwrks Mbile Management and lcks the device if Require Passwrd is enabled. ios - Remves all mail and PIM (calendar and cntacts) data cntrlled by ZENwrks Mbile Management. Cmmand is applied immediately; hwever, device is capable f pstpning the actin. Symbian - Remves the ZENwrks Mbile Management accunt infrmatin. Lck Device Administratrs r end users can remtely lck the device, requiring an unlck passwrd t be entered befre the device can be used. Andrid and Andrid with TuchDwn (OS 2.2 r greater), BlackBerry (with NtifySync fr BlackBerry), ios, and Windws Mbile supprt this plicy. Symbian S60 3 and Windws Phne 7 devices Nt supprted. Wipe Strage Card Administratrs r end users can remtely wipe all data frm the device s strage card. This is supprted fr Andrid, BlackBerry (with NtifySync fr BlackBerry) and Windws Mbile platfrms. ZENwrks Mbile Management 2.6.x System Security Guide ZENwrks Mbile Management System Security 12
Implementatin Guidelines: Preventing Device Breaches The ZENwrks Mbile Management dashbard is cnsidered the main pint f cntrl and security enfrcement. Frm here, administratrs can ensure that security is being ptimally maintained thrugh cntinuus mnitring f the cnnected user devices. All administrative actins indicated in the Device Security sectin f this dcument can be executed thrugh this dashbard. ZENwrks Mbile Management prvides a number f preventative plicy settings designed t avert security breaches with regard t mbile devices. Lck, passwrd, and encryptin rules are enfrced frm the Organizatin: Plicy Suites view f the ZENwrks Mbile Management dashbard. Plicy Suite: Security Settings ZENwrks Mbile Management 2.6.x System Security Guide ZENwrks Mbile Management System Security 13
Wipe and Lck cmmands are issued frm the Users tab n the ZENwrks Mbile Management Dashbard. Users might als issue the cmmands via the User Self Administratin Prtal. User Detail Panel Desktp User Self Administratin Prtal ZENwrks Mbile Management 2.6.x System Security Guide ZENwrks Mbile Management System Security 14