mobile device management
TRANSCRIPT
1/26/16
1
Mobile+Device+Management:
A+look+from+inside+out+with+case+studies
MEHMET+AKİF +ACAR,+MDM+ADMIN+&+IOS +DEVELOPER
TURKISH+PETROLEUM+CORPORATION
Email+ :[email protected]:[email protected]:++90+533+6304079Work:++90+312+2073557
MDM:+A+look+From+Inside+Out
• Information+ about+my+company+and+job+ responsibilities
• Concepts,+Definitions+ and+Assumptions
• Mobile+Device+Enrollment
• Controlling+Mobile+Devices
• Handling+ Data+Roaming
• Deployment+of+In]house+and+App]store+Apps
• The+Role+of+MDM+Admin
1/26/16
2
Turkish+Petroleum+Corporation+(T.P.A.O)
TPAO+is+a+national+oil+company+involved+in+merely+upstream+sector.
TPAO+has+four+core+activities+in+the+oil+sector:
• Exploration,+Drilling,+Production+ and+Well+
Completion.
• Natural+Gas+Storage
• Participation+to+Oil+and+Natural+Gas+Pipeline+
Projects.
My+job+responsibil ities• Manage,+support,+troubleshoot,+maintain+and+optimize+mobile+device+management+solution+
currently+while+making+suggestions+and+adjustments+to+future+needs
• Assist+end+users+via+telephone,+email+or+at+place+with+a+wide+range+of+questions+and+problems+with+
their+iOS devices+and+connectivity+needs
• Monitor+and+track+incident+calls;+recognize+high+priority++situations+and+take+action+within+the+
expected+response+time+through+technicians+or+by+myself
• Train+end+users+as+well+as+technicians+on+iOS device+technology
• Assisting,+training+and+setup+of+district+Apple+ID’s.
• Building,+updating+and+publishing+in]house+apps
• Setting+up+VPN+to+Apple+Devices
• Setting+up+mobile+intranet+site+to+Apple+Devices
• Searching+and+choosing+necessary+App]store+apps+and+presenting+them+in+custom+App]Store• AND+MUCH+MORE…..
1/26/16
3
Concepts,+Definitions+and+Assumptions
• Mobile'Device'Management'(MDM):+Systems+that+typically+deploy+apps+over+the+air,+setup+email,+VPN+and+other+corporate+systems+configuration+automatically,+wipe+or+locks+lost+devices+and+controls+device+utilities+such+as+camera+or+data+roaming.+The+primary+challenge+is+the+ability+to+manage+the+risks+associated+with+mobile+access+to+enterprise+data+while+securing+company+issued+and+BYOD+mobile+devices.
• Bring'your'own'device'(BYOD):+Allow+employees+to+use+their+self]owned+devices+in+their+daily+work+flows+such+as+access+ to+email+inbox+and+corporate+Wi]Fi+network.
• In7house'applications:+Application+that+have+been+written+internally+by+company+personnel.+These+ applications+does+not+exist+in+App]store+rather+they+should+be+tested+and+deployed+by+other+systems.
• Data'roaming:+It+refers+to+the+continued+data+service+you+get+when+you+go+outside+of+your+mobile+operator+coverage+area.+To+illustrate,+you+can+get+email+through+cellular+data+in+a+country+other+than+your+home+country+if+data+roaming+enabled.
Concepts,+Definitions+and+Assumptions
• Virtual'Private'Network'(VPN):+It+is+a+network+that+uses+internet,+to+provide+remote+offices+or+individual+access+to+their+company’s+network.+For+example,+by+VPN+you+can+access+ your+corporate+data+securely+using+a+coffee’s+Wi]Fi+network.
• On+premise+software:+It+is+the+software+that+is+installed+and+run+on+computers+on+the+premises+of+company+using+the+software,+rather+than+a+remote+facility+such+as+cloud+systems
I+assume+ that+by+saying+
• Mobile+devices,+I+refer+to+iPhone+and+iPads.• Wi]Fi,+I+refer+to+corporate+Wi]Fi+network.• Public+Wi]Fi,+I+refer+to+any+Wi]Fi+network+other+than+corporate.• Cellular+data,+I+refer+to+a+situation+that+I+am+out+of+office+and+have+access+to+internet+
through+3G+or+4G+network+but+not+corporate+Wi]Fi.
1/26/16
4
Mobile+Device+Enrollment• Mobile+Device+Enrollment+is+in+fact+the+end+of+a+process+called+Provisioning.+
• Mobile+Device+Provisioning+is+the+one+of+Mobile+IT+Challenges.
Network Access Control Data
security
Device+Provisioning
Mobile+IT+ChallengesIs+it+safe+ device?+Could+I+give+
access+rights+to+Wi]Fi?+By+jail+broken+iPhone++or+
android+device,+you+can+use+it+as+an+access+point+to+
break+into+private+computer+networks+and+gain+info+about+network+structure.
Is+it+safe+ to+get+and+read+emails+on+
mobile+device?+The+company+emails+may+be+shared+all+over+the+
world
Does+it+conform+company+policies?
How+can+we+verify+it?+Allow+BYOD?
Mobile+Device+EnrollmentOur+MDM+story+begins+in+late+2011+after+mass+deployment+ of+iPhone+4+to+heads+of+departments+ and+executives.
Main+challenges+were;
• Contact+ transfer,+exchange+ email+configuration,+ iOSupdates
• Obtaining+Apple+ID++and+App+store’+apps+deployment
• Mobile+access+to+ERP+application+and+intranet+site
• Microsoft+Lync mobile+integration
1/26/16
5
MDM+SolutionsSo+we+searched+ and+tested+some+MDM+solutions+ +(the+only+requirement+is+proof+ of+concept)
+ Reseller+exist.
] Not+Good+Remote+Assistance.
] On+premise+MDM+trial+deployment+is+carried+by+reseller+failed.
Tested+ in+April+ 2012
++Reseller+exist.
] Not+Good+Remote+Assistance.
] On+premise+MDM+trial+deployment+is+carried+by+reseller+failed.
Tested+ in+March+ 2012
++Mobile+enrollment+test+in+their+hosted+environment+is+successful.++Good+remote+assistance] On+premise+MDM+trial+deployment+couldn’t+be+done+(financial+reason)+at+that+times.+Now+it+is+completely+free+of+charge.] No+reseller+exist+in+Turkey+at+2011.+But+now+many…
Tested+ in+December+ 2011+
++On+premise+MDM+trial+deployment+is+carried+by+remote+assistance+and+ended+successfully.
++Mobile+provisioning+test+is+successful.
++Good+Remote+Assistance
] Reseller+not+exist.
Tested+ in+April+ 2012
Gartner+MDM+Report+May+2012 1. The+‘entry+criteria’+for+the+Magic+Quadrant:+It+is+not+enough+to+be+on+the+edge+of+the+mobile++technology,+the+MDM+‘vendor’+needs+to+sell+and+deliver++a+minimum+number+of+seats.
1. Established+technology+providers+don’t+perform+same+ level+as+the+new+MDM+vendors+although+they+have+advantage+in+terms+of+market+coverage.+So,+MDM+is+not+an+add]on+to+an+existing+platform,+MDM'is'a'new'discipline'in'IT,+it+requires+skills+and+technology.
1. Customers+are+now+providing+feedback+to+Gartner,+before+that+Gartner+was+asking+MDM+vendors+about+customer+care.
1. The+leaders+are+Airwatch,+MobileIron &+Zenprise.
MDM+Solutions
1/26/16
6
MDM+SolutionsGartner+MDM+Report+May+2013
1. MobileIron and AirWatch are+still+leaders+and+Citrix+bought+a+seat+at+the+table+with+the+acquisition+of+ZenPrise.
2. SilverbackMDM is+not+in+the+quadrant+anymore.
1. Vmwarewould+buy+Airwatch for+1.54+billion+dolars according+to+the+news+published+in+Jan+22+2014.
Mobile+Device+EnrollmentFor+secure+and+simple+device+enrolment;
• End+users+should+ not+be+required+to+download+and+configure+ a+client+from+a+public+ app+store+as+part+of+the+enrolment+ process.
• Must+not+expose+Active+Directory+during+ provisioning+process.
• Must+not+require+SCEP+(Simple+Certificate+Enrolment+Protocol).
• Must+not+require+end+ user+to+enter+corporate+ credentials+on+an+untrusted+ device+until+it+has+been+inspected.
• Ability+to+limit+enrolment+to+authorized+ devices+only,+e.g.+by+serial+number+or+IMEI+number,+OS+version+or+hardware+model.
• Simple+self+service+provisioning+for+end+users+with+the+option+ for+Administrators+to+provision+a+device+on+behalf+of+an+end+ user.
1/26/16
7
Controlling+Mobile+Devices
By+controlling+mobile+devices,+we+mean+
• Application+Blacklist
• Enable+URL+filtering
• Enforcing+Passcode
• Enforcing+restrictions
• Wi]Fi+access+control
• Deciding+which+app+uses+VPN
• Control+ Exchange+ActiveSync+Settings
Application+Blacklist
Blacklist+apps+are+applications+that+violates+company+ policies+so+we+deemed+as+apps+that+are+not+ allowed+or+are+unsafe+for+use+on+mobile+devices.+
In+Oil+&+Gas+sector,+ the+information+related+with+any+company+departments+is+critical+therefore+shouldn’t+ be+exposed+ to+cloud+systems+like+Dropboxor+Skydrive
By+using+MDM,+you+can+aware of++download+of+such+apps+and+take+preemptive+actions.
1/26/16
8
Application+Blacklist
Dropbox name+is+added+ to+Application+Blacklist.
No+Action:+Just+Alert+MDM+AdminLock:+Turn+mobile+device+to+lock+screen.Block:+Remove+enterprise+data+and+email+but+MDM+profile+not+deleted.Wipe:+Complete+deletion+of+enterprise+info.
Enable+URL+FilteringSo+if+end+ user+try+to+access+dropbox from+Safari+(internet+browser),+then+we+block+access+to+the+URL+of+dropbox by+web+content+ filtering+property+ of+MDM
The+urlhttps://www.dropbox.comis+added+to+blacklisted+URL+list.
1/26/16
9
Enable+URL+FilteringSo+if+end+ user+try+to+access+dropbox from+Safari+(internet+browser),+then+we+block+access+to+the+URL+of+dropbox by+web+content+ filtering+property+ of+MDM
As+a+result;The+end+ user+can+not+access+dropbox from+safari.
Enforcing+PasscodeBy+using+MDM,+we+can+enforce+usage+of+passcode having+specific+properties.
Increase+min+length+ of+passcode
Decrease+the+max+number+of+failed+attempts
Force+them+to+change+their+passcode+at+least+4+times+a+year
1/26/16
10
Enforcing+Restrictions
It+is+important+to+control+mobile+device+functions+ remotely.+iOSalready+gives+user+right+to+restrict+some+functions+but+with+MDM+you+can+do+much+more.+!
Enforcing+RestrictionsConsidering+ security+requirements+of+Oil+&+Gas+sector,+ through+MDM+following+restrictions+should+ be+applied:
• Disallow+iCloud Backup,+iCloud Document+Sync+and+iCloud Key+Value+Sync
• Disallow+Untrusted+SSL+certificates
• Force+Encrypted+iTunes+Backup
• Disallow+Diagnostic+Data+to+be+Sent+to+Apple
• Disallow+Cloud+Keychain+Syn
• Disallow+configuration+ profile+installation
• Force+Safari+for+Fraud+Warning+
1/26/16
11
MDM+Restriction+configuration+ can+also+be+configured+ according+ to+your+specific+needs
Enforcing+Restrictions
You+can+take+screenshot+ of+your+iPhone+screen+by+pressing+buttons.
By+MDM,+you+can+restrict+Screen+capture+
MDM+Restriction+configuration+ can+also+be+configured+ according+ to+your+specific+needs
Enforcing+Restrictions
I+use+this+restriction+ for+prevention+of+screen+capture+of+our+in]house+application+that+shows+daily+geographical+reports+on+mobile+devices.
So,+it+becomes+difficult+to+share+the+graphical+reports+with+email+or+any+cloud+ solution.+
Daily+Geographical+ Report+System+Mobile+App
1/26/16
12
Wi]Fi+Access+NetworkWi]Fi+network+access+control+could+ be+put+into+practice+by+using+MDM.
MDM+can+enforce+end+user+to+enter+their+credentialsto+access+Wi]Fi+network.
Wi]Fi+Access+NetworkWi]Fi+network+access+control+could+ be+put+into+practice+by+using+MDM.
MDM+pre]populate+Wi]Fi+settings+on+mobile+devices+
on+behalf+of+user+so+network+password+is+not+shared+among+end+users.
1/26/16
13
Deciding+which+apps+use+VPN
In+our+sector+it+is+a+necessity+to+limit+the+amount+of+intranet+services+exposed+ to+public+internet+for+security+concerns.+ So+how+can+an+in]house+ app+connect+ to+the+company+intranet+resources+if+the+end]user+is+out+of+office?
Internet Intranet
Well+Log+Reports+Server
VPN'TUNNEL
Deciding+which+apps+use+VPN
By+using+VPN,+mobile+devices+could+access+company+ resources+from+internet.
Internet Intranet
Well+Log+Reports+Server
VPN'TUNNEL
1/26/16
14
Deciding+which+apps+use+VPN
How+can+we+set+up+remotely+VPN+configuration+ on+mobile+devices?+
• MDM+has+the+ability+to+send+VPN+settings+to+the+desired+mobile+devices.
• MDM+administrators+can+define+VPN+settings+that+are+only+to+be+accessed+by+certain+applications+with+the+introduction+ of+iOS 7.
• VPN+access+rights+can+be+remotely+changed+on+mobile+devices.+
Control+Exchange+Active+Sync+Settings
Automatic+email+configuration+ on+mobile+device+is+a+must+since+manual+configuration+of+many+devices+is+waste+of+time.
Through+MDM+you+can;
• Automatically+push+exchange+ActiveSync+account+settings
• Configure+Period+ of+mail+to+synchronize+ to+the+device.+
• Enforce+to+use+SSL+if+the+external+mail+server+is+protected+ by+an+SSL+certificate.
1/26/16
15
Control+Exchange+Active+Sync+SettingsUsing+MDM,+additional+ exchange+ active+sync+policies+could+be+enforced+ for+enhanced+ security+
Prevents+the+user+to+move+corporate+ email+messages+to+different+
mailboxes.
Prevents+the+user+from+using+this+email+
account+ in+third+party+apps+to+forward+
content.
Handling+Data+RoamingOil+&+Gas+Company+Executives+and+operational+engineers+frequently+trip+abroad.+Using+foreign+cellular+data+network+results+in+too+much+cost.
Source:+thisismoney.co.uk and+which.co.uk 2012.
Watch'2'music'videos
Upload'10'
photos
Write' two'emails'
daily'for'14'days
Left'on'standby'for'24'hours
With+T]Mobile,+three+days+trip+data+roaming+
costs:+(Assume+ email+only)Nearly+63'poundor+240'turkish lira
1/26/16
16
Handling+Data+RoamingBy+using+MDM,+we+can+aware+of+whether+mobile+device+executes+data+roaming+or+not.
We+can+determine+the+end+user+using+reporting+ services+of+MDM.
Handling+Data+RoamingBy+using+MDM,+we+can+aware+of+whether+mobile+device+executes+data+roaming+or+not.
One+iPhone+data+roams+in+Kazakhstan!
1/26/16
17
Handling+Data+Roaming
In+fact+we+can+configure+behavior+of+MDM+in+case+of+data+roaming;
• No+actions+is+performed.
• Lock:+Mobile+device+screen+is+locked.
• Block:+The+device+is+moved+to+the+blocked+state.
• Wipe:+Hard+reset+to+factory+settings.
• Re]Apply:+Disable+data+roaming.
Handling+Data+Roaming
In+fact+we+can+configure+behavior+of+MDM+in+case+of+data+roaming;
Alerting+Administrator:+Emails+are+sent+to+admins+notifying+them+about+breaking+data+roaming+policy.+And+give+information+about+ end+user.
1/26/16
18
Deployment+of+In]house+and+App]store+Apps
First+of+all,+in+order+ to+distribute+your+in]house+application+to+mobile+devices,+you+need+to+enroll+iOS Developer+Enterprise+Program.
iOS Developer+Enterprise+Program
It+is+not+easy+to+enroll+the+Enterprise+Program.+Time+consuming+ and+requires+victim.
It+requires+D.U.N.S+number.
Enrolling+employee+must+have+binding+ authority+to+enter+into+contracts.
The+enrolling+ employee+becomes+Team+Agent.
Legal+contact+ at+your+company+to+verify+enrolling+employee+&+their+binding+authority.
Have+to+pay+the+price+(299+dollars+for+one+year)+by+credit+card.
Budget+ at+least+30+days+for+enrollment.
1/26/16
19
Apple+Developer+Enterprise+Certificate
Apple Developer Enterprise Certificate
Develop+in]House+Apps+and+Test
Apple'Push'Notification'servers
MDM'server
Provide+communication+between+MDM+and+mobile+device.
Distribute+in]House+Apps
Deployment+of+In]house+AppsWith+the+acquisition+of+the+certificate,+we+can+distribute+ in]house+apps+through+MDM+using+direct+push+installation+or+company+App+market.
Direct+Push+Installation+includes+several+steps;
• In]house+app+is+added+to+MDM+system+via+its+App+Portal
• Tag+page+is+created+for+the+in]house+app
• The+End+User’s+mobile+device+is+added+to+the+Tag
MDM+sends+the+app+via+push+notification.+ If+the+end+user+accepted+ the+download+request,+the+app+is+downloaded+ to+the+mobile+device.
1/26/16
20
Deployment+of+App]store+Apps
Deployment+of+App]store+Apps+can+be+done+ by+Company+App+Market+that+is+created+by+MDM.
App+market+consists+of+a+list+of+enterprise+and+App]store+applications.+
Deployment+of+App]store+Apps
Our+company+App+market+(TP+MARKET)+was+loaded+automatically+into+the+mobile+devices+with+the+completion+ of+the+enrolment+procedure.
It++currently+includes+two+in]house+apps+and+many+carefully+chosen+App]Store+apps..
1/26/16
21
Deployment+of+App]store+Apps+through+App+market
In+our+App+market+there+are+couple+of+apps+that+were+chosen+from+App]store+and+can+be+installed+by+users+manually+within+the+app+market.
App+information+is+given+along+with+the+installation+option.
Using+MDM+restrictions+you+can+restrict+access+to+App]Store+and+only+allow+users+to+download+from+your+App]market.
Deployment+of+in]House+Apps+through+App+market
End+users+can+download+in]house+apps+within+the+App+market+by+themselves+manually.
Through+MDM,+you+can+give+right+to+download+ to+the+designated+ end+user’s+app+market.
1/26/16
22
The+role+of+MDM+Admin
MDM'ADMIN
HardwareSupport
Providing'and'
Maintaining'security
Software'Support
What+really+matters+is+THE'USER'EXPERIENCE
