- [Instructor] In the last video,
you learned how you can configure the security settings
on an individual mobile device
to meet an organization's security requirements.
If you try to do that for every single device
in your organization,
you'll be facing a formidable challenge.
That's where mobile device management
technology comes into play.
Mobile device management, or MDM solutions,
provide organizations with an easy way
to manage the security settings
on many mobile devices simultaneously.
It's similar to the way that you might use Active Directory
to manage the settings on many Windows computer systems.
Administrators may create and enforce policies across groups
of devices from a central console
without requiring access to multiple devices.
MDM also allows administrators
to perform device configuration management,
preventing end users from disabling
the security settings on their devices in a way
that overrides the organization's security policies.
For example, you can use MDM to require
that devices be protected
with an alphanumeric passcode
or that they use encrypted backups.
You can also disable unused device features
to increase the device's security profile.
MDM provides administrators with control
over the data stored on devices as well.
It allows remote wiping of lost or stolen devices,
as well as revoking user access
to a device on the fly.
These are especially helpful when an employee loses a device
or leaves the organization without notice.
Administrators may disable the use
of removable storage on devices
to prevent the removal of sensitive information.
One of the most important features
of mobile device management is application control.
Administrators may specify the applications
that users may install on mobile devices
using either a blacklist or whitelist approach.
In the blacklist approach,
administrators identify specific prohibited applications
and users may install any applications
that are not on the blacklist.
In the whitelist approach, on the other hand,
administrators identify the applications that are allowed
and all other applications are prohibited.
Some mobile device management solutions also allow
the segmentation of storage,
providing a secure, encrypted portion of the device
for use with sensitive organization data
while allowing users unrestricted access
to the remainder of the device for personal use.
There are many different mobile device management
products on the market.
Let's take a look at one, Google Mobile Management.
Here we are on the Networks page
of Google Mobile Management.
I'm going to go ahead and click on Wi-Fi
and then Add Wi-Fi,
and let's go ahead and set up a Wi-Fi network
for use on our mobile devices.
We're going to call this the Corporate Network,
and if our network uses the SSID of COMPANY,
we can go ahead and also tell it the security type
and use on that network.
Let's say we're using WPA2 Encryption with a passphrase,
and I'll go ahead and type in that passphrase
and we'll call it notsecure
because we should always use a very complex passphrase,
if not enterprise authentication on our wireless networks.
We can go ahead and then and set all sorts
of different settings about this wireless network.
If there's a proxy in use,
which types of devices may access it,
and then, whether we're going to apply it
by user or by device,
depending upon how we'd like this network
to be rolled out across all of our mobile devices.
All I have to do then is go ahead
and click the Add button and save this policy,
and over the next few hours,
this Wi-Fi setting will be pushed out across all
of our mobile devices.
This is a really convenient way
to add Wi-Fi networks to devices
without having users entering passcodes
or configuring authentication,
and when you make changes,
you can just push those changes out
and have them automatically applied
to wireless devices across your enterprise.
Now let's take a look at some
of the more detailed device configuration settings
on the Mobile Management screen.
From this screen, I can perform many different functions
including blocking and wiping devices,
activating new devices,
and controlling security settings.
Let's go here into Device Management settings
and take a look at some of the things that we can do.
We have the ability to control which types
of synchronization may be used
and on what platforms we enforce security policies.
We can require passwords and choose
that we want to make those strong passwords,
and specify all the different passwords settings
that you'd expect.
The minimum number of characters,
how often passwords need to be changed.
If a device is locked after a period of inactivity,
whether encryption is required on the device,
if the user may activate the remote wipe functionality.
There's really a lot of different security settings
here within Google Mobile Management
that we can apply to Android, Chrome, and iOS devices.
Now, I'm going to go back to this Mobile Management screen
without saving any of those settings
and let's say I want to manage the applications
that can be used on iOS devices.
Let's take a look at how this application
control actually works.
We're going to go ahead and click on the applications
that are whitelisted for use
and you can see, Google's already defaulted
to allowing some of these different Google applications,
but let's say I also want to allow users
to watch movies while they're traveling,
so I want to add Netflix.
I can go ahead and click Add Application here,
and as you can see,
I'm given this Whitelist iOS App screen
and I can just type in the name
of an iOS application.
We'll type Netflix and click Search,
and then I choose the correct Netflix application
and click Whitelist.
And in just a moment here,
Netflix appears down on the bottom of the whitelist
and can be used across all of my devices.
That's how application control works
in an iOS environment using Google Mobile Management.
Mobile device management is a powerful tool
that allows security professionals
to ensure that all devices used
with an organization's data have security settings in place
that match the organization's security policy.