Kaspersky Endpoint Security. AppConfig Technical Capabilities

Transcription

1 Kaspersky Endpoint Security AppConfig Technical Capabilities

2 Introduction The following document describes the technical capabilities and deployment the native mobile Kaspersky Endpoint Security app to devices based on the best practices documented by the AppConfig Community. Reference EMM vendor specific setup documentation available on the AppConfig Community site for details on how to configure each of these capabilities with the EMM vendor of your choice. App Deployment EMM solutions have the capability to deploy native applications that live on the public app stores to devices. Operating systems such as ios, Android, and Windows provide EMM vendors native built-in APIs as part of the MDM Mobile Device Management protocols documented by the operating systems to make this possible. Kaspersky Endpoint Security is available only on Android devices. Using this capability, the Kaspersky Endpoint Security app that is in the public app store can be installed automatically or via a self-service catalog with EMM platforms participating in AppConfig Community. Alternatively, some customers may choose to build a custom app built using the Force.com development platform. In this case, the resulting app will likely be deployed as an internal or in-house app. EMM vendors participating in AppConfig Community have the capability to deploy these types of apps as well. App Configuration For some customers, the first time use of the Kaspersky Endpoint Security application requires the manual configuration of all its settings. EMM vendors participating in AppConfig Community have the ability to auto-configure these settings. The end user no longer has to input these values themselves. Please reference the matrix below for more information. Configuration Key Description Value Type LicenseActivationCode App activation code App activation code consisting of twenty Latin letters and numerals. To activate the app with an activation code, you need Internet access to connect to Kaspersky Lab activation servers. String If you leave the field blank, the app will be activated with a trial license. The trial license is valid for 30 days. When the trial license expires, all features of the Kaspersky Endpoint Security mobile app are disabled. To continue using the app, you must purchase a commercial license. Page 1

3 ScanScheduleType Scan run mode AfterUpdate start a virus scan after a database update. The app updates anti-virus databases according to the defined schedule (UpdateScheduleType). Daily start a virus scan once a day. Configure the scan start time (ScanScheduleTime). Weekly start a virus scan once a week. Select the day of the week to start a virus scan (ScanScheduleDay) and configure the time (ScanScheduleTime). Off autostart of a virus scan is disabled. Irrespective of which value is set, the device user can manually start a virus scan. ScanScheduleDay Day of scan Monday / Tuesday / Wednesday / Thursday / Friday / Saturday / Sunday You can select only one value for this setting. ScanScheduleTime Time of scan The time can be indicated in 24-hour format (for example, 13:00) or 12-hour format (for example, 10:30 P.M.). String ScanScheduleLock configuration of the scan run mode True the user cannot access the virus scan run mode settings within the app settings. False the user can configure the virus scan run mode and, for example, disable autostart of a virus scan. ScanOnlyExecutableFiles Types of files to scan (Virus Scan) AllFiles scan all files. OnlyExecutables scan only executable files. Executable files are files with the APK (ZIP), DEX, and SO extensions. ScanArchives Scan archives with unpacking True the app unpacks archives and scans their contents. False the app scans only the archive files. The app scans only archives with the ZIP (APK) extension. Page 2

4 ScanActionOnThreatFound Action on threat detection (Virus Scan) Quarantine the app puts detected objects in Quarantine. Quarantine stores files as archives, so they cannot harm the device. The Quarantine lets you delete or restore the files that were moved to isolated storage. Delete the app deletes the detected objects. Skip the app leaves the detected objects unchanged. If the detected objects have been skipped, Kaspersky Endpoint Security warns the user about problems in device protection. When there is an attempt to access an object on the device (such as an attempt to copy or open it), the app blocks access to the object. AskUser the app prompts the user to select an action for each detected object: skip, quarantine, or delete. When multiple objects are detected, the user can apply a selected action to all objects. Information about detected threats and the actions taken on them is logged in app reports. ScanLock configuration of scan settings True the following scan settings cannot be accessed by the user in the app settings: the type of files to scan, scanning of archives, and the action to take on a detected threat. False the user can configure scan settings and, for example, select the Skip action for detected threats. ScanAndProtectionAdwareRiskware adware, autodialers, and riskware True the app detects adware and other apps that can be exploited by criminals to harm the user's device or personal data. False the app skips adware and other apps that can be exploited by criminals to harm the user's device or personal data. Page 3

5 ProtectionMode Real-time protection mode Recommended the app scans only new apps once immediately after they have been installed, as well as files from the Downloads folder. Extended the app scans all files that the user opens, modifies, copies, runs and saves on the device. The app also scans new apps and files from the Downloads folder. Disabled Real-time protection is disabled. UseKsnMode Kaspersky Security Network mode Recommended the app exchanges data with Kaspеrsky Security Network (KSN). Kaspersky Endpoint Security uses KSN for realtime protection of the device against threats (Cloud Protection) and the operation of Web Protection on the Internet. Extended the app exchanges data with Kaspеrsky Security Networkand also sends the Virus Laboratory certain performance statistics from Kaspersky Endpoint Security. This information makes it possible to keep track of threats in real time. No personal data is collected, processed, or stored by KSN services. Disabled the app does not use data from Kaspеrsky Security Network. You cannot enable Web Protection (EnableWebFilter). The Cloud Protection component is not available for Anti-Virus. ProtectScanOnlyExecutableFiles Types of files to scan (Real-time Protection) AllFiles scan all files. OnlyExecutables scan only executable files. Executable files are files with the APK (ZIP), DEX, and SO extensions. Page 4

6 ProtectionActionOnThreatFound Action on threat detection (Real-time Protection) Quarantine the app puts detected objects in Quarantine. Quarantine stores files as archives, so they cannot harm the device. The Quarantine lets you delete or restore the files that were moved to isolated storage. Delete the app deletes the detected objects. Skip the app leaves the detected objects unchanged. If the detected objects have been skipped, Kaspersky Endpoint Security warns the user about problems in device protection. When there is an attempt to access an object on the device (such as an attempt to copy or open it), the app blocks access to the object. Information about detected threats and the actions taken on them is logged in app reports. ProtectionLock configuration of real-time protection settings True the following real-time protection settings cannot be accessed by the user in the app settings: real-time protection mode, types of files to scan, and the action to take on a detected threat. False the user can configure real-time protection settings and, for example, select the Skip action for detected threats. UpdateScheduleType Databases update run mode Daily check for new anti-virus databases and download them to devices once a day. Configure the database update start time (UpdateScheduleTime). Weekly check for new anti-virus databases and download them to devices once a week. Select the day of the week to start a database update (UpdateScheduleDay) and configure the time (UpdateScheduleTime). Off automatic update of antivirus databases is disabled. Irrespective of which value is set, the device user can manually start an update of anti-virus databases. Page 5

7 UpdateScheduleDay Day to start a database update Monday / Tuesday / Wednesday / Thursday / Friday / Saturday / Sunday You can select only one value for this setting. UpdateScheduleTime Database update start time The time can be indicated in 24-hour format (for example, 13:00) or 12-hour format (for example, 10:30 P.M.). String UpdateScheduleLock configuration of the database update run mode True the user cannot access the database update run mode settings within the app settings. False the user can configure the database update run mode and, for example, disable autostart of anti-virus database updates. AllowUpdateInRoaming Update databases in roaming True the app downloads anti-virus databases if the device is in the roaming zone. The app downloads anti-virus databases according to the defined schedule (UpdateScheduleType). False the app downloads anti-virus databases only if the device is in the home network. Page 6

8 EnableWebFilter Web Protection True the app uses the Web Protection component to block malicious and phishing websites on the Internet. Web Protection supports Google Chrome only. For the Web Protection component to work, the following conditions must be met: A proxy server is configured in the browser settings: ProxyMode = "fixed_servers" ProxyServer = " :3128" DisableSpdy = true DataCompressionProxyEnabled = false For more details about configuring Google Chrome, visit the Chromium project website. After the Kaspersky Endpoint Security app is removed from the mobile device, reset the proxy server settings. Use of KSN is enabled in the app settings: UseKsnMode = Recommended or UseKsnMode = Extended It is recommended to select Google Chrome as the default browser in the operating system settings. False protection against malicious and phishing websites is disabled. EnableWebFilterLock configuration of Web Protection True the user cannot access Web Protection settings within the app settings. False the user can configure Web Protection settings and, for example, disable protection against malicious and phishing websites on the Internet. UpdateServer Database update source server address Address of the server hosting the database updates, for example, If you leave the field blank, Kaspersky Endpoint Security uses the Kaspersky Lab update servers. String Page 7

9 AllowGoogleAnalytics Submit data to Google Analytics True the app automatically submits Kaspersky Endpoint Security operating data to the Google Analytics service. This data is needed to improve the performance of the app and to analyze user satisfaction. Data is transferred to the Google Analytics services via a secure connection. Access to and protection of data is regulated by the relevant terms of use of the Google Analytics service. False submission of data to the Google Analytics service is disabled. App Tunnel EMM vendors who participate in AppConfig Community have the ability to enable native app tunneling features on supported mobile devices using a protocol called per-app VPN. Many EMM vendors provide customers a built-in per-app VPN or App Tunneling solution as part of the EMM offering, as well as integrate with 3 rd party per-app VPN providers such as Cisco, Palo Alto Networks, F5, and Pulse Secure. Single Sign On Kaspersky Endpoint Security supports delegating the login process to a company s SAML identity provider. EMM vendors participating in AppConfig Community have the ability to auto-deploy the appropriate certificates and credentials to the mobile device to auto-login the user into this SAML identity provider that has been setup. Note: The SAML identity provider that is used must support the native SSO capabilities that are documented in the AppConfig Community. Visit the SSO section of the AppConfig Community dev center for an up to date list of identity providers that have been tested to work successfully with single sign-on. The following SSO protocols are supported in the Kaspersky Endpoint Security app: Certificate based authentication to SAML identity provider Kerberos based authentication to SAML identity provider Kaspersky Endpoint Security supports a variety ofcertificate based authentication approaches, including private and public certs. The App Configuration key/value pairs needed to initiate the SSO process is determined the app integrated with AppConfig using the Kaspersky Endpoint Security for AppConfig service. Page 8

10 Access Control For security reasons, enterprises may want to prevent users from downloading Kaspersky Endpoint Security to their unmanaged or unapproved device. The following approaches of preventing access to the Kaspersky Endpoint Security app on unapproved devices is supported: SAML Identity provider based access control App Config Based Access Control Security Policies Some organizations may require the Kaspersky Endpoint Security app to have more granular security and data loss protection within itself to prevent sensitive data and documents from leaking outside company control. Lastly, EMM can leverage the native OS protocols to wipe and remove all corporate data on the device and uninstall the Kaspersky Endpoint Security app: Native OS Encryption (enforced with device pincode) Managed Open In (Android for Work policy) Copy / Paste Control (Android for Work policy) Screenshot Control (Android for Work policy) Page 9