ALTIRIS SECURITY SOLUTION 6.1 FOR HANDHELDS ADMINISTRATOR GUIDE

Transcription

1 ALTIRIS SECURITY SOLUTION 6.1 FOR HANDHELDS ADMINISTRATOR GUIDE

2 Notice Copyright 2004 Altiris Inc. All rights reserved. Product Version: 6.1 Document Date: October 14, 2004 Bootworks U.S. Patent No. 5,764,593. RapiDeploy U.S. Patent No. 6,144,992. Recovery Solution U.S. Patent No. 5,778,395, 5,907,672, , , , , , , , GB , B , Other patents pending. Due to the inherently complex nature of computer software, Altiris does not warrant that the Altiris software is error-free, will operate without interruption, is compatible with all equipment and software configurations, or will otherwise meet your needs. The content of this documentation is furnished for informational use only, is subject to change without notice, and should not be construed as a commitment by Altiris. Altiris Inc. assumes no responsibility or liability for any errors or inaccuracies that may appear in this documentation. For the latest documentation, visit our Web site at Altiris, the Altiris logo, BootWorks, Inventory Solution, LabExpert, PC Transplant, RapiDeploy, and RapidInstall are registered trademarks of Altiris, Inc. in the United States. Carbon Copy is a registered trademark licensed to Altiris, Inc. in the United States and a trademark of Altiris, Inc. in other countries. Altiris express, Altiris Protect, Application Management Solution, Application Metering Solution, Asset Control Solution, Asset Management Suite, Client Management Suite, Compliance Toolkit, Connector Solution, Conflict Analysis Solution, Contract Management Solution, Deployment Server, Deployment Solution, Energy Saver Toolkit, Education Management Suite, Helpdesk Solution Software, Lab Management Suite, Migration Toolkit, Mobile Client for SMS, Monitor Solution, Notification Server, Patch Management Solution, Problem Management Suite, Recovery Solution, Server Management Suite, Site Monitor Solution, Software Delivery Solution, TCO Management Solution, UNIX Client for SMS, Web Administrator for SMS, Web Reports, and other product names are trademarks of Altiris, Inc. in the United States and other countries. Microsoft, Windows, and the Windows logo are trademarks, or registered trademarks of Microsoft Corporation in the United States and/or other countries. HP and Compaq are registered trademarks of the Hewlett-Packard Corporation. Dell is a registered trademark of Dell Inc. Macintosh is a registered trademark of the Apple Computer Corporation. Palm OS is a registered trademark of Palm Computing, Inc. BlackBerry is a service mark and a trademark of Research In Motion Limited Corporation. RIM is a service mark and trademark of Research In Motion (RIM) All other brand names are trademarks or registered trademarks of their respective companies. Altiris Security Solution 6.1 for Handhelds Administrator Guide 2

3 Contents Notice Chapter 1: Introduction Chapter 2: Installing Altiris Security Solution for Handhelds Installing Altiris Security Solution for Handhelds on the Notification Server Licensing Chapter 3: Altiris Security Solution for Handhelds Policy Editor Installing the Policy Editor Customizing Security Policies Group Info Tab Password Tab General Tab PalmOS Tab PocketPC Tab RIM Tab Saving Policy Files Chapter 4: Using Altiris Security Solution for Handhelds Configuration Administrator Setup Installing Altiris Security Solution for Handhelds on Pocket PC Handhelds Updating Security Policy for Pocket PC Handhelds Discovering RIM Host Computers Without Security Solution Installed Installing Altiris Security Solution for Handhelds on RIM Handhelds Deploying Security Policy to RIM Handhelds Tasks Pocket PC Tasks RIM Tasks Packages Pocket PC Packages RIM Packages Collections Reports Uninstalling Altiris Security Solution for Handhelds from Pocket PC Handhelds Uninstalling Altiris Security Solution from RIM Host Computers Uninstalling Altiris Security Solution for Handhelds from RIM Handhelds Uninstalling Altiris Security Solution for Handhelds Altiris Security Solution 6.1 for Handhelds Administrator Guide 3

4 Contents Chapter 5: Frequently Asked Questions Index Altiris Security Solution 6.1 for Handhelds Administrator Guide 4

5 Chapter 1: Introduction Altiris Security Solution for Handhelds is the industry standard for handheld data security. It provides multi-layered security for Palm, Pocket PC, and RIM handhelds ensuring corporate information is secure once it leaves the corporate walls. Altiris Security Solution for Handhelds eliminates the most significant security risks associated with deploying handhelds by providing security tools to strengthen user authentication, encrypt data on the handheld, and erase important corporate data if a handheld is deemed lost or stolen. Altiris Security Solution for Handhelds combined with Altiris Inventory Solution for Handhelds and Altiris Software Delivery Solution for Handhelds provides a complete set of management tools for you to Get a Grip on your handhelds. Altiris Security Solution for Handhelds is on-device security, offering flexible options to define and enforce security policies for the growing number of handheld users. A high level of data integrity is achieved with the three-tiered system of security: password policy enforcement, strong industry standard data encryption and fail-safe bitwiping. The Altiris Security Solution for Handhelds Policy Editor is provided so that you can centrally control and tailor the configuration and management of security policies to the requirements of distinct end user collections. For example, administrators are given the option of encrypting all or selected databases or allowing only approved applications to launch. Brute Force attacks can be prevented by automatically launching Altiris Bitwipe technology to wipe databases, applications or folders upon too many unsuccessful password attempts. The solution also allows you to encrypt data stored on external storage cards or on virtual volumes within internal device memory. Notes: This release of Altiris Security Solution for Handhelds only supports Pocket PC and RIM handhelds. Altiris will soon update the solution to include Palm OS support and it will be available from the Altiris Solution Center. A separate end user reference guide is included with Altiris Security Solution for Handhelds. This end user guide provides instructions to help end users work with the solution on their handheld. The information in the end user guide can be copied and customized into a help guide that you may wish to build and distribute for your specific implementation of the solution. Altiris Security Solution 6.1 for Handhelds Administrator Guide 5

6 Chapter 2: Installing Altiris Security Solution for Handhelds This chapter provides information on installing and licensing Altiris Security Solution for Handhelds on the Notification Server. This chapter also explains the installation of Altiris Security Solution for Handhelds on Pocket PC and RIM handhelds, and their prerequisites. Prerequisites Altiris Security Solution for Handhelds is designed to work with Notification Server. We recommend that you use the most current release of Notification Server 6.0. For more information on installing the Notification Server, see Setup and Installation in the Altiris Notification Server Help. Pocket PC Handhelds Altiris Security Solution for Handhelds supports most handhelds based on the Pocket PC 2002 and Windows Mobile 2003 operating systems. An administrator Pocket PC handheld that has the typical applications and databases found on end user handhelds is required to configure proper policy settings. A Windows based computer with Microsoft ActiveSync installed and a partnership with the administrator Pocket PC handheld to import policy template data. The Altiris Pocket PC Agent must be installed on all Pocket PC handhelds that are to be protected with the solution. The Altiris Security Solution for Handhelds and the security policy files are distributed to end user handhelds through this agent. The solution requires that the administrator first configure an administrator Pocket PC handheld that has the typical applications and databases that end users have on their handhelds. The solution provides the Altiris Security Solution for Handhelds Policy Editor to help you define security policies for your organization. The Policy Editor requires Microsoft ActiveSync to read the applications and databases on the administrator Pocket PC handheld. These applications and databases make up your policy template data that can then be customized with the editor to suit your organizations needs. It is not necessary to install the Policy Editor on the Notification Server. Instructions are contained within this guide that explains how to copy the Policy Editor executable to a separate Windows desktop/laptop for security policy configurations. Note: Microsoft ActiveSync is available as a free download from windowsmobile/resources/downloads/pocketpc/activesync37.mspx. RIM Handhelds Altiris Security Solution for Handhelds is compatible with RIM 850, 857, 950, and 957 handhelds. RIM Desktop Manager and the Altiris Windows Notification Server Agent installed on end users desktops and laptops synchronizes with the RIM handheld. For more information on the Windows Notification Server Agent installation, see Altiris Notification Server Help. RIM handheld software version 2.6 or greater provided by your RIM re-seller must have been installed on the end users RIM handheld through the host computer that will receive the installation files. Discovery policies exist within the solution to help administrators determine if this requirement has been met. Note: RIM Desktop and Handheld software are available for download from products/software/index.shtml. Altiris Security Solution 6.1 for Handhelds Administrator Guide 6

7 Chapter 2: Installing Altiris Security Solution for Handhelds Installing Altiris Security Solution for Handhelds on the It is recommended that you first install Inventory Solution for RIM Blackberry from Altiris on the RIM handheld before installing Altiris Security Solution for Handhelds. For more information on installation of Inventory Solution on RIM Blackberry, see Inventory Solution For RIM Blackberry Product Guide. No administrator handheld is required to configure RIM security policies. Altiris Security Solution for Handhelds must be installed on the RIM handheld prior to sending customized policy files. Policy files that are sent prior to installing Altiris Security Solution for Handhelds will not be processed. Important Items Before You Begin It is recommended that you first configure and test Altiris Security Solution for Handhelds in a controlled environment prior to rolling out to end users. This ensures that all settings have been verified and no undesirable settings have been enabled that would restrict the end user from operating their handheld. The Policy Editor requires that you set up an administrator password. Please ensure that the password you set up will not be used by an end user. Having the same password for both the administrator and end user will cause the solution to work incorrectly. Note: The following are end user handheld options that are end user configured only. The end user can access the following settings on their handheld: Pocket PC Decrypt PIM databases after unlock. Personal Information Management (PIM) databases are decrypted "on-the-fly." When the user requests for access to a PIM application, the database will decrypt to allow access. Users can enable the Decrypt PIM databases after unlock setting and all PIM databases are decrypted upon unlocking the handheld. End users may not delete any of the administrator's selections for wipe or encryption of databases and folders, but end users can add to the administrator's selections of databases and folders to wipe or encrypt. RIM Clear Memory option wipes unallocated memory. The standard RIM OS does not wipe unallocated memory and vital information may still be available on the handheld even after deletion. Clear Memory allows the end user to wipe these unallocated memory bits. End user is required to set the handheld wipe password. The wipe password is different from the authentication password. The wipe password can be enabled by the end user. If the wipe password is entered, Altiris Security Solution for Handhelds immediately wipes databases that have been selected for wiping. Installing Altiris Security Solution for Handhelds on the Notification Server You can install Altiris Security Solution for Handhelds on the Notification Server using the Altiris Console. To install the Altiris Security Solution for Handhelds 1 Click Start > Programs > Altiris > Altiris Console. 2 On the Altiris Console, click the Configuration tab. 3 On the treeview pane, click Configuration > Solutions Settings > Upgrade/Install Additional Solutions. 4 On the content pane, click the Available Solutions tab, and then click Solutions. 5 From the list of solutions, select Security Solution for Handhelds. The Solution Update screen appears. 6 On the Solution Update screen, click Start to begin the solution download. Altiris Security Solution 6.1 for Handhelds Administrator Guide 7

8 Chapter 2: Installing Altiris Security Solution for Handhelds Licensing When the download completes, on the content pane, click the Currently Installed tab. Here, you can view all the solutions that you have installed. Licensing Each Altiris product comes with a 10-day trial license that is installed by default. You can register and obtain a 30-day evaluation license through our web site at or purchase a full product license. The trial license installed on the handheld is valid for 15 days. To apply your product license within the Altiris Console, navigate to Configuration > Licensing > Install License. Browse to the folder that you saved your license file to or copy and paste the contents of the license in the pane provided. Select Install License to apply the settings. Navigate to the License Status tab and select Refresh to view the updated status. A registration key is required on end user handhelds to register the application. On the Altiris Console, click the Configuration tab. Navigate to Configuration > Solutions Settings > Security Solution for Handhelds > Security Solution for Handhelds - Security Policy Configuration. The registration key number is displayed on the content pane of Altiris Security Solution for Handhelds page in the License Key box. There is a single registration key number applicable to all handhelds regardless of operating system. The registration number found in the License Key box should be typed in the Policy Editor application when defining security policies. This registration number is sent to end user handhelds as part of the security policy and registers the end user s handheld as a valid application user. Altiris Security Solution 6.1 for Handhelds Administrator Guide 8

9 Chapter 3: Altiris Security Solution for Handhelds Policy Editor The Altiris Security Solution for Handhelds Policy Editor allows you to customize settings for the installation of Altiris Security Solution for Handhelds on end user handhelds. This includes features such as, auto lock, bomb functionality, and database encryption. Altiris Security Solution for Handhelds Policy Editor supports multiple policy configurations or groups. You can specify different policy settings for each group of end users, simplifying the entire policy management process. Quick Links Installing the Policy Editor (page 9) Customizing Security Policies (page 10) Saving Policy Files (page 22) Installing the Policy Editor Use the Policy Editor to create new policies and modify them. The policies can be customized to suit the security requirement of the organization. For more information on customizing policies, see Customizing Security Policies on page 10. For Pocket PC protection, the solution requires that the administrator first configures an administrator Pocket PC handheld that has the typical applications and databases that end users have on their handhelds. The solution provides the Policy Editor to help you define security policies for your organization. The Policy Editor requires the use of Microsoft ActiveSync to read the applications and databases on the administrator Pocket PC handheld. It is not necessary that the Policy Editor be installed on the Notification Server. Instructions below explain how to copy the Policy Editor executable to a separate Windows desktop or laptop for security policy configurations. For RIM protection, no administrator handheld is required to configure security policies. However, it is recommended that you test your policies on an administrator handheld prior to rolling out the policy in production environment. To install the Policy Editor on a Windows computer 1 Locate the AltirisSecuritySolutionPolicyEditor.exe in the C: > Program Files > Altiris > Security Solution for Handhelds > Admin folder on the Notification Server. 2 Copy the executable file to the desktop computer that syncs with the administrator handheld. 3 Run the executable file. Note: The Policy Editor executable file is not recommended to be executed on the Notification Server. 4 After the installation is complete, click Start > Programs > Altiris > Solutions > Handheld Management Suite > Altiris Security Solution > Altiris Security Solution for Handhelds Policy Editor to launch the Policy Editor. Altiris Security Solution 6.1 for Handhelds Administrator Guide 9

10 Chapter 3: Altiris Security Solution for Handhelds Policy Editor Customizing Security Policies Customizing Security Policies Create a custom policy that fit the requirements of your organization by altering the security settings. The different sections of the Policy Editor program are described below: Group Info Tab (page 10) Password Tab (page 10) General Tab (page 12) PocketPC Tab (page 16) RIM Tab (page 20) Group Info Tab Use the Group Info tab to specify details about the new group, such as end users who receive the set of policy files. You can create a group for each handheld type, and then policy for each group. You can differentiate groups depending on types of handhelds. This helps in creating customized policies for each type of handheld. Notes: You should not use the same security policy for all the handhelds. The following items in the Group Info tab are not sent to end user handhelds as part of the policy settings. Group Info Tab Options Feature Description Group Name Displays the group name. To change the Group Name, left-click the group name in the left pane under the Groups folder. Description Helps distinguish one group s settings from another. You can enter the description in the Description box. Password Tab Use the Password tab to configure the administrator password settings. You can also set password rules for end user handhelds in this section. Setting the Administrator Password For Altiris Security Solution for Handhelds to function properly it is required that you first set an administrator password. The administrator password is also required to uninstall the solution from the end user handhelds. In this section you can set or modify the administrator password, and set password rules for end users. You first need to install the Policy Editor. For more information in installation of Policy Editor, see Installing the Policy Editor on page 9. To set the Administrator password 1 Open the Altiris Security Solution for Handhelds Policy Editor. Note: If you are launching the Policy Editor for the first time, you see a New Group window. 2 Click Groups on the left pane, and then click the New Group icon. 3 Type a name for this new Group in the Name box. 4 Type the administrator password in the Password box. 5 Re-type the administrator password in the Confirm Password box. 6 Click OK. Altiris Security Solution 6.1 for Handhelds Administrator Guide 10

11 Chapter 3: Altiris Security Solution for Handhelds Policy Editor Customizing Security Policies To change the Administrator password 1 Open the Altiris Security Solution for Handhelds Policy Editor. 2 Select the Group for which you need to change the password. 3 In the Password tab, type the new administrator password in the Password box. 4 Re-type the administrator password in the Confirm Password box. 5 Type the old password in the Old Password box. 6 Re-type the old administrator password in the Verify Old Password box. 7 Click OK. Important: Please ensure that the password you choose will not be used by an end user. Having the same password for both the administrator and end user will cause the solution to work incorrectly. Password Tab Options Feature Password Administration Password Verify password Old password Verify old password Password history length Description The items in this section are for password administration. Used to enter the new administrator password. Note: When you initially create a new Group, you are prompted to set up an administrator password; however, you may change the administrator password later. Used to confirm the administrator password. Used to enter the old administrator password. Used to confirm the old administrator password. Used to track end users passwords to ensure that they do not repeatedly use the same password. Create unlock password End User Password Rules Minimum password length Requires both letters and digits By increasing the password history length, you can set a number of passwords for Altiris Security Solution for Handhelds to remember. With a setting of 1, Altiris Security Solution for Handhelds remembers the end user s current password, so that they cannot use it twice in a row. Setting this option to 2 makes the Altiris Security Solution for Handhelds remember the current and previous password, and setting this option to 3 will remember the current password as well as the prior two, and so on. Used to create a temporary unlock password, which is valid for 60 minutes. The temporary unlock password is used when an end user has forgotten their password. The temporary unlock password is unique for a given handheld, its time and date, and the user group it has been assigned to. For instructions on how to generate a temporary unlock password, see To generate a temporary unlock password on page 12. You can control the password rules governing the end user's password. This password is used to access the handheld. These rules include minimum password length, alphanumeric requirement, and password expiration. Select the appropriate check box for the options that you require. Used to enforce a minimum password length. The minimum length for the password is decided by the value selected from the drop-down list. Used to enforce that both letters and digits are required in the end user s password. Altiris Security Solution 6.1 for Handhelds Administrator Guide 11

12 Chapter 3: Altiris Security Solution for Handhelds Policy Editor Customizing Security Policies Password Tab Options Feature Change password after Disable use buttons to enter password To generate a temporary unlock password For Pocket PC handheld, before generating the temporary unlock password, the end user needs to tap the button marked ID on the main lockout screen of their Pocket PC handheld, note the ID number, and give the ID number to the administrator. For RIM handheld, before generating the temporary unlock password, the end user needs to type REMOTECODE in the Password box of their RIM handheld, retrieve their device ID, and give the device ID number to the administrator. 1 Open the Policy Editor, and click the Password tab. 2 Click Create unlock password. This displays Unlock Password dialog box. 3 Type the ID Number generated by the end user handheld in the Device ID box. 4 Set the time and date for which the password will begin to be effective. 5 Click OK. Note: The time for which the temporary unlock password is valid relates to the end user s handheld time, and not the workstation time from which the temporary unlock password is generated. You should consider time zones when generating unlock passwords for end users. 6 Ensure that the end user enters the generated temporary password in their handheld. 7 The end user is then asked to reset their handheld password. General Tab Description Use the General tab to define the activation, bomb, user, lockdown, and other properties. The various sections of the General tab are explained in the following tables. Activation section Used to prompt the end user to change their password after a specific amount of time. The time period is decided by the value selected from the drop-down list. Note: Both 12 months and 1 year are shown as available options. Use 12 months instead of 1 year. Disables the use of hardware buttons to enter end user password for the handheld. Use the Activation section to activate settings to lock the handheld when turned off completely or after being turned off for a specified time. Altiris Security Solution 6.1 for Handhelds Administrator Guide 12

13 Chapter 3: Altiris Security Solution for Handhelds Policy Editor Customizing Security Policies Activation Section Options Element Description Auto lock on power Used to set Altiris Security Solution for Handhelds to automatically lock the off (on timeout for handheld when it is turned off, or optionally, after the handheld has been RIM handhelds) turned off for a specified amount of time. If off more than x minutes User Can Override You can choose to allow end users to control most settings on the client handheld by enabling this option. Selecting the check box next to this setting enables this feature on the client s handheld. Selecting the User Can Override check box allows the end user to modify the initial settings for the designated options. Clearing the User Can Override check box prevents the end user from changing the initial settings for the corresponding option. Note: It is recommended that you do not enable the User Can Override setting for RIM handhelds. Enabling this setting allows the end user to disable enforcement of password protection. Used to automatically lock the handheld when it has been turned off for a specified amount of time. Bomb section User Can Override Selecting the User Can Override check box allows the end user to modify the initial settings for the designated options. Clearing the User Can Override check box prevents the end user from changing the initial settings for the corresponding option. Note: For RIM handhelds this setting controls how long the default timeout is set at. Selecting User Can Override allows the end user to change the default timeout values to meet their specific requirements. Altiris Security Solution for Handhelds protects against brute force password attacks with data bitwipe functionality, or the bomb. You can set security policies such as wipe data after x failed logon attempts or wipe data if not synchronized in x days. If the bomb is triggered, then all data flagged for bitwiping is completely erased; not only is the data erased, it is also overwritten to ensure that it cannot be recovered. Altiris Security Solution 6.1 for Handhelds Administrator Guide 13

14 Chapter 3: Altiris Security Solution for Handhelds Policy Editor Customizing Security Policies Bomb Section Options Element Attempts limit Description Used to allow Altiris Security Solution for Handhelds to either activate the bitwiping process, or lockout the end user if a specified number of incorrect passwords are entered in the lockout screen. Method Bitwipe storage card if bomb is triggered If not synced (with end users host PC) User Can Override Selecting the User Can Override check box allows the end user to modify the initial settings for the designated options. Clearing the User Can Override check box prevents the end user from changing the initial settings for the corresponding option. Used to select the method of data protection. Wipe This method initiates the bitwiping process on selected databases and folders when the attempts limit has been met. Lockout This method permanently locks the handheld when the attempts limit has been met. The end user's password no longer allows access to their handheld and they are required to contact the administrator to generate a temporary unlock password using the temporary unlock utility. Used to destroy the contents of any storage card connected to the handheld when the bomb is triggered. The bomb triggers due to one of the following reasons: When the end user exceeds the number of log on attempts than the number specified in the settings. When the end user enters a wipe password in the lockout screen. If the handheld has not synced with the host computer within the time specified in the security policy. If an immediate bitwipe policy is sent. Used to activate the data protection bitwiping process if the handheld has not synced within a specified amount of time (specified in days and hours) with the end users host computer. Note: The administrator selects databases and folders that are erased if the bomb is triggered. User section User Can Override Selecting the User Can Override check box allows the end user to modify the initial settings for the designated options. Clearing the User Can Override check box prevents the end user from changing the initial settings for the corresponding option. Use the User section to set whether information about the owner of the handheld is displayed on the lockout screen. These settings are explained below. Altiris Security Solution 6.1 for Handhelds Administrator Guide 14

15 Chapter 3: Altiris Security Solution for Handhelds Policy Editor Customizing Security Policies User Section Options Element Show user information Description Used to display the information listed in the handheld s owner information on the lockout screen. User Can Override Selecting the User Can Override check box allows the end user to modify the initial settings for the designated options. Clearing the User Can Override check box prevents the end user from changing the initial settings for the corresponding option. Note: The end user should only enter their Owner Information in the handheld s Owner Information section. They should not enable Show Owner Information when the device is turned on through the default device owner settings. Altiris Security Solution will show the Owner Information automatically upon startup. If the default handheld Show Owner Information upon startup setting is enabled, Altiris Security Solution will work to minimize this window upon start up and will cause a delay before the user can use the handheld. Lockdown Communications section Use the Lockdown Communication section to prevent the end user from using IrDA, WiFi and Bluetooth, and Speaker/Microphone. The various settings involved in this section are explained below. Lockdown Communications Options Element IrDA (Infrared Beaming) Description Prevents end users handhelds from receiving or sending data via the infrared (IrDA) port. Selecting the IrDA check box disables infrared beaming. Clearing the check box to enables IrDA. WiFi and Bluetooth Prevents end users handhelds from receiving or sending WiFi and Bluetooth wireless signals. Selecting the WiFi and Bluetooth check box disables WiFi and Bluetooth. Clearing the check box enables wireless communication. Speaker/ Microphone Note: Both Bluetooth and WiFi are disabled. There is no option to enable any one of the two. Disables the ability of recording and playing back of sounds on the end user s handheld. Immediate Security Actions section Use the Immediate Security Actions section to immediately lock the handheld, immediately bitwipe, and force encrypted memory card use, when inserted into the handheld. The various options in this section are explained below. Immediate Security Actions Options Element Lock the handheld immediately Description Locks the handheld immediately upon uploading the new policy to the handheld. Altiris Security Solution 6.1 for Handhelds Administrator Guide 15

16 Chapter 3: Altiris Security Solution for Handhelds Policy Editor Customizing Security Policies Immediate Security Actions Options Element Immediate bitwipe Force encrypted memory card use PalmOS Tab Description Use the PalmOS tab to customize the settings specific to Altiris Security Solution for Handhelds for the Palm operating system. This tab is further divided into several sections. Note: Although the Policy Editor includes a Palm OS tab, this release of Security Solution for Handhelds does not yet support security policies for Palm operating system handhelds. Palm OS support will be coming shortly and will be available from the Altiris Solution Center when released. PocketPC Tab Bitwipes selected data upon uploading the new policy file to the handheld. Enable this option to require that any memory cards inserted into the handheld are formatted with a password protected encrypted volume, before the memory card can be read from or written to. Note: Be careful while using this option as it requires end users to format their memory card upon initial insertion, and completely wipes all the data from the card. When this option is enforced, end users are shown a warning upon card insertion indicating that their memory card will be formatted and all previous data erased. If they select not to proceed with the format, the memory card will not be available. Use the PocketPC tab to customize the settings that are specific to Altiris Security Solution for Handhelds for Pocket PC handhelds. The administrator Pocket PC handheld is used in this section to configure security policies for end user Pocket PC handhelds. You must have the administrator Pocket PC handheld connected to the computer via ActiveSync that is running the Policy Editor at the time of data import. The administrator Pocket PC handheld is one that has all of the standard applications and databases that your end users have on their handhelds. You also must first install the Altiris Security Solution for Handhelds on the administrator Pocket PC handheld prior to importing template information. Failure to do so results in unexpected errors. For more information, see Configuration on page 23. Importing Template Information There are several buttons on the Pocket PC tab, such as, Encrypted Databases, Encrypted Folders, Protected Applications, Approved Applications, Wiped Databases, and Wiped Folders. Clicking these buttons opens new dialog boxes that display the contents on the handheld currently connected to the computer via Microsoft ActiveSync. Each dialog box has a button labeled Import. To import template information Click Import. Use this button to begin importing template information from the connected handheld. Note: You must have the administrator Pocket PC handheld connected to the computer, via ActiveSync, that is, running the Policy Editor at the time of data import. You also must first install the Altiris Security Solution for Handhelds on the administrator Pocket PC handheld prior to importing template information. Failure to do so results in unexpected errors. For more information, see Configuration on page 23. If you do not wish to use the features "Protected Applications" or "Approved Applications" it is recommended that you keep these boxes clear and do not import applications from the handheld within these sections Altiris Security Solution 6.1 for Handhelds Administrator Guide 16

17 Chapter 3: Altiris Security Solution for Handhelds Policy Editor Customizing Security Policies Encryption section For Pocket PC handheld users, there is an option to modify the encryption settings. Encryption Section Options Element Description Algorithm Allows you to set which encryption algorithm to use when encrypting files and databases on the Pocket PC handheld. The three options available for encryption algorithm are: None Encryption Algorithm is not applicable. Fast This is a proprietary encryption algorithm that is relatively fast. This option offers good security for the time needed to encrypt data. Strong This is a stronger form of encryption that takes longer than Fast. This option is offered in 128-bit and 512-bit Blowfish versions, as well as 128-bit and 256- bit AES versions. Lock on reset Auto Encrypt New Databases User Can Override Selecting the User Can Override check box allows the end user to modify the initial settings for the designated options. Clearing the User Can Override check box prevents the end user from changing the initial settings for the corresponding option. Activates the Altiris Security Solution for Handhelds Lock if the Pocket PC handheld is reset. User Can Override Selecting the User Can Override check box allows the end user to modify the initial settings for the designated options. Clearing the User Can Override check box prevents the end user from changing the initial settings for the corresponding option. Automatically encrypts new databases. Select this check box to activate this feature. Note: Automatically encrypting new databases can cause some applications to quit responding or not work at all. Encrypted Databases User Can Override Selecting the User Can Override check box allows the end user to modify the initial settings for the designated options. Clearing the User Can Override check box prevents the end user from changing the initial settings for the corresponding option. Altiris Security Solution for Handhelds allows you to administer the selection of databases that are encrypted on the end user s Pocket PC handheld. To encrypt Pocket PC databases 1 Open the Altiris Security Solution for Handhelds Policy Editor. 2 Click the Pocket PC tab. 3 Click Encrypted databases. 4 Initiate the ActiveSync session, then click Import. Altiris Security Solution 6.1 for Handhelds Administrator Guide 17

18 Chapter 3: Altiris Security Solution for Handhelds Policy Editor Customizing Security Policies This imports all the existing Pocket PC handheld databases to the open dialog box. 5 Select the check box against the database that you want to protect for encryption. Clear the check box to prevent the associated database from being encrypted. 6 Click OK. Note: This is an optional procedure for customizing the databases for encryption beyond the standard Personal Information Manager (PIM) databases. If you do not want to import any information, there is a standard list of PIM databases to use. Encrypted Folders Altiris Security Solution for Handhelds allows you to administer the selection of folders that are encrypted on the end user s Pocket PC handheld. To encrypt folders 1 Open the Altiris Security Solution for Handhelds Policy Editor. 2 Click the Pocket PC tab. 3 Click Encrypted folders. 4 Initiate ActiveSync session, then click Import. This imports all the existing Pocket PC handheld folders to the open dialog box. 5 Select the check box against folders that you want to protect for encryption. Clear the check box to prevent the associated database from being encrypted. 6 Click OK. Notes: This is an optional procedure to customize the folders for encrypting beyond the standard folders list. If you do not want to import any information, there is a standard list of folders to use. It is not recommended that you encrypt the Windows, Temp, Connection Manager or Documents and Settings folders on Pocket PC handhelds. Protected Applications Altiris Security Solution for Handhelds allows you to administer the selection of applications on the end user s Pocket PC handheld that are protected with a password (the end user is prompted for their handheld password before the selected applications can run). This feature is typically used when organizations deploy specific applications to end users that contain company data. If an end user handheld is compromised prior to the handheld being locked, this setting prevents the protected application from being launched if a valid password is not entered. To protect applications 1 Open the Altiris Security Solution for Handhelds Policy Editor. 2 Click the Pocket PC tab. 3 Click Protected applications. 4 Initiate ActiveSync session, then click Import. This imports all the existing Pocket PC handheld applications to the open dialog box. 5 Select the check box against the applications that you want to prompt for password protection. Clear the check box to prevent the associated application from being prompted for password protection. 6 Click OK. Notes: This is an optional procedure to customize the applications that require application launch protection. If you do not wish to use this feature it is recommended that you clear the protected Altiris Security Solution 6.1 for Handhelds Administrator Guide 18

19 Chapter 3: Altiris Security Solution for Handhelds Policy Editor Customizing Security Policies applications box and do not import applications from the handheld. Use the Clear setting if you have mistakenly imported applications. Certain types of applications can be missing from the protected applications list even after performing an import. To add an application to this list, use the Pocket PC handheld s default File Explorer to create a shortcut to the hidden application s.exe file within the My Device\Windows\Start menu folder. Import the application list into the Policy Editor once again to allow launch protection of the newly added applications. Approved Applications Altiris Security Solution for Handhelds allows you to administer the selection of applications that Pocket PC end users are allowed to launch. To approve applications 1 Open the Altiris Security Solution for Handhelds Policy Editor. 2 Click the Pocket PC tab. 3 Click Approved applications. 4 Initiate ActiveSync session, then click Import. This imports all the existing Pocket PC handheld applications to the open dialog box. 5 Select the check box against the application for approval or clear the check box to prevent the associated application from being allowed to launch. Notes: Any application that does not appear in the Approved application list is not allowed to launch. Do not import applications if you do not want to enforce this option. Use the Clear setting if you have mistakenly imported applications. The standard PIM applications are always approved for launch, regardless of the settings specified in this dialog box. Certain type of applications can be missing from the Approved applications list even after performing an import action. To add an application to this list, use the Pocket PC handheld s default File Explorer to create a shortcut to the hidden application s.exe file within the My Device\Windows\Start menu folder. Import the application list into the Policy Editor once again to allow approval for these applications. Wiped Databases Altiris Security Solution for Handhelds allows you to select the databases to be deleted if the bomb is triggered on end users Pocket PC handheld. Altiris Security Solution for Handhelds protects against brute force password attacks with data bitwipe functionality, or the bomb. You can set security policies such as wipe data after x failed logon attempts or wipe data if not synchronized in x days. If the bomb is triggered, then all the data flagged for bitwiping is completely erased (wiped); not only is the data erased, it is also overwritten to ensure that it cannot be recovered. To wipe databases 1 Open the Altiris Security Solution for Handhelds Policy Editor. 2 Click the Pocket PC tab. 3 Click Wiped databases. 4 Initiate ActiveSync session, then click Import. This imports all the existing Pocket PC handheld databases to the open dialog box. 5 Select the check box against the database to mark it for deletion when the bomb is triggered. Clear the check box to prevent the deletion of the associated database when the bomb is triggered. Altiris Security Solution 6.1 for Handhelds Administrator Guide 19

20 Chapter 3: Altiris Security Solution for Handhelds Policy Editor Customizing Security Policies Note: This is an optional procedure to customize the databases for wiping when the bitwiping bomb is triggered. If you do not want to import any databases, there is a standard list of PIM databases that you can use. Wiped Folders Altiris Security Solution for Handhelds allows you to select the folders to be deleted if the bomb is triggered on end users Pocket PC handhelds. Altiris Security Solution for Handhelds protects against brute force password attacks with data bitwipe functionality, or the bomb. You can set security policies such as wipe data after x failed logon attempts or wipe data if not synchronized in x days. If the bomb is triggered, then all the data flagged for bitwiping is completely erased (wiped); not only is the data erased, it is also overwritten to ensure that it cannot be recovered. To wipe folders 1 Open the Altiris Security Solution for Handhelds Policy Editor. 2 Click the Pocket PC tab. 3 Click Wiped folders. 4 Initiate ActiveSync session, then click Import. This imports all the existing Pocket PC handheld folders to the open dialog box. 5 Select the check box against the folder to mark it for deletion when the bomb is triggered. Clear the check box to prevent the deletion of the associated folder when the bomb is triggered Note: This is an optional procedure to customize the folders for bitwiping when the bomb is triggered. If you do not want to import any folders, there is a standard list of folders to use. License Number Enter the license key provided to you when you purchased Altiris Security Solution for Handhelds. For more information on locating your license key, see Licensing on page 8. The license key is then transferred via the policy file to the end user s handheld. This is to ensure that all end user handhelds are registered when you distribute your policy files to them. RIM Tab Use the RIM tab to customize settings that are specific to Altiris Security Solution for Handhelds for RIM handhelds. Encryption Altiris Security Solution for Handhelds provides options to select the type of encryption to be used on end users RIM handhelds. To select the type of encryption 1 Open the Altiris Security Solution for Handhelds Policy Editor. 2 Click the RIM tab. 3 Select the encryption type, Fast or Strong, from the drop-down list. 4 Select User Can Override to allow the end user to modify the initial settings for the designated options. Clear this check box to prevent the end user from changing the initial settings for the cleared options. Note: We do not recommend enabling User Can Override for this setting. Altiris Security Solution 6.1 for Handhelds Administrator Guide 20

21 Chapter 3: Altiris Security Solution for Handhelds Policy Editor Customizing Security Policies Encryption of Databases Altiris Security Solution for Handhelds provides options to select which databases are encrypted on end users RIM handhelds. To select specific databases for encryption protection 1 Open the Altiris Security Solution for Handhelds Policy Editor. 2 Click the RIM tab. 3 Select the check box against the Encrypt databases options that you want to force encryption on. You can select one or more of the options from Mail, Tasks, Memo, and Address book. 4 Select User Can Override to allow the end user to modify the initial settings for the designated options. Note: We do not recommend enabling User Can Override for this setting. Remote Bitwipe Feature Altiris Security Solution for Handhelds provides the option to immediately bitwipe certain databases remotely on end users RIM handhelds if the handheld is deemed lost or stolen. To remotely bitwipe selected databases 1 Open the Altiris Security Solution for Handhelds Policy Editor. 2 Click the RIM tab. 3 Select the check box for the Destroy selected device contents above option. Make sure that you have selected the check boxes against the databases that you wish to remotely delete. 4 Make sure that your administrator password is correctly typed in the admin password fields in the Password tab. 5 Distribute this policy file using the Sample Security Policy task. For more information, see To deploy policy files to RIM handhelds via on page 28. Notification of Administrator Level Events Altiris Security Solution for Handhelds provides the option to notify the administrator of security policy events for RIM handhelds through . Altiris Security Solution for Handhelds sends an note to the administrator specifying when a policy file has been accepted by an end user handheld. To notify the administrator via 1 Open the Altiris Security Solution for Handhelds Policy Editor. 2 Click the RIM tab. 3 Select the check box against the Notify administrator about security events via . 4 Type the address where you would like to send the notifications, in the box. Note: The administrator does not receive a notification when selecting to remotely destroy selected handheld contents. License Number Enter the license key provided to you when you purchased Altiris Security Solution for Handhelds. For more information on locating your license key, see Licensing on page 8. The license key is then transferred via the policy file to the end users handheld. This is to ensure that all end user handhelds are registered when you distribute your policy files to them. Altiris Security Solution 6.1 for Handhelds Administrator Guide 21