McAfee MVISION Mobile Threat Detection Android App Product Guide

Transcription

1 McAfee MVISION Mobile Threat Detection Android App Product Guide September 11, 2018

2 COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator, McAfee epo, McAfee EMM, Foundstone, McAfee LiveSafe, McAfee QuickClean, Safe Eyes, McAfee SECURE, SecureOS, McAfee Shredder, SiteAdvisor, McAfee Stinger, True Key, TrustedSource, VirusScan are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. LICENSE INFORMATION License Agreement NOTICE TO ALL USERS: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL TERMS AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU DOWNLOADED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE TERMS SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND. McAfee MVISION Mobile Threat Detection Android Platform Guide

3 Contents Contents Preface... 5 Related Documentation... 5 Audience... 5 Introduction... 6 Detection Engine... 7 Engine Overview... 7 Threat Response Policy/Matrix Updates... 7 McAfee MVISION MTD Application Deployment... 8 Overview... 8 MDM Integration... 8 Without MDM Integration... 8 McAfee MVISION MTD Application Installation... 9 About Initializing McAfee MVISION MTD Application... 9 About VPN Permission Settings... 9 Activation McAfee MVISION MTD Application Functionality About the Dashboard Device Safety Network Safety Apps Safety Application Scanning Package Installer Activity Monitor Danger Zone Network Monitor Full Threat Log Advanced Details Invoking Advanced Details Advanced Details Information McAfee MVISION Mobile Threat Detection Android Platform Guide

4 About Debug Logs Local Device Actions Appendix A Google s Android for Work Implementation with McAfee MVISION MTD Application Overview Supported Configurations McAfee MVISION MTD Application Running in Work and Personal Profiles Appendix B - Site Insight McAfee MVISION Mobile Threat Detection Android Platform Guide

5 Preface This document is a guide for deploying and configuring the McAfee MVISION MTD Application on your Android device. Related Documentation McAfee support documentation is found in the Customer Portal at the following web site: Audience The intended audience for this guide is a McAfee MVISION MTD Application administrator or end user. The McAfee MVISION MTD Application provides threat protection to mobile devices. The system administrator for McAfee MVISION Mobile Console sets policies for threats, and also monitors and manages the detected threats. See McAfee MVISION Mobile Console Configuration Guide for more information. McAfee MVISION Mobile Threat Detection Android Platform Guide

6 Introduction The Android MVISION Mobile Threat Detection application provides continuous detection and remediation of malicious events affecting devices running the Android platform. This is done through real-time forensic data analysis by a machine learning detection engine that is continuously trained as the threat landscape changes. Following Manageability consoles are available to manage and visualize data related to Mobile devices: 1. McAfee MVISION Mobile epo Extension: Go to your epo server and find all data related to Threats and Devices in respective pages under MVISION Mobile. Dashboard page contains the summary of threats, most attacked networks and most attacked users. Detailed information is available in McAfee MVISION Mobile epo Extension Product Guide. 2. McAfee MVISION Mobile Console: Go to this console to make any configuration changes. Administration of the console is further documented in the McAfee MVISION Mobile Console Configuration Guide. While a user can interact with McAfee MVISION Mobile Threat Detection (MTD) App to see current device security status, health and previous events, there is no requirement for any interaction. Remediation can be performed by the Android McAfee MVISIO MTD application as well as through MDM integration with one of the supported MDM vendors. The type of remediation that can be performed is determined by the MDM integration/vendor configured and can range from a simple notification to the user through a wipe of all company data (intellectual property) from the device. This guide provides the following: Details on how the application is deployed How to interact with the application Configuration options that exist from the MVISION Mobile Console Customer documentation can be downloaded from the Customer Portal that details the configuration and use of the MVISION Mobile Console as well as specific MDM integrations. Requirement Minimum Version Android Version Version 4.1 McAfee MVISION Mobile Threat Detection Android Platform Guide

7 Detection Engine Engine Overview McAfee MVISION MTD App includes a combination of behavioral analysis and malware scanning to detect multiple layers of attacks from network and host-based threats without needing any special privileges on the device. A revolutionary cyber-attack detection engine uses statistical models to dynamically detect advanced host and network-based attacks on mobile devices. Unlike other threat detection systems, this engine monitors the whole device for malicious behavior (not just scanning apps) without reliance on signatures. This approach allows us to find and protect against both known and unknown threats in real-time, regardless of how they are delivered to the device. In addition, the malware engine scans for malicious applications installed on the device, and also scans applications prior to being installed on the device to offer continuous protection. Malware scanning is on the device so that malware can be detected, and action can be taken to remove a malicious application even if the device has no network connectivity. If an internet connection is available, McAfee MVISION MTD App performs additional malware scanning analysis against our proprietary database. This database is built using data from labs research team as well as other sources. The behavioral detection engine runs on the device, within the McAfee MVISION MTD application, to detect threats without any need for Internet connectivity or special privileges. This unique approach protects the end user s privacy and prevents excessive battery drain that occurs when data is sent to the cloud. All decisions are made on the device. Each McAfee MVISION MTD application communicates to a central cloud server periodically to confirm that it is running and to see if there are any updates to the policy that need to be incorporated. When McAfee MVISION MTD is initially started, it requests the latest Engine from the back-end server. At this point the latest Threat Response Policy/Matrix (TRM) is also downloaded. The TRM contains rules for what action to take upon certain threats and is the representation of the Policy page in the MVISION Mobile Console for this user. The Android version of McAfee MVISION MTD contacts the cloud server every 15 minutes to signify it is active and passes certain device information. The information passed up to MVISION Mobile Console is configurable per the Privacy template on the MVISION Mobile Console. This provides for a mechanism to track changes on the device. Threat Response Policy/Matrix Updates The TRM can be updated in the following ways: The cloud server sends a Push notification that a new TRM is ready to download. Then McAfee MVISION MTD application retrieves the updated TRM. McAfee MVISION MTD Application polls the cloud server to see if there is an updated TRM available to download. The time interval for this polling is currently configurable by McAfee. The Android McAfee MVISION MTD application provides malicious application detection. McAfee MVISION MTD includes a local database of malware signatures which is used to check for malicious applications in the following modes: McAfee MVISION Mobile Threat Detection Android Platform Guide

8 Manual mode: On the App Safety page, there is a Run Manual Scan button to manually check for malicious applications at any time. If malware is found, an event is sent to the MVISION Mobile Console and an alert displays with an option to uninstall the application. Automatic mode (1): When the user downloads an application from the browser, , or any other client (which saves the file on the SDCARD) McAfee MVISION MTD scans it. McAfee MVISION MTD then alerts the user if the application is malicious before the application is installed and offers a button to delete the malicious application from the device. Automatic mode (2): When a new application is installed McAfee MVISION MTD scans it. If it is malicious, an event is sent to the MVISION Mobile Console and an alert displays with an option to uninstall the application. McAfee MVISION MTD Application Deployment Overview The Android McAfee MVISION MTD application can be deployed using one of two modes. The first mode is with an MDM and the other mode is without an MDM. If a customer has an MDM solution, it is strongly suggested that the MDM be used to distribute the application. These steps are covered in separate MDM Deployment Guides specific to the supported MDM, located in the McAfee Support portal. If no MDM has been implemented, the user can be instructed to download the McAfee MVISION MTD Application from the Google Play Store and install it. When adding the MDM in McAfee MVISION Mobile Console, the administrator can check a box for Android devices that sends a user an for each new device. The contains a McAfee MVISION MTD Application activation link for each new device that is synchronized from the MDM. See McAfee MVISION Mobile Console Configuration Guide for more information. MDM Integration If MDM integration is enabled and McAfee MVISION MTD Application has been pushed to an Android Enterprise device from the MDM, then the device can sometimes be transparently activated. If the Android device is not an Android Enterprise device for instance, then it must be activated by the user with an MDM activation link. In both cases, a device identifier is used to match up with the synchronized device identifier from the MDM. Once a match has been found, then that device is associated with McAfee MVISION MTD Application in the correct McAfee MVISION Mobile Console environment. Without MDM Integration If there is no MDM integration, the device displays the End User License Agreement (EULA). After the agreement is accepted, the activation request page displays. The user activates McAfee MVISION MTD Application with the method provided from the administrator. If SAML authentication is enabled for the domain entered, then McAfee MVISION MTD Application reaches out to the configured SAML server to continue with the authentication. They are then matched up with the environment where the user activation has been defined and activated if the link is valid. McAfee MVISION Mobile Threat Detection Android Platform Guide

9 McAfee MVISION MTD Application Installation About Initializing McAfee MVISION MTD Application When McAfee MVISION MTD Application is pushed down to the device, it must be launched by the user at which point an initial set of installation screens are displayed. The user can do this by tapping the McAfee MVISION MTD Application icon that shows up in the devices application grid. Alternatively, you can start McAfee MVISION MTD Application by using the built-in Android protocol handlers without any configuration required. If a user taps on a link from Chrome, the McAfee MVISION MTD Application starts up and installs. This allows an administrator to send a notification via to users after they have McAfee MVISION MTD Application installed. This notification instructs the user to tap on a link (on their device) to start it up rather than having them find the icon on the device. Upon successful installation and activation, the Dashboard page displays. The figure shows you how the Dashboard page appears. At this point, McAfee MVISION MTD Application is installed and protecting the device. About VPN Permission Settings An administrator has the option to configure McAfee MVISION MTD Application to set up a Virtual Private Network (VPN) connection in response to threats. If this is requested, then during the installation of McAfee MVISION MTD Application, a VPN profile is installed on the device. McAfee MVISION MTD Application has screens to request this permission from the user. These screens guide the user when installing the application or when policies change for the device. Screens prompt the user to allow the VPN configuration. When a Network Sinkhole device action is configured for at least one threat type in the McAfee MVISION Mobile Console Policy page, the user is prompted with the screens in the following figures to indicate acceptance. The VPN permission screens do not display if the administrator did not configure a VPN on the McAfee MVISION Mobile Console. Perform the following steps if prompted for the VPN connection: McAfee MVISION Mobile Threat Detection Android Platform Guide

10 1. McAfee MVISION MTD Application sends push notifications to alert the user, when the administrator configures the application for this protection. Tap Continue to give permission. 2. Tap Continue again to indicate a local VPN can be requested. 3. Tap OK to the device s connection request to allow McAfee MVISION MTD Application to setup the VPN protection. Note: The confirmation screen above is the standard Android message that mentions monitoring of traffic occurs, but no monitoring of network traffic is performed. Activation There are numerous different methods of McAfee MVISION MTD Application activation, and this section describes the alternatives. If MDM integration has been enabled, then the device activation can be transparent. In some MDM integrations, you click an MDM activation link. If there is no MDM integration, the device displays the End User License Agreement (EULA). After the agreement is accepted, the activation request page displays. The user actives in one of the following ways: Clicks on the activation link (URL) Scans a QR code with the camera of the device Enters a domain name The administrator provides the information for activation. Once activated, the device is then matched up with the correct environment for the activation link. For some customers, the activation option exists to enter their domain name, such as example.com on the startup of McAfee MVISION MTD Application. Domain-based activations can be used by customers that McAfee MVISION Mobile Threat Detection Android Platform Guide

11 have an integration with a supported identity provider. If the domain name is known by the McAfee MVISION MTD Application, then activation proceeds using the single sign-on activation flow. Upon successful installation and activation, the Dashboard is displayed. The figures show the activation prompt and the domain entry options. For devices where the administrator wants to use a different activation link on an already activated device, the user must confirm to use the new activation link. The figure shows the confirmation given. McAfee MVISION MTD Application Functionality Users do not need to interact with McAfee MVISION MTD Application for proper detection and prevention of malicious activities. However, users can access McAfee MVISION MTD Application to determine if it is setup correctly, if it has found any malicious activity, and to view recommendations on how to decrease the risk of device attacks. About the Dashboard The Dashboard screen displays after activation. It displays a general status of the device and a status for all threat vectors: Device Network Applications The status YOU ARE PROTECTED is displayed if there are no critical events detected on the device as defined by the Threat Response Policy/Matrix. The green check mark is another status field that indicates no critical events have been detected. Once a critical event is detected, the Dashboard title bar turns orange and changes to a Threat Detected! display. The green check box changes to an orange shield with an arrow pointing down. The dashboard displayed here shows a critical threat detected in the Device category as well as detection of a malicious application. The threats can be viewed by tapping on the Critical Issues link under the text Threat Detected. This takes you to a listing of the critical threats detected. McAfee MVISION Mobile Threat Detection Android Platform Guide

12 The three categories displayed in the Dashboard represent the three possible vectors for threats entering the device. Device, Network and Application. Each category can be tapped to take you to additional details about that category. The current status of the device always shows under the Category name. McAfee MVISION Mobile Threat Detection Android Platform Guide

13 Tapping on the menu option list (three horizontal lines) in the upper corner of the Dashboard takes you to a page with the following: Network Monitor Full Threat Log About McAfee MVISION MTD Application Information about the current version of McAfee MVISION MTD Application can be viewed by tapping on About McAfee MVISION MTD Application. McAfee MVISION Mobile Threat Detection Android Platform Guide

14 Device Safety In the Dashboard, the Device Safety category displays an icon of the device type, the device name along with the status indicated by a green check mark or red X on the icon for the category. Threats that would show up in this category include: Rooted Elevation of Privilege System Tampering Once a critical threat is detected as defined by the Threat Response Policy (or Threat Response Matrix), the Category name changes to Device is Compromised. The icon status is indicated as below: Indicates that none of the critical threats above have been detected on the device. Indicates that one or more critical threats above have been detected on the device. McAfee MVISION Mobile Threat Detection Android Platform Guide

15 Tapping this category takes you to the Device Safety page displayed in the figure. If there are any critical events, the title bar is orange and changes to Monitoring Device. The Device Safety page displays an overview of the device with topics such as vulnerable OS version, compromised or rooted. If any of the detections are set to Yes, then a recommendation can be accessed by tapping the down arrow to get more information on the item. Tap the up arrow to retract the recommendation. Some phones are not able to display the full page due to their size. In this case, the user can scroll the page to view the remaining items. McAfee MVISION Mobile Threat Detection Android Platform Guide

16 The following table defines the description of each item in the Device Details page: Device Detections Description Vulnerable Android The device is running a version of Android known to have vulnerabilities. Version Rooted The device has been rooted and therefore cannot be trusted. Compromised The device has a critical issue. Stagefright Vulnerable The device is vulnerable to Stagefright attacks. BlueBorne Vulnerable The device is vulnerable to the BlueBorne attack, which is executed via the Bluetooth stack. USB Debugging USB Debugging mode is enabled. Developer Mode Developer mode is enabled. 3 rd Party App Store Applications can be installed from anywhere on the Internet. Device Encryption Screen Lock Device Protection The device s disk is encrypted. The device requires a pin or pattern to unlock the screen. There are two available options: DETECTING: McAfee MVISION MTD Application is enabled and detecting malicious events. NOT DETECTING: McAfee MVISION MTD Application is disabled and is not detecting malicious event. It has been disabled from the McAfee MVISION Mobile Console. This is done via the DEVICES page in the McAfee MVISION Mobile Console application. See McAfee MVISION Mobile Console Configuration Guide for more information. McAfee MVISION Mobile Threat Detection Android Platform Guide

17 Network Safety In the Dashboard, the Network Safety category displays the currently connected Wi-Fi SSID. Critical threats that show up in this category include: ARP or ICMP MITM, Fake SSL Certificate, SSL Strip, Rogue Access Point and Traffic Tampering. Once a critical threat is detected as defined by the Threat Response Policy/Matrix, the Category name changes to This Network is not safe!. The icon status is indicated as below: Indicates that none of the critical threats above have been detected on the device. Indicates that one or more critical threats above have been detected on the device. This icon continues to be shown until the device connects to a new network or the current SSID is disconnected. Tapping on this category takes you to the Network Safety page. The figure shows the network safety screen display. An overview of the device network configuration including the device s IP address, as well as the currently connected SSID and its BSSID are displayed. The Network protection entry shows that McAfee MVISION MTD Application is protecting the device. If there are any critical events, the title bar is orange, as shown in the figure, and changes to Threat Detected!. Recommendations for the user to stay safe are displayed as appropriate for the critical event detected. The screen can be scrolled up to see all the information. McAfee MVISION Mobile Threat Detection Android Platform Guide

18 Apps Safety In the Dashboard, the Apps Safety category displays the last known malware scan date and time along with the status indicated by a green check mark or red X on the icon for the category. Threats that would show up in this category include: Malicious App Found. Once a critical threat is detected as defined by the Threat Response Policy/Matrix, the Category name changes to Malicious App Found. The icon status is indicated as below: Indicates that none of the critical threats above have been detected on the device. Indicates that one or more critical threats above have been detected on the device. Tapping on this category takes you to the Apps Safety page shown in the figure. If there are any critical events, the title bar is orange and changes to Threat Detected!. The malicious app is listed by its name and the user is given the recommendation to uninstall the application with a button to tap that uninstalls it. The user is also given the option to delete the malicious APK file that was downloaded to the device to reduce the risk of installing the malicious application again in the future. Application Scanning Android McAfee MVISION MTD Application automatically scans the device for malicious apps when it is first installed. Apps are also scanned upon download and installation. After McAfee MVISION MTD Application has been running, a user can initiate a manual scan at any time. To do this, select RUN MANUAL SCAN. If a malicious application is found, the following screens provides the user with information on the application and a recommendation of what to do about it. McAfee MVISION Mobile Threat Detection Android Platform Guide

19 Package Installer Once McAfee MVISION MTD Application is installed and operational, any requests to install an application are handled by the McAfee MVISION MTD Application Package Installer feature. There is no setting or configuration needed to enable this, McAfee MVISION MTD Application registers itself as a Package Installer on the Android device. When an application is installed, Android asks the user to choose which Package Installer to use. The user should choose McAfee MVISION MTD Application and Always. McAfee MVISION MTD Application then verifies the application is not malicious and installs it on the device. If it is found to be malicious, the screen in the figure alerts the user to delete the file. McAfee MVISION Mobile Threat Detection Android Platform Guide

20 Activity Monitor The Activity Monitor page display statistics regarding security tests performed on the device and threats detected by McAfee MVISION MTD Application over two different time periods, 7 days or 30 days. Any threats detected in the chosen timeframe are displayed numerically. The user can tap on the red right arrow icon to display the log page for the chosen threat vector and view the events in more detail. The right arrow symbol ( > ) has a different meaning depending on the color of the background and is described in the following table. Color Grey Black Red Description: There have not been any events for this vector during this time period. Threats have been detected during this time period, but none are critical. There are critical threats detected during this time period. McAfee MVISION Mobile Threat Detection Android Platform Guide

21 Danger Zone While roaming/traveling, it is common to look and connect to available Wi-Fi networks to access the internet for business or pleasure. But many open Wi-Fi networks are traps, where malicious attackers prey upon innocent victims looking to connect to any available access point, patiently waiting to compromise and attack the victim s information. Danger Zone provides information to the user if nearby available networks should be avoided (high-risk networks). Before the user decides which network to connect to, the user can open the McAfee MVISION MTD Application app and tap on Danger Zone. They are presented with a map showing the markers of high risk (red icons) networks nearby. If the user does not check McAfee MVISION MTD Application before connecting to a network, and the user connects to a high-risk network, the user is alerted that they are connecting to a high-risk network with recommendations of what are the next actions, for instance to disconnect from the highrisk access point. The screenshots below show the map initially displayed, based on the user s location. The red icons with numbers on them represent the number of threats detected on high risk access points. The user McAfee MVISION Mobile Threat Detection Android Platform Guide

22 can zoom using two-finger actions on the screen to zoom in and out. Tapping on an icon dives deeper into the location chosen and eventually to the SSID for nearby or unsecured Wi-Fi networks. If a user connects to a known high-risk access point, the alert displays instructing the user that they connected to a known high-risk network with the name of the network they connected to and a recommendation to disconnect from that network. An optional configuration alerts the user if they are near a known high-risk network. Nearby networks are only evaluated while Wi-Fi is enabled and not connected. McAfee MVISION MTD Application scans nearby networks and alerts on any that are known to be high risk. This feature is enabled via the McAfee MVISION Mobile Console management interface in the Threat Response Policy/Matrix. If the threat Danger Zone Nearby is enabled, McAfee MVISION MTD Application discovers nearby networks that are known high risk, the user is alerted and provided a button to press to show the known nearby networks. McAfee MVISION MTD Application continues to check for risky networks after the device has moved greater than 500m and after 10 minutes. McAfee MVISION Mobile Threat Detection Android Platform Guide

23 Network Monitor The Network Monitor page provides a graphical snapshot of the network events seen on the connected Wi-Fi network, and also details on the last network event detected. The user can navigate to this page from any page in McAfee MVISION MTD Application by tapping on menu option list and then selecting Network Monitor. The Network Monitor page displays via icons all network threat events on the currently connected Wi-Fi network and displays new events as they are detected. Orange icons represent Wi-Fi network scans. Red icons represent critical network threats such as ARP or ICMP Man-in-the-middle (MITM) attacks. McAfee MVISION Mobile Threat Detection Android Platform Guide

24 Full Threat Log The Full Threat Log page provides a chronological listing of all events detected on the device. Users can navigate to this page from any page in McAfee MVISION MTD Application by tapping on the menu option list and then Full Threat Log. Along with the event list, the Full Threat Log page also displays a description of the event, when it happened, and a recommendation of possible actions to take. The user can scroll through the log by pulling the page up. McAfee MVISION Mobile Threat Detection Android Platform Guide

25 Advanced Details Invoking Advanced Details The Advanced Details page is available from the settings page. Users can navigate to this page from any page in McAfee MVISION MTD Application by tapping on the menu option list and then by pressing the About McAfee MVISION MTD Application option for 1 to 2 seconds. The Advanced Details page provides help in debugging and information gathering for the application. Advanced Details Information The Advanced Details page displays the following: Version: Current McAfee MVISION MTD Application version running on this device. Debug Logs: With this option you can send current log information for support and troubleshooting. Invoke this with the share icon on the title bar. Build ID: Current McAfee MVISION MTD Application Build ID number running on this device. Login: This value reflects the user currently activated in on this device in McAfee MVISION MTD Application (if not anonymous). The value of AUTO signifies that this device is synchronized through an MDM. Device ID: The identifier for the device. Server: The current cloud server for McAfee MVISION MTD Application communication. Customer Name: Customer environment name that McAfee MVISION MTD Application is connected to on the McAfee MVISION Mobile Console. Release: A value of true indicates the build has been released for general availability. A value of false indicates an internal build. Malware Classifier Download: The date and time of the current application malware database being used to check for malicious applications on the device. TRM Download: The date and time of the last Threat Response Policy/Matrix download. Whitelist Download: The date and time of the application whitelist/blacklist download. Privacy Download: The date and time of the last Privacy Policy download. Privacy Profile Name: The name of the currently enforced Privacy Policy Profile. Engine State: Displays whether or not detection is enabled. McAfee MVISION Mobile Threat Detection Android Platform Guide

26 About Debug Logs You can view and share the McAfee MVISION MTD Application log information. After you invoke the Advanced Details screen, tap on the share icon at the top on the title bar. The figures below show an example of the log information displayed and the share options. No personal information is collected or shared through these logs. Debug Logs Page Log Share Options McAfee MVISION Mobile Threat Detection Android Platform Guide

27 Local Device Actions The McAfee MVISION Mobile Console administrator has options that can be performed locally on the device when there is a threat detected. Currently these actions can be selected as part of the Threat Response Policy/Matrix on McAfee MVISION Mobile Console: 1) Disconnect Wi-Fi: When this item is selected in the TRM, McAfee MVISION MTD Application disables the Wi-Fi interface in response to the selected threat(s). The device then falls back to cellular data. The user can later enable Wi-Fi and ensure they do not select the network where the error was detected. 2) Isolate from Network (Knox): When this item is selected in the TRM, McAfee MVISION MTD Application utilizes Knox on the device to block all network activity for the malicious app or abnormal process detected on the device. The device has to have McAfee MVISION MTD Application enabled with Device Admin privileges and the device has to be Knox capable. Contact your Customer Success team to enable your McAfee MVISION Mobile Console environment for Device Admin privileges. The Knox license agreement is shown to the end user after a McAfee MVISION MTD Application activation. The end user must accept the Knox license agreement to enable McAfee MVISION MTD Application to perform the Isolate App from Network Knox action. 3) Disable Bluetooth: When this item is selected in the TRM, McAfee MVISION MTD Application disables the Bluetooth interface in response to the selected threat(s). The user can enable the Bluetooth interface when they are in a safe location. 4) Network Sinkhole: If a threat is detected with the Network Sinkhole action enabled, McAfee MVISION MTD Application either allows or blocks network CIDR s and/or domains as defined by the McAfee MVISION Mobile Console administrator. McAfee MVISION Mobile Threat Detection Android Platform Guide

28 Appendix A Google s Android for Work Implementation with McAfee MVISION MTD Application Overview Google s Android for Work provides an environment to separate your business app data from your personal app data. Applications in the work profile of Android for Work run in a separate protected workspace vs the personal side of the device. For example, the Android for Work Contacts app has different contacts then the personal Contacts app. Applications running in the work profile can only see other applications and processes in the work profile. Supported Configurations When implementing McAfee MVISION MTD Application on a device with Android for Work, there are the following supported configurations: Running McAfee MVISION MTD Application only in the work profile of the device. a. Monitors apps installed in the work profile. b. Monitors network behavior on the device. c. Monitors abnormal behavior on the device. Running McAfee MVISION MTD Application only in the Personal profile of the device. a. Monitors apps installed in the personal profile. b. Monitors network behavior on the device. c. Monitors abnormal behavior on the device. Running McAfee MVISION MTD Application in both the work and personal profiles. This configuration provides the best protection. a. Monitors apps installed in both the personal and work profile. b. Monitors network behavior on the device. c. Monitors abnormal behavior on the device. Regardless of which deployment option is used, McAfee MVISION MTD Application detects device and network threats. The detection and evaluation of applications is done by McAfee MVISION MTD Application on apps that are installed in the same container as McAfee MVISION MTD Application (work, personal, or both depending on the deployment model). McAfee MVISION Mobile Threat Detection Android Platform Guide

29 McAfee MVISION MTD Application Running in Work and Personal Profiles When McAfee MVISION MTD Application is running within both the work and personal profiles, the McAfee MVISION Mobile Console shows it as one device. This configuration uses one license. McAfee MVISION Mobile Console displays the two profiles within the device as two applications. This figure shows what displays on the McAfee MVISION Mobile Console when the device is selected. The two McAfee MVISION MTD Application applications coordinate together so threat notifications are not duplicated. Because it is one device, the same TRM policies apply to both instances of the McAfee MVISION MTD Application. The work profile McAfee MVISION MTD Application can be configured to install on the device. The personal profile application must be manually installed by the user. In the configuration with McAfee MVISION MTD Application in both profiles, the auto-activation functionality works the same as when a single McAfee MVISION MTD Application is installed. NOTE: Knox security is supported the same way McAfee MVISION MTD Application supports Android for Work. McAfee MVISION Mobile Threat Detection Android Platform Guide

30 Appendix B - Site Insight McAfee MVISION MTD Application provides a safety check to validate URL s are not malicious when tapped in non-browser apps such as or text apps. Essentially, when a link is presented to a user is an message or a text message as an example and the user taps it, the URL is directed to McAfee MVISION MTD Application to validate it and McAfee MVISION MTD Application ensures it is not malicious. if it is not malicious, the URL is then opened in the browser. There are the following Threat Response Policy/Matrix threats relating to Site Insight: Site Insight - Link Tapped Site Insight - Link Visited If a link is determined to be malicious, a notification display is sent to the user regardless if the Notify User box is checked in the policy. When the feature is first activated at the device, the user is presented with an option to use McAfee MVISION MTD Application or a browser to go to the link. The figure shows the selection provided. The user can select JUST ONCE or ALWAYS for McAfee MVISION MTD Application validation. If a URL is determined to be malicious, the user is alerted. The figure gives an example of an alert. This feature can be enabled or disabled from the Management page of the McAfee MVISION Mobile Console and is further detailed in the McAfee MVISION Mobile Console Configuration Guide. Separate actions can be taken based on whether a user has only tapped a malicious link and been alerted or chosen to continue on to visit the malicious site. McAfee MVISION Mobile Threat Detection Android Platform Guide