1 Introduction Requirements Architecture Feature List... 4

Size: px

Start display at page:

Download "1 Introduction Requirements Architecture Feature List... 4"

Geoffrey Terry
5 years ago
Views:

1 Contents 1 Introduction Requirements Architecture Feature List Device Compliance status Auto grouping for devices Auto grouping for applications Other AirWatch Compliance Policy and actions Basic Deployment Prepare AirWatch account TMMS Server Setting Deploy Android agent Deploy IOS agent Feature Configuration Set AirWatch compliance status and send

2 1 Introduction There are 2 important functions in TMMS. One part is mobile device management related features; the other is security scan related features. TMMS security scan features can integrate with 3rd party MDM vendors. The latest 9.7 version can integrate with AirWatch and MobileIron. VMware AirWatch is an Atlanta-based provider of Mobile Device Management (MDM) software and standalone management systems for devices, content, applications and Requirements The following requirements/conditions should be met before proceeding: Mobile Security for Enterprise 9.7 version or later The communication server is configured to either Local Communication server or Cloud Communication Server. AirWatch version 8.4 AirWatch account

3 1.2 Architecture MARS Mobile App Reputation is a cloud-based technology that automatically identifies mobile threats based on app behavior, Crawl & collect huge number of Android apps from various Android Markets, Identifies existing and brand new mobile malware, Identifies apps that may abuse privacy / device resources, World s first automatic mobile app evaluation service SPN The Trend Micro Smart Protection Network delivers proactive global threat intelligence against zerohour threats to ensure that you are always protected. We use our up-to-the-second threat intelligence to immediately stamp out attacks before they can harm you. Powering all of our products and services.

1.3 Feature List 1.3.1 Device Compliance status The AirWatch Console provides a list of enrolled

4 1.3 Feature List Device Compliance status The AirWatch Console provides a list of enrolled devices, showing the device s compliance status. Users of non-compliant devices will get an notification.

1.3.2 Auto grouping for devices Mobile Security uses a prefix to create three (3) classes (Malware, Vulnerability, and Privacy), and tags the risk devices as follows: PREDEFINEDPREFIX_Dangerous

the device s Smart Group (e.g. if TMMS found that a device has a malware, it will be automatically move to PREDEFINEDPREFIX _Dangerous group). 1.3.

5 1.3.2 Auto grouping for devices Mobile Security uses a prefix to create three (3) classes (Malware, Vulnerability, and Privacy), and tags the risk devices as follows: PREDEFINEDPREFIX_Dangerous PREDEFINEDPREFIX _Risky PREDEFINEDPREFIX _NO_TMMS The prefix is predefined by the Administrator. When TMMS finds a malicious application, it will automatically change the device s Smart Group (e.g. if TMMS found that a device has a malware, it will be automatically move to PREDEFINEDPREFIX _Dangerous group) Auto grouping for applications The risk applications are grouped together under App Groups respectively, and include apps with tag and category added as prefix to their names, this is automatically procedure. PREDEFINEDPREFIX _Malware_App_Android PREDEFINEDPREFIX _Privacy_App_Android PREDEFINEDPREFIX _Vulnerability_App_Android PREDEFINEDPREFIX _Malware_App_iOS

6 1.3.4 Other AirWatch Compliance Policy and actions The administrator can set AirWatch Compliance Policy to AirWatch Blacklist (e.g. Block/Remove Managed Apps while the device is in XXXX_malware_app_Android Group). There are many actions, commands, and provided by AirWatch. 1.4 Basic Deployment Prepare AirWatch account We need to have an AirWatch account to be used for the communication between the TMMS server and AirWatch. The user will need to configure the permissions on AirWatch. Do any of the following options: Option 1: Create an AirWatch Administrator for the communication The created account may need to call the REST API to collect information, and some configuration in the AirWatch console is needed.

7 Option 2: Create a user with API ONLY with all REST API permission This option needs configuration from the TMMS web console and the AirWatch console.

8 Option 3: Create a user with API ONLY with customized REST API permission This option allows the administrator to select specific REST APIs to be used. The table below shows the specific REST APIs that TMMS use, and should be enabled: Category Admin User Management WTag Management Smart Group Management Application Group Management Application Management Device Management Name Search Admin User Create Tag Search Tag Add Devices to the Tag Remove Devices from Tag Retrieve Devices with Specific Tag Create Smart Group Search Smart Groups Delete Smart Groups Create Application Group Search Application Group Retrieve Application Group Details Add Application to an Application Group Delete Application from the Application Group Internal Application Install : Upload Application Chunks (ios and Android) Internal Application Install : Begin Internal Application Install Retrieve Device Information Device Extensive Search Device Count Info

9 The AirWatch REST permission settings page does not have permission for each API, but provides a lot of API Series (e.g. Admin API, APPs API, etc.). End-users will need consult with AirWatch regarding what REST API permission need to be enabled in the settings page TMMS Server Setting 1. Log on to the Mobile Security Administration web console. 2. Click Administration > Communication Server Settings on the menu bar, and make sure the Communication Server settings are configured. If the settings are not configured, refer to the topic Configuring Communication Server Settings in the Installation and Deployment Guide for the configuration steps.

10 3. Click Administration > Deployment Settings. 4. Under the Server tab, select Security Scan, and then select AirWatch as the MDM Solution from the drop down list. 5. Under Register Service, configure the following AirWatch settings: API URL API KEY Account The account used in the integration feature should have AirWatch Administrator role privilege. Please refer KB Password

11 6. Click Verify Settings to make sure Mobile Security can connect to the AirWatch server. 7. Under Data Synchronization Settings section, configure the following: Security Category Prefix The Security Category Prefix will be added while TMMS create Smart Groups and App Groups. Like XXXX_Malware_App_Android Deploy Android agent TMMS has two Android agent versions. AirWatch Administrator need to choose one of the following versions: Version Google play version TMMS server version Pros and Cons Administrator need to send an to end-user with QR code or Enrollment Key. End-users need to open TMMS agent and scan the QR code or manually enter the Enrollment Key to register their device to server. Agent can be updated automatically. Administrator need to send an to end-user ask them to launch TMMS Agent, after end-user launch TMMS Agent, TMMS agent will register to TMMS server While TMMS agent has new version, end-user need to type the upgrade button in the notification bar AirWatch agent can help to launch TMMS agent in backend; So, Administrator can deploy TMMS to devices automatically. *SAMSUNG Device Only*

12 Google Play build 1. Log on to AirWatch web console, and navigate to Apps & Books > List View > Public > Add Application. 2. On the Add Application screen, configure the following fields: a. Managed By: Type Trend Micro. b. Platform: Select Android from the drop-down list. c. Source: Select Search App Store. d. Name: Type ent security to search the app store.

13 3. Click Next. 4. From the search results, select Enterprise Mobile Security. 5. On the Add Application screen, click the Assignment tab, and select the assigned groups from the Assigned Groups field. This assignment will let TMMS install on the Assigned group. 6. Click Save & Publish. 7. Click Upload to upload it to AirWatch.

14 Local Server build 1. Tick Use preset Enrollment Key. 2. In the TMMS for Enterprise web console, go to Administration > Deployment Settings > Android Agent. 3. Choose Download from TMMS Server. 4. Tick Auto Enrollment. 5. Click Upload.

Finished all steps in Local Server build part first All devices are SAMSUNG Devices 1.

15 6. The application will now show in the AirWatch console. Automatically Enroll SAMSUNG Devices Requirements: Only supports Local Server build. Finished all steps in Local Server build part first All devices are SAMSUNG Devices 1. Configure the Files/Actions from the AirWatch console. Do the following: a. From the AirWatch console, go to Devices > Staging & Provisioning > Components > Files/Actions. b. Click Add > Android.

16 c. In the General tab, provide the information for the Name and Description fields. d. Go to the Manifest tab, then click Add Action, located under the Install Manifest section.

17 e. In the Add Manifest options, provide the following information, then click Save: Action(s) to Perform: Run Intent Command Line and Arguments to run: mode=explicit,broadcast=false,action=android.intent.action.main,package= com.trendmicro.tmmssuite.enterprise,class=com.trendmicro.tmmssuite.ent erprise.ui.tmmsenterprisesplashscreen TimeOut: [any] f. In the Add Files/Actions page, click Save.

2. Configuring the Product. Follow the steps below: a. From the AirWatch console, go to Devices > Staging & Provisioning > Product List View. b. Click Add Product > Android.

18 2. Configuring the Product. Follow the steps below: a. From the AirWatch console, go to Devices > Staging & Provisioning > Product List View. b. Click Add Product > Android. c. In the General tab, provide the information for the Name, Description, and Assigned Groups fields. d. Go to the Manifest tab, then click Add, to add the manifest.

19 e. In the Add Manifest options, provide the following information, then click Save: Action(s) to Perform: Install Files/Actions Files/Actions: TestLauncher f. In the Add Product page, click Save. 3. Configuring the Application. Do the steps below: a. Assign the TMMS Agent to a smart group. b. Set the Push Mode to Auto.

20 1.4.4 Deploy IOS agent 1. Login to the AirWatch Admin console, then go to Apps & Books > Applications > List View. 2. Under the Public tab, click Add Application. 3. Provide the following information: Organization Group: Trend Micro Platform: Apple ios Source: Search App Store Name: ENT Security

21 4. Click Next. 5. Click Select for enterprise mobile security. 6. In the Add Application page, click save and assign 7. In the Assignment tab, click Add Assignment

22 8. Set Select Assignment Group to the device group you want to management, set App Delivery Method to Auto

23 9. Set Application Configuration to Enable Note: In this page, the value of EK, ServerUrl, and ServerPort should be provided following the real environment. This information can be found in the TMMS Admin console > Administration > Deployment Settings > ios Agent tab > Step Click Save & Publish. 11. Click Publish.

1.5 Feature Configuration 1.5.1 Set AirWatch compliance status and send email After the integration, the administrator can

From the Airwatch Admin Console, go to Devices > Compliance Policies > List View. 2.

24 1.5 Feature Configuration Set AirWatch compliance status and send After the integration, the administrator can create more useful compliance policies in the AirWatch admin console. 1. From the Airwatch Admin Console, go to Devices > Compliance Policies > List View. 2. Click Add, select the Platform (Android or Apple ios), then select the rules. 3. Click Next. 4. Under the Actions tab, do the following: Tick the Mark as Not Compliant box. Choose Notify. Select Send to User

5. Go to Assignment tab, select the Assigned Groups, then click Next. 6. Under the Summary tab, provide the Name, and Description, then click Finish and Activate. 7.

25 5. Go to Assignment tab, select the Assigned Groups, then click Next. 6. Under the Summary tab, provide the Name, and Description, then click Finish and Activate. 7. Then, when a malware is finding in TMMS, the app will be put into the blacklist, then the device will be set as un-compliance, and the policy will be triggered. All this is down automatically.

1 Introduction Requirements Architecture Feature List... 3

1 Introduction Requirements Architecture Feature List... 3 Contents 1 Introduction... 2 1.1 Requirements... 2 1.2 Architecture... 3 1.3 Feature List... 3 1.3.1 Device Compliance status... 3 1.3.2 Auto grouping for devices... 4 1.4 Basic Deployment... 4 1.4.1 Prepare