Policies

These are the available columns on the Apps Flagged by Policies page:

You can filter the display by clicking on the column with a triangle, and request items by clicking the option dots at the end of the row.

The user can filter the display by clicking on the column with a triangle. For each app displayed, the user can request reports such as Executive PDF Report, Technical PDF Report, JSON Report, and Alternate Reports. They can also mark the app as allowed, denied, or out of compliance for the organization.

Device app non-compliance with organizational policies must be reported to administrators. An administrator can mark an app as out-of-compliance (OOC) for the user's enterprise in the Apps Policy tab on the Policy page. Users are notified of non-compliant apps and instructed to uninstall them from their devices. Administrators can set up app policies based on particular characteristics like camera or microphone usage. The Mobile Security console displays the apps that meet the defined policy. The administrator can designate an app as:

The administrator has the ability to designate apps as reviewed for the purpose of monitoring their review progress. Applying specific app permissions by an administrator mitigates potential threats from certain developers or apps. MDM-loaded, internal, or sideloaded apps can be designated as safe. No threats were detected for these applications.

When an administrator denies specific apps, then it generates the ‘Suspicious iOS App’ or ‘Suspicious Android App’ threat for that app, which is similar to marking it as malware. When an administrator marks an app as out-of-compliance, then it generates the ‘Out of Compliance App’ threat.

An administrator has these options for marking an app as out of compliance:

To enable phishing protection without content filtering, click the Policy navigation menu item. Then on the Phishing & Content Policies tab, select the Phishing Protection radio button. With this selection, you can, as an administrator, set up the following functionality on a device with the GravityZone MTD:

To enable content filtering and phishing protection, click the Policy navigation menu item. Then, click the Phishing & Content Policies tab, and select the Enhanced Phishing Protection plus Content Filtering radio button.

With the Enhanced Phishing Protection plus Content Filtering selection, you can, as an administrator, set up the following functionality on a device with GravityZone MTD:

Information about the available actions for different categories are detailed in this table below.

*This option is mainly for frames inside other websites to avoid too many alerts.

**This assumes that the threat policy is set so that these threats are enabled.

To set up specific actions in the content filtering categories:

There are two main content categories:

The category data is dynamically managed and can change instead of being static for each release. Therefore, this subcategory list can change before a release is published.

An administrator can set up a custom category list and they are also called Access Control Lists. This list allows an administrator to override the categorization defaults and actions for a category. An administrator can also add more websites to the list and assign a category and define the desired actions. One or more groups can reference a custom categorization list.

Whenever an Alert & Create Threat or a Block & Create Threat action is selected for the category, threats are generated on the Threat Log page

Whenever an Alert & Create Threat or a Block& Create Threat action is selected for the category, threats are generated on the Threat Log page.

If other categories other than the Security/Risk group are set, then these threats are generated:

.

You can copy the categorization's action settings from a different group to the current group if another group exists. If the "Default Group" is the only group available, then this feature is disabled.

To disable phishing protection and content filtering, click the Policy navigation menu item. Then on the Phishing & Content Policies tab, select the Disabled radio button. With this disabled, the phishing protection feature is no longer enabled on the devices in that group.

If a device user gets the notification of a "Server verification incomplete" message, you must ensure the corresponding threats for phishing protection are enabled. For devices with phishing protection enabled, these threats must be enabled in the threat policy:

The administrator can manually input the Samsung Knox KPE license. There is one license for a tenant that you can set by following these steps:

To set the policies for the Samsung Knox devices, click the Policy navigation menu and then the Samsung Knox Policy tab.

When the threat is identified, there are several actions that can be taken on the device and are set up in the Policies. Follow these steps to select data loss prevention in the policies:

To get the status of the Samsung devices included in the Devices window, perform these steps:

1. In the Mobile Security Console, from the navigation pane, click Devices.

2. In the upper right corner of this window, click the gear icon.

3. To add the Samsung Knox device info, click the Knox checkbox and click Apply.

4. A new Knox column is added.

5. This window shows the following information for each of the individual devices.

   

   • Risk Posture: This identifies the risk posture if the phone is compromised and if it is Low, Elevated, or Critical, or if the phone is in a Normal state. Selecting the drop-down arrow allows the Admin to get only the devices listed of the selected (Critical, Elevated, Low, or Normal) risk level.

   • App Version: This column shows the version of the app.

   • User: This identifies the user of the device. By clicking on the drop-down arrow, a search can be performed for a specific user.

   • Group: This shows the Group to which the device is assigned. By clicking on the drop-down arrow, a search can be performed for a specific group, so that all devices in that group are displayed

   • OS: This determines if the device is an iOS or Android device, and the release of software on the device. By clicking on the drop-down arrow, the Admin can select to see only the iOS devices or the Android devices, and also select the specific version of the devices to display.

   • Upgradeable OS: This shows if the device is upgradeable to the newest release of software or not. By clicking on the drop-down arrow, the Admin can choose to see only the devices that are upgradeable or only the devices that are not upgradeable.

   • Device ID: This shows the device ID. Clicking on the drop-down arrow allows the Admin to search for a specific device ID.

   • Model: This column shows the actual model type of the Samsung device.

   • App Version: This column shows the version of the app.

   • Privilege: The Privilege column allows the Admin to select the devices listed by Privilege, including the following:

     

     • Jailbroken/Rooted: This status indicates that the device is jailbroken (for iOS) or rooted (for Android). Jailbroken means the iPhone has had privilege escalations applied for the purpose of removing software restrictions imposed by Apple on iOS devices. Rooted means that privileges are modified on the device so that root access to the operating system has the device potentially compromised.

     • USB Debugging: This status indicates that the device is currently in a restoring or repairing status.

     • 3rd Party App Store: This status indicates that the specified app was downloaded from a 3rd Party app Store rather than the acceptable Apple Play or Google Play Store.'

     • High-Risk Devices: This status indicates that the device is identified as a “High Risk” device and may be the target of a surveillance company and may or may not be currently targeted.

     • Not Jailbroken: This status indicates that the device is not jailbroken.

     • Developer Mode: This status indicates the app is whitelisted by a developer.

   • CVE: This provides the Common Vulnerabilities and Exposure (CVE) that applies to the Risk Posture shown on the device (if a CVE has been logged).

   • Knox : This identifies if the Samsung Knox device is activated with advanced Knox security protection. Clicking on the drop-down arrow allows the Admin to select “Activated” or “Deployed” devices to be shown in the list.

   • Operational: This column specifies if the device is “Active”, “Inactive”, or “Pending Activation”. Clicking on the drop-down arrow allows the Admin to select which status of devices to be shown in the list.

   • Last Seen: This column shows the date and time that the specified alert was seen on the devices.

On the Samsung Knox devices having Advanced Support enabled, the following figures show the screens that come up on the device regarding the license agreement including Privacy Notices and Data Loss Prevention.

The user has to accept and agree to the terms and conditions for the device to be activated with the Advanced Knox Mobile Security features. The screen below shows the Data Loss Prevention activities that are activated on the mobile device if it is found to be compromised:

The Data Loss Prevention features on Samsung Knox devices with Advanced Support enabled are displayed in the Advanced Details window. This window identifies the disabled or restricted features, which include:

The threat policy actions can be defined for the default group or for groups that the user defines. This information is displayed by selecting the Policy page and then the Threat Policy tab.

The Threat policy has the following options:

Click Deploy to send the new threat policy to the currently activated devices. When integrated with an MDM or local device groups, each group is created as a Mobile Security Console group with its own threat policy. The user selects which group to modify in the Selected Group drop-down list.

Protection actions

The protection actions are applied on the device or via MDM integration.

Device action

The device actions do not require integration with an MDM (with the exception of the iOS Disconnect Wi-Fi action).

1. To set the Device Action, select Policy in the navigation pane, and select the Threat Policy tab.

2. Locate the desired threat, and click the gear icon in the Device Action column.

3. Click the checkbox for the desired device action and click OK. The figure shows the actions provided for Android, iOS, Samsung Knox, and Browser Extension devices.

The following sections describe the different actions for Android, iOS, and Knox.

Android

• Disconnect Wi-Fi - Disable the Wi-Fi adaptor and fall back to cell data if enabled. The user can then enable the Wi-Fi adapter when they are safe.

• Network Sinkhole - If Network Sinkhole Settings are configured in the Manage page, this option displays here. The action either blocks or allows defined network ranges/domains based on an IP network/mask and domains configured.

• Disable Bluetooth - Disable the Bluetooth adaptor and disconnect any current Bluetooth connections.

• Tunnel Unsecured Traffic - When this is selected, a secure VPN tunnel is automatically initiated to handle traffic across an unsecured connection.

iOS

• Enable VPN - This is enabled when VPN Settings are configured in the Manage page. Choose this option to bring up the defined VPN in response to a threat.

• Network Sinkhole - If Network Sinkhole Settings are configured in the Manage page, this option displays here. The action either blocks or allows defined network ranges/domains based on an IP network/mask and domains configured.

• Disable Bluetooth - Disable the Bluetooth adapter and disconnect any current Bluetooth connections. This is supported only for GravityZone MTD for MDMs.

• Tunnel Unsecured Traffic - When this is selected, a secure VPN tunnel is automatically initiated to handle traffic across an unsecured connection.

• Disconnect Wi-Fi (Optional) - A Disconnect Wi-Fi option for iOS is displayed for certain MDMs. When selected, a Wi-Fi profile is pushed down to the device through the MDM that effectively disconnects from the currently connected SSID. The Wi-Fi on the device then falls over to the next available SSID or cell data if no SSIDs are available.

Samsung Knox

• Use Android Actions - This works in conjunction with the Knox action settings.

• Disable/Uninstall/Block App -These remove or disable the app from running on the device.

  Note

  Inbuilt apps like Chrome cannot be uninstalled.

• Isolate from Network - This disables any network communications from apps that are malicious but not yet uninstalled.

• Network Sinkhole -If Network Sinkhole Settings are configured in the Manage page, this option is available. The action either blocks or allows defined network ranges/domains based on an IP network/mask and domains configured.

• Data Loss Prevention - For the data loss prevention options on the Samsung Knox Advanced, click Policy in the navigation pane, then select the Samsung Knox MTD Policy tab. Find an Android device and click the gear icon on that line. This pop-up window opens to allow selection of the actions to be taken for data loss prevention on the Samsung Knox devices. Click the Data Loss Prevention checkbox.

Browser Extension:

• Disable Extension - This disables the extension that is linked with the threat.

• Uninstall Extension - This uninstalls the extension that is linked with the threat.

MDM action

To enable an MDM action item, on the same row as the threat to be configured, pull down the list under the MDM Action column and choose the group to be applied to the device when this particular threat is detected.

Mobile Security Console securely communicates with the MDM API and makes the assignment as defined in the selection. To remove an MDM action from occurring for a threat classification, change the threat MDM Action to 'No Action'.

Note

The Disconnect Wi-Fi action as an MDM action is supported for iOS devices only. For Android devices, this action currently needs to be performed as a 'Device Action' request.

Mitigation action

When a threat is remediated, and is no longer posing a threat to the device, the administrator can define specific actions that can be taken on the customer's MDM. For example, when a device is detected to be under an ARP MITM attack, it can be prevented fromaccessing various corporate resources. When the device is moved to a clean network, the administrator can automatically allow the device to access those resources again. The Mitigation Action column is used for this function. To remove the action that was performed as a response to a threat that is now mitigated, choose 'Remove'. The Administrator also has the option to move the device to another group available on the MDM. Due to the nature of some threats, not all threat classifications can be mitigated.