MDM Primer-02
TweetFollow Us on Twitter

MDM Primer-02

Mobile Device Management (MDM) Primer
Fall, 2011

(continued)

Configuration Profiles

Configuration profiles are lists of settings that IT departments use to quickly set up iOS devices. These profiles may be setup to configure end users' devices to access Microsoft Exchange servers, the corporate VPN tunnel, Wi-Fi networks and corporate resources. Configuration profiles also give IT the ability to lock the settings.

Configuration profiles can be created with the iPhone Configuration Utility (iPCU), a free application for Mac OS X (10.6.x and 10.7.x) and Windows (XP, Vista and 7).


Figure 4 - iPCU Configuration Profiles

What are configuration profiles?

A configuration profile is an XML file that can be used to distribute configuration information to iOS devices. IT administrators will use these configuration profiles to configure specific, single or multiple, settings for iOS devices. Each configuration profile contains one or more "payloads,” which detail out all of the settings that one can possibly set on an iOS device, which include:

  • Passcode - requirement of passcode, simple vs. complex passcode
  • Restrictions - locking down Safari, YouTube, iTunes, installation of apps, deletion of apps, allowed content
  • Wi-Fi - networks SSID's and passwords (any standard 802.11x wireless network)
  • VPN - Cisco IPSec, L2TP, PPTP, SSL VPN
  • Email - Standards-based email, contacts, and calendars (IMAP, POP, CardDAV and CalDAV)
  • Exchange ActiveSync - supporting Exchange Server 2003, 2007 and 2010
  • LDAP - directory service settings
  • CalDAV - calendar service settings for shared calendars
  • CardDAV - group address book
  • Subscribed Calendars - read only access to shared calendars
  • Web clips - URL's to a specific website, shortcut
  • Credentials - PKCS1 and PKCS12 certificates to install on the device
  • SCEP - Simple Certificate Enrollment Protocol allows the device to obtain certificates from a certificate authority
  • Mobile Device Management - configures the device so that its configuration is managed over the air by an MDM server
  • Advanced - Cellular network settings (APN)

Best Practices for Protecting Configuration Profiles

Administrators should sign and/or encrypt a configuration profile to prevent it from being altered or viewed. You can also protect a configuration profile by locking it with a passcode so that an end user can't remove it.


Figure 5 - Setting Security

Signing and encryption

The data on a configuration profile can contain sensitive information such as account information and passwords. iPCU allows three options for exporting out the profiles you have built and protect your data.

A signed profile may only be replaced by another profile with the same Identifier and signed by the same copy of iPCU. iPCU may be used to both encrypt and sign configuration profiles, locking them down to a specific device and preventing others from changing or viewing the settings of the profile.

Security on profiles is available as follows, upon Export:

  • None - Creates a plain text .mobileconfig file that can be installed on any device. Data is not encrypted and may be viewed in any text editor. There is no security in place.
  • Sign configuration profile (good security) - Creates a signed .mobileconfig file that can be installed on any device, provided the profile hasn't been altered. After installation, the profile can be updated only by another profile with the same Identifier and signed by the same copy of iPCU.
 The profile is signed with the public key associated with a device's identity certificate. This public key can be obtained by connection through USB to a computer running iPCU or using over-the-air enrollment.
  • Create and sign encrypted configuration profile for each selected device (best security) - Signs the profile so it cannot be altered, encrypts all the contents so the profile cannot be viewed in a text editor, and can be installed only on specific devices that appear in the Devices list. Separate .mobileconfig files are created for each of the devices you select from the Devices list. In most cases, this is the best option to select and offers the highest amount of security.

Locking Profiles

A profile may also be distributed that's locked to a device so that after it's installed, it can be removed only by wiping the device of all data (full reset) or, by entering a passcode. Locking a configuration profile is recommended to prevent end users from deleting it from a device. The following three choices are available for locking:

  • Always - The end user may remove the profile at any time.
  • With Authorization - Password is set, and needed, for removal of profile.
  • Never - Profile may only be updated with a new version, but not be removed.

Installing configuration profiles

Profiles can be installed via one of several methods:


Figure 6 - Hard-wired USB Connections

  • USB - for smaller installations, this is a viable way of getting payloads onto your mobile devices. As the quantity goes up, the benefits to this method go down and it becomes much more work. This process is, typically, done by IT directly. The USB method is meant for low-quantity deployments, such as 50 or less devices.


    Figure 7 - Wireless Connections

  • Wirelessly - Profiles can be distributed wirelessly via email, website and over the air. When an end user downloads the profile from the web or opens it as an attachment in Mail, the device recognizes the .mobileconfig extension as a profile and begins installation when the user taps Install. If a passcode has been set on the device, the user will be prompted to enter in their credentials.
  • Email - Distribution of profiles via email. The end user receives the email message on the iOS device and then taps on the attachment to install the profile. This process does require the end user to accept and install.
  • Website - Distribution of profiles via a corporate website require the user to follow a specific link to download a profile. The end users can navigate to the web page on their device and then download the profile onto it. This process does require the end user to accept and install.
  • Over the air - IT can use a secure enrollment and configuration process enabled by the Simple Certificate Enrollment Protocol (SCEP) to distribute encrypted configuration profiles over the air. SCEP does require some infrastructure to be setup, but makes the process much easier for IT departments to manage in the long run.

Did you know that the fastest way to get a handle on MDM is through MacTech's seminar series?
MacTech InDepth: Mobile Device Management will do a deep dive on MDM in one day. December 7, 2011 San Francisco, CA. Learn the issues, talk to vendors, be able to make a plan. Save $200 with early bird registration or find out more about the event.

 
AAPL
$114.11
Apple Inc.
+2.10
MSFT
$47.93
Microsoft Corpora
-0.22
GOOG
$533.36
Google Inc.
+4.59

MacTech Search:
Community Search:

Software Updates via MacUpdate

MegaSeg 5.9.4 - Professional MP3 DJ appl...
MegaSeg is a complete solution for pro audio/video DJ mixing, radio automation, and music scheduling with rock-solid performance and an easy-to-use design. Mix with visual waveforms and Magic... Read more
Parallels Desktop 10.1.2 - Run Windows a...
Parallels Desktop is simply the world's bestselling, top-rated, and most trusted solution for running Windows applications on your Mac. With Parallels Desktop for Mac, you can seamlessly run both... Read more
GarageSale 6.9.1 - Create outstanding eB...
GarageSale is a slick, full-featured client application for the eBay online auction system. Create and manage your auctions with ease. With GarageSale, you can create, edit, track, and manage... Read more
Quicksilver 1.2.2 - Application launcher...
Quicksilver is a light, fast and free Mac application that gives you the power to control your Mac with keystrokes alone. Quicksilver allows you to find what you need quickly and easily, then act... Read more
Mac DVDRipper Pro 5.0.1 - Copy, backup,...
Mac DVDRipper Pro is the DVD backup solution that lets you protect your DVDs from scratches, save your batteries by reading your movies from your hard disk, manage your collection with just a few... Read more
ClamXav 2.7 - Free virus checker, based...
ClamXav is a free virus checker for OS X. It uses the tried, tested, and very popular ClamAV open source antivirus engine as a back end. I hope you like and use ClamXav a lot and that it helps keep... Read more
FoldersSynchronizer 4.2 - Synchronize or...
FoldersSynchronizer is a popular and useful utility that synchronizes and backs-up files, folders, disks and boot disks. On each session you can apply special options like Timers, Multiple Folders,... Read more
Waltr 1.0.6 - Drag-and-drop any media fi...
WALTR is designed to make it easy to upload and convert any music or video file to an iPad or iPhone format for native playback. It supports a huge variety of media file types, including MP3, MP4,... Read more
Tonality Pro 1.1.3 - Professional-grade...
Tonality Pro gives you the power to create stunning and dramatic black & white images. This is a complete monochrome image editor with more than 150 one-click style presets, totally unique... Read more
OS X NTP Security Update 1.0 - Addresses...
The OS X NTP Security Update addresses a critical security issue with the software that provides the Network Time Protocol service on OS X, and is recommended for all users. Version 1.0: Initial... Read more

Latest Forum Discussions

See All

Forget the Gloves – It’s a Cage Match in...
Forget the Gloves – It’s a Cage Match in Real Boxing’s Underground Update Posted by Jessica Fisher on December 23rd, 2014 [ permalink ] | Read more »
Who Wore it Best? Best of 2014
It’s the end of the year, so it’s time for some arbitrary internet awards! In this wrap-up episode of Who Wore it Best? we present our winners for the best, worst, and flat-out weirdest cloned games that graced the App Store in 2014. [ Who... | Read more »
Now You Can Explore Mayan Temples in Ass...
Now You Can Explore Mayan Temples in Assassin’s Creed Pirates’ Newest Update Posted by Jessica Fisher on December 23rd, 2014 [ permalink ] | Read more »
Soft Design aims to do free-to-play righ...
They say a team is only as big as its fans and that’s also certainly the case with video games, judging from the sales certain AAA ‘heavyweights’ get year-after-year. Soft Design took that principle as a core design philosophy and worked closely... | Read more »
Bogga Christmas Tree
Bogga Christmas Tree By Amy Solomon on December 23rd, 2014 Our Rating: Universal App - Designed for iPhone and iPad Bogga Christmas Tree allows young children to trim a tree, any time or place.   | Read more »
Opera Coast 4.0 Launches on iOS with 4 N...
Opera Coast 4.0 Launches on iOS with 4 New Features Posted by Jessica Fisher on December 23rd, 2014 [ permalink ] Universal App - Designed for iPhone and iPad | Read more »
Cricket Kids: Christmas Presents
Cricket Kids: Christmas Presents By Amy Solomon on December 23rd, 2014 Our Rating: Universal App - Designed for iPhone and iPad Cricket Kids: Christmas Presents allows children to play with digital toys opened for the Christmas... | Read more »
Lara Croft & Tomb Raider Mobile Bund...
Lara Croft & Tomb Raider Mobile Bundle – Only $4.99 Posted by Jessica Fisher on December 23rd, 2014 [ permalink ] Lara Croft is coming to you in | Read more »
SimCity BuildIt Review
SimCity BuildIt Review By Nadia Oxford on December 23rd, 2014 Our Rating: :: BUILDING AN OK TOMORROWUniversal App - Designed for iPhone and iPad SimCity BuildIt is a competent city-building game, but its free-to-play trappings are... | Read more »
SimCity Buildit – Tips, Tricks, and Stra...
Hello, Budding Mayors Want to know what we made of all this upgrading and inevitable waiting? Check out our SimCity BuildIt review! SimCity BuildIt is a city-building game from EA. Your job as mayor is to build houses for people to live in, industry... | Read more »

Price Scanner via MacPrices.net

Sony Fixing To Launch Large-Screen Android Ta...
Digitimes’ Aaron Lee and Joseph Tsai report that Sony, which last February exited the laptop computer market with the sale of its VIAO PC-making unit to a group of JApanese investors, is now expected... Read more
After Christmas sale: 13-inch Retina MacBook...
B&H Photo has new 13″ MacBook Pros on sale for up to $150 off MSRP as part of their Holiday pricing. Shipping is free, and B&H charges NY sales tax only: - 13″ 2.5GHz MacBook Pro: $1043 save... Read more
After Christmas sale: 15-inch Retina MacBook...
Adorama has 15″ Retina MacBook Pros on sale for up to $150 off MSRP. Shipping is free, and Adorama charges NY & NJ sales tax only: - 15″ 2.2GHz Retina MacBook Pro: $1899 save $100 - 15″ 2.5GHz... Read more
After Christmas sale: MacBook Airs for up to...
B&H Photo has 2014 MacBook Airs on sale for up to $120 off MSRP, for a limited time, for the Thanksgiving/Christmas Holiday shopping season. Shipping is free, and B&H charges NY sales tax... Read more
Apple now offering Certified Refurbished Mac...
The Apple Store is now offering Apple Certified Refurbished 2014 Mac minis, with models available starting at $419. Apple’s one-year warranty is included with each mini, and shipping is free: - 1.... Read more
Will Apple Build An A-series ARM Processor Po...
In computer terms, it’s been a very long time since the MacBook Air had a major redesign. More than four years have elapsed since Apple recast what had originally been more a pricy boutique device... Read more
iPhone 6s mini With Four-Inch Screen Rumored...
The Times of India’s Komal Mohan, citing a story in The Electronic Times of Taiwan, says that unnamed upstream supply chain sources report that Apple is gearing up to launch a new 4-inch screen... Read more
What’s The Current Value Of Your iOS Apps?
Basel, Switzerland based ConIT AG has announced AppZapp Notify and its free PC and Mac tool available for download. What is the present value of all my downloaded Apps? With AppZapp Notify, for the... Read more
PhatWare Releases WritePad Pro Advanced iOS W...
PhatWare Corporation has announced immediate availability of WritePad Pro 2.0, its advanced word processing, note-taking, and document management app which also takes full advantage of PhatWare’s... Read more
Last minute gift idea: Send an Apple Store Gi...
Send an Apple Store Gift Card by email this season, perhaps as a last minute Christmas gift. According to Apple, “Apple Store Gift Cards can be used to purchase Apple hardware and accessories at any... Read more

Jobs Board

*Apple* Solutions Consultant (ASC) - Apple (...
**Job Summary** The ASC is an Apple employee who serves as an Apple brand ambassador and influencer in a Reseller's store. The ASC's role is to grow Apple Read more
Senior Event Manager, *Apple* Retail Market...
…This senior level position is responsible for leading and imagining the Apple Retail Team's global event strategy. Delivering an overarching brand story; in-store, Read more
*Apple* Store Leader Program (US) - Apple, I...
…Summary Learn and grow as you explore the art of leadership at the Apple Store. You'll master our retail business inside and out through training, hands-on experience, Read more
Project Manager, *Apple* Financial Services...
**Job Summary** Apple Financial Services (AFS) offers consumers, businesses and educational institutions ways to finance Apple purchases. We work with national and Read more
*Apple* Retail - Multiple Positions (US) - A...
Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, you're also the Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.