September 2023

On-Device Content Filtering: Powerful and Privacy Friendly

Month: September 2023

Author: September 26, 2023 by Laurie Mona

Source: https://www.jamf.com/blog/on-device-content-filtering-with-jamf/

You can have more and better security at your organization without having to compromise your employees’ or students’ privacy with Jamf’s new on-device content filtering solution.

The on-device content filter for iOS and iPad OS is a web protection technology Jamf brings to both Jamf Security Cloud and Jamf Safe Internet.

In this session “On-device Content Filtering: Powerful and Privacy-friendly,” presenter Hernán Romero, Product Manager at Jamf, shows what’s so exciting about this new solution.

What does on-device content filtering mean?

Simply put, this feature enables the evaluation of policies on the device rather than the gateway.

Romero says that thanks to more powerful iPhone and iPads and new network APIs from Apple, we’ve been able to move the evaluation of web-protection policies from the cloud to the device.

The on-device content filter uses an Apple network extension to analyze traffic directly on a device. And because of the semi-sandbox architecture of this network extension, we’re able to not only provide more and better security but to do so in a privacy-friendly way.

How is it more powerful?

Because the on-device content filter is deeply integrated with Apple’s architecture in an unrestricted way, we can go beyond the usual domain-based rules.

Expanded areas of filtering include:

URLs – evaluation of full paths and query parameters, even with TLS encryption
IP addresses – block not only single IP addresses but also ranges and subnet
Bundle IDs –full traffic filtering of all incoming and outgoing traffic in iOS/iPadOS apps
Keywords – broad or specific blocking of words and phrases in a URL and HTML body

Romero walked through the traffic flow of on-device content filtering. He explained that once Jamf Trust has fetched a policy from the cloud if the on-device content filter needs to ask threat intelligence for classification, the response is cached on the device. Similarly, if there’s an explicit rule, it’s applied immediately.

The result: fewer round trips versus cloud-based vectoring, which means lower latency and faster end-user experience. Additionally, users with personal VPNs are not able to bypass on-device filtering as opposed to cloud-based vectoring.

How is it more privacy-preserving?

Thanks to Apple’s semi-sandboxed architecture of the network extension, on-device content filtering offers privacy by design.

All evaluation of end-user activity is done in the encrypted site of the network extension where all sensitive data is stored. Once the evaluation is complete, sensitive data is stripped as it passes through the unencrypted part of the network extension before it’s available for reporting.

The result: on-device content filtering gives more and better security in a privacy-friendly way.

Who is on-device content filtering for?

While the Jamf team was building this solution they specifically focused on:

Students and parents – give peace of mind from privacy safeguards built-in by design
Teachers – apply policies as broad or specific as you need them to be
High-compliance environments – make sure sensitive private data stays private
Admins – gain effective and comprehensive tools aligned with Apple principals

As Romero notes, we’re thinking about end users, admins and organizations – it’s an upgrade for everyone.

Check out the full session for a step-by-step demonstration of setup, deployment and usage as well as an audience Q and A.

Register for JNUC to access this session as well as others on demand.

by Pieter Beckmann

Hypothesis: Generative AI at Jamf

Month: September 2023

Author: September 22, 2023 by Laurie Mona

Source: https://www.jamf.com/blog/generative-ai-jamf/

There’s perhaps no hotter topic in tech today than Artificial Intelligence (AI), especially Generative AI.

Here at Jamf, we brought together a team of experts from across the organization to investigate how we can use Generative AI both internally and for our customers.

As Akash Kamath, Senior Vice President, Engineering at Jamf, discussed during the JNUC 2023 keynote, the Jamf Collaboratory was created to pioneer “a new era of intelligent solutions meticulously crafted to enhance Apple device management and security.”

The JNUC session, Hypothesis GenerativeAI at Jamf, features Jamf Collaboratory members David Pryce-Compson, Senior Manager, Data Science and Matt Benyo, Detections Developer, for a discussion on how we view AI, its use cases at Jamf and our first proof of concepts.

Intentional and responsible AI

While it’s been predicted that by 2030 generative AI could lead to the automation of nearly one-third of all work hours, this revolution likely won’t be painless.

We’re already seeing some of the issues with relying on technology for answers, such as the hallucinatory misinformation possible with queries to ChatGPT.

The Jamf team’s approach to AI focuses not only on how can we use the technology, but how we incorporate meaning and care to protect everyone involved and actually offer something valuable.

For use cases both internal and external, our focus is on improving productivity and workflows. How can this technology help save time for both Jamf employees and customers?

The solutions seem to lie in either centralizing various knowledge bases or focusing in on one that is so deep that only a machine can give you the correct and relevant information, based on a specific query.

Proof of concepts

A cornerstone project for the AI team is our new internal knowledge chatbot, Ask Jamf.

This specialized language model marries the capabilities of state-of-the-art large language models with proprietary data derived from Jamf Pro documentation and insights gleaned from Jamf Nation user forums.

As revealed in the JNUC keynote presentation, the Jamf Collabatory has been trialing this generative AI experiment for Apple- and Jamf-specific queries and information.

During this year’s JNUC in Austin, on-site attendees were invited to trial a demo in person at the Jamf station in the expo hall. As expected, we found that the type of queries asked and the results captured demonstrated both the potential and the problems of this type of tool.

Challenges we already know about include:

The “right” answer – may be situation-specific or change over time
Safety – risks of offensive or harmful content, bad advice or unsafe answers
Hallucination – issues with answers given outside the scope of training data
Chat User Experience – if they don’t like the chat interface, may not use it
No Control over user prompts – garbage in, garbage out – not knowing how to query

Hypothesis: weaving warnings into wisdom

Jamf is also working on security features that enable IT teams to do more with less.

By experimenting with a “hypothesis” function within Jamf Protect, we can leverage the collective insights from Jamf Threat Labs and the capabilities of AI to instantly analyze an event and its associated telemetry data.

This three-pronged approach within Jamf Protect incorporates:

Static detection – identifiable malware automatically prevented from running on endpoints
Raw Telemetry – rich information about everything happening on a system
Behavioral analytics – investigation to determine response – this is where generative AI comes in: the “hypothesis” feature

Effective threat analysis benefits from the maximum context, to be able to parse whether flagged behavior is an actual security breach or something less dangerous.

As a management and security platform, Jamf can instantly add valuable context to the AI prompt, including alert and telemetry data, information and context about the detection, information about the organization itself, and even information about the experience level of the admin to be able to produce a tailored response that meets them where they are.

By using the hypothesis feature, Jamf Protect is able to issue a comprehensive, three-dimensional view of the situation, offering the explanations and evidence used in its analysis as well as tailored suggestions for further investigation and remediation.

Evolving technology

The Jamf Collabatory team is continuing the internal development of AI projects and gathering feedback. At some point, the next step will be private beta groups, and finally workshopping new features.

Check out the full presentation for more discussion about Jamf’s forays into AI, including an informative Q and A at the end.

Register for JNUC to access this session as well as others on demand

by Pieter Beckmann

Jamf and Microsoft Entra ID Conditional Access - 1035

Month: September 2023

Author: September 20, 2023 by Jesus Vigo

Source: https://www.jamf.com/blog/security-with-entra-ID-conditional-access/

In this session, learn the best practices of integrating the Jamf suite of products with Microsoft Entra ID to make sure your resources are accessed by your managed devices. Presented by:

Michael Epping, Microsoft
Mark Morowczynski, Microsoft
Sean Rabbit, Jamf

What is conditional access?

In a nutshell, conditional access, or CA for short, is a security policy that aims to strengthen your organization’s security posture by applying zero-trust principles to your cloud apps and services.

Customers who rely on Microsoft for identity and access solutions might know it by its former name — Azure Active Directory (AAD). Morowcznski explains that Entra ID is the comprehensive IDentity as a Service (IDaaS) solution from Microsoft and recaps the different features included alongside conditional access, such as:

Single Sign-On (SSO)
Provisioning
Governance
Passwordless

A common use of CA includes a policy that is configured by IT to limit access to protected apps by devices that do not meet minimal endpoint health requirements. For example, your organization utilizes cloud-based file storage for collaboration between employees. To limit network-based security risk, a policy is configured to require that devices attempting to access data from the service must have a network connection secured with Zero Trust Network Access(ZTNA). The policy enforces device compliance by determining the endpoint’s current state — and if verified to have ZTNA enabled — it will permit the user access to the requested resource. However, if ZTNA does not exist or cannot be verified for any reason, the CA policy will redirect the request to say, a webpage directing the user to enable ZTNA or to install the agent for their device type.

Jamf and CA

Microsoft is one of Jamf’s largest partners. Thanks to its integration capability, integrations between third-party apps/services and Jamf Pro serve to expand the latter’s comprehensive management abilities while allowing the former seamless access to Jamf’s flagship device management platform. The end result is a win-win for our customers that merges the best of both worlds without compromising on security or management.

Discussing how this integration works and providing excellent resources to aid MacAdmins along their integration pathway, Rabbit walks the audience through the initial setup process all the way through to show how the solutions work in tandem during the demo session.

Following the demo, Epping discusses how to deploy Microsoft Entra ID and Jamf Connect to handle:

Identity
Access
User permissions
Security protections

As well as reviewing some common pitfalls that might impact certain organizations and of course, what to look out for to side-step these issues for a smooth, stress-free deployment.

Register for JNUC to access this and other sessions.

by Pieter Beckmann

What’s next for MDM?

Month: September 2023

Author: September 20, 2023 by Haddayr Copley-Woods

Source: https://www.jamf.com/blog/declarative-management-in-mdm-with-jamf/

Katie English, Director of Product Strategy at Jamf, started this seminar from the end: “At the end of the session,” she said, “the goal is that everyone will be overcome with optimism that MDM is going to help them solve the problems that they really care about.”

But first, a brief history of MDM

“Prior to the MDM protocol,” said English. “the only Apple devices you were managing were Macs. When those Macs were managed by the Casper Suite, at enrollment they would get some local binaries, those local binaries would have root privileges, and they would be able to retrieve data about the Mac to send back to a Management Server on a defined schedule. They’d also be able to tell the local client to take programmatic action by downloading packages and running local scripts. We called this the ‘forced pull’ device management.”

Eventually, iPhones changed everything. And Jamf developed Mobile Device Management capabilities. “The change in management style was necessitated by iOS almost never being physically connected to an actual network, and also by its heavily sandboxed system architecture.”

Gone was an agent with root-level access periodically contacting a management server. MDM necessitated push notifications.

A device that maintains a persistent connection to Apple pings their core services, and asks Apple to have the device ‘phone home’ to receive a setting, install a command, or install an app.

MDM 101

“This is MDM 101,” said English. “The tech we’ve been using alongside the Jamf Management Framework for nearly 13 years.” As a matter of fact, Jamf Pro still uses binary-related pull actions and MDM push commands.

The future of device management

“Of course,” said English, “the protocol has gotten some new tricks since then. We’ve got heaps of commands, tons of granular settings.”

Enter Apple’s announcement in 2021: “The future of device management is declarative management.” This is really quite definitive.

“So here we are, a year after that,” said English, “and Apple is continuing to invest in this new Declarative Management protocol, which thankfully operates right alongside traditional MDM.”

Legacy MDM workflows

“Remember that traditional MDM relies on a device having a persistent connection to Apple, and a management server asking Apple to have a managed device ‘phone home’ to receive a command or a query,” said English.

An example:

The command might be “update your OS.”
Then the subsequent query might be, “What’s your OS right now?”
An admin might then ask again to ensure the command went through correctly: “How about now? How about I check again tomorrow?”

Traditional MDM means admins get acknowledgments when commands have been received or completed, and we can get a lot of information back from the device when we ask.

“But we have to ask,” said English. “Repeatedly. And we get a lot of duplicative information back. Repeatedly.” For commands that are complex or contain conditional workflows, the flow of information back and forth increases. Asking your management server to parse that information and possibly perform calculations against the changes can trigger resulting commands and queries

How does Declaration Management work?

Declarations are the polar opposite and can send far more detailed up-front instructions that tell the device how to behave under a set of conditions. That set of instructions combines with status reporting to alert the management server when certain values change on the device.

“So, rather than the frequent polling and verbose responses and reactive MDM actions based on what the device eventually reports in response to queries,” continued English, “the management server can simply compose a set of instructions, send that to the device, then the device can behave autonomously without nearly as much traffic back to MDM.” And it does this, she pointed out, without nearly as much calculation-intensive behavior on the management server itself to tell the device what to do next.

“With that single sparse value update for that device record,” English continued, “the management server can do whatever additional processing needs to do in regard to remediation workflows, enabling or restricting access to organizational data, that kind of thing.”

Jamf started with basic declarations and status updates in Jamf Pro 10.42 last year and offered them in Jamf School earlier this year. Jamf has now taken the next step to adopt software updates by declarations, now available in Jamf Pro , and coming soon to Jamf School.

English used software updates as a way to illustrate where things are going, walking attendees through workflows to update software as well as the ways Apple has pushed it a step further with:

Client-side notifications
The ability for users to update ahead of the target enforcement time
The ability for users to schedule the update with local client logic

English expects that Apple will iterate enhancements to this functionality as they move forward, reminding admins that a few years ago they were probably using policies or scripted commands to invoke the softwareupdate binary. Now, after the advent of the first M1 Mac, the behavior has changed. Authentication requires an MDM bootstrap token and updated OS, and/or a user password for local user-initiated updates.

“Unattended policies triggered by a script or by a local agent with root privileges basically went away,” said English.

What’s next: Apple evolves

English surmises that this change may mark the beginning of a trend. “Programmatic access to certain binaries will continue to be deprecated in favor of ‘MDM should do it instead’ or ‘the end user has to interact with admin rights to make it happen.'”

“It’s easy to see,” continued English, “particularly from a security perspective, why Apple would make these choices. Say a user inadvertently downloads an app with malware bundled in it. When they install it, the payload wants to access a local binary outside of the app bundle to change its privileges or get access beyond the app sandbox. If you have to stop and enter a password to do it, that might just be enough friction to prevent the ultimate invocation of that malicious binary action.”

The industry has also seen a similar change regarding kernel extensions and the extra burden required for an end user to install them without MDM intervention.

“Administrative actions will increasingly require proper administrative tooling,” said English. “I predict that you’re gonna need MDM to do more things that you’re used to scripting.”

Degrees of management

As further evidence of this trend, English pointed to the BYOD workflow, with User Enrollment that has a deliberately limited subset of MDM functionality and visibility. “Management can do some stuff,” she said, “but user data is ignored, and user choices aren’t arbitrarily overridden by a management command.”

So what conclusions could we draw from account-driven workflows, consumer devices, and the future of MDM? The key is Managed Apple IDs. They unlock many new workflows, and their functionality will evolve.

English believes that the industry will continue to see degrees of management as enabled by Apple IDs.

“The amount and kind of management applied to a device is necessarily getting more complicated,” said English. “It’s not as cut and dry as it used to be: full management or nothing at all. There’s an acknowledgment that end users are getting pretty savvy and may object to the collision between personal data and work data, and that MDM has to offer experiences that mix and mingle enterprise needs with consumer desires.”

Trusted Access

Trusted Access, English believes, will become a declaration rather than a series of reactions— making it easier and more secure.

At Jamf, Trusted Access is the combination of management and security solutions that ensures the right people on the right devices have the right access to resources in your organization. “This is something that we at Jamf care about a great deal,” says English, “and if you haven’t already checked out our webpage, you should.”

“As admins, we are really used to security being a reactive process, said English. “As Declarative Management matures and offers more arbitrary interactions, admins will be able to simply define the state for compliance and devices won’t be able to deviate from it.”

All of this means that MDM, by way of enhancements with Declarative Management, will permit admins to make devices more secure by default, and staff will know more quickly when a vital condition changes.

What’s next: Jamf extends

“So while Apple continues to evolve MDM,” said English, “let’s talk a little about what Jamf will be doing to turn raw functionality into problem-solving for admins.”

Apple has given Jamf many opportunities this year.

“I’ve talked about Trusted Access, which is sort of a holistic approach to manage and secure devices, but to zero in on a more specific example, I’m just going to pick a specific feature available this year, which is the Return to Service command.

English then walked attendees through how this command has changed and how it enhances workflows for Jamf Pro and Jamf School.

Jamf has also, she pointed out, been able to enhance existing tools like Self Service with these new opportunities which makes these tools even easier to use and even more effective.

What’s next: Don’t panic

“[Declarative Management] is the next direction. I don’t think it will affect what I do too much. Overall WWDC was a bunch of bright shiny toys I won’t get to play with.”

— a Jamf customer, during a UX Research interview

“I sympathize,” English admitted. “Change can be really quite unsettling, and some organizations actively discourage it. I also was a change-averse admin, and scripting literally everything was totally okay with me. But I am hoping that we can start to shake off the worry about change— because how MDM is evolving, change is actually pretty cool.”

English believes that even skeptical or fearful Apple admins will see the value in MDM’s evolution.

MDM, English says, will be:

More secure (by permitting declarations to set compliance out of the box, and by limiting programmatic interactions with low-level binaries)
More native (by enabling end-user interactions based on declarations)
More useful over time (by iterating on the already strong foundation of MDM with DDM)

You’re not alone!

In addition, Jamf is here to help you use MDM to solve real problems, just as we have with Software Updates and Return to Service. Jamf helps admins to adopt new features more quickly by optimizing our architecture to iterate and deliver features faster. And Jamf enables you to manage and secure your Apple devices to your specific organization’s standards.

Register for JNUC to access this and other sessions.

by Pieter Beckmann

What is Mobile Security?

Month: September 2023

Author: September 15, 2023 by Jesus Vigo

Source: https://www.jamf.com/blog/what-is-mobile-security/

Simply put, mobile security is the protection of smartphones, tablets and mobile computers (laptops) from security threats.

What is mobile security?

While it is typically defined in scope to specifically call out threats associated with wireless computing, this could be misleading as there are threat types that do not rely on wireless communications to be considered successful attacks, like device theft or exfiltrating data locally to a USB flash drive.

Why is mobile security important?

Similar to computer-based security, as more users and organizations come to rely on mobile technologies for communication, collaboration and working while on the go, mobile devices are increasingly being leveraged to contain, process and/or transmit sensitive data. While this bears little difference to desktop computers in usage, the difference for mobile security lies in that mobile devices provide new ways of performing personal and professional tasks, in turn introducing new forms of risk that endpoint security solutions designed for desktop computers may not and usually do not address comprehensively.

For example, given the nature of how mobile OS’s are designed, most malware targeting mobile devices thus far operate within resident memory once executed. Once a smartphone or tablet is power cycled, the memory is flushed, and the threat is removed until it is triggered once again. However, users seldom reboot their mobile devices, leading these threats to linger on, causing untold havoc.

Conversely, on desktop operating systems, malware works nearly identically, except that there exist multiple ways by which malware authors can establish persistence, allowing them to retain a foothold within the computer even after being rebooted. Therefore, endpoint security for desktop systems scans memory as well as the system itself for other Indicators of Compromise (IoC). Once identified, the remediation workflow executes to remove the threat.

Though both slightly differ, in the background there are significant differences in how endpoint security operates between mobile and desktop computing platforms. It is this difference, paired with the explosive growth of mobile security and the fact that, after all, mobile devices do utilize network connections to communicate with apps, resources and services over the internet, that poses a greater risk to securing data and end-user privacy. This includes acting as a conduit forfacilitating larger-scale network-based attacks – as well as future attacks being actively developed – if left unchecked.

Out-of-the-box, mobile security is not enough

Many who follow our blog know how pivotal security and privacy play when using technology. One of the leaders of this discussion arguably is Apple, whose commitment to both is witnessed in its consistent inclusion of security and privacy frameworks that serve as a tentpole of the platform.

In fact, since its inception on the iPhone by way of Touch ID, Apple has included the security and privacy framework into every piece of hardware – mobile and desktop computing alike – ensuring that anyone using a device across its entire product line will find the same level of protection. However, discussing mobile security requires Microsoft and Google, alongside Apple, and relates not just to smartphones but tablets and wearables as well.

Even with all their security-focused features in tow, ones like device encryption or biometrics as mentioned earlier, mobile security requires a comprehensive approach in order to keep mobile endpoints safe and ensure data security. This doesn’t imply an inherent weakness in the devices themselves but rather speaks to the nature of the evolving mobile threat landscape. Specifically, one that is impacted by dynamically occurring changes that are hard for organizations to keep up with. For example, in their rush to deploy mobile devices, many businesses overlook the following:

Critical security protocols that expose them to potential threats
Holistic endpoint security that addresses existing threats, as well as novel threats
Rigorous security hygiene procedures that begin with device provisioning and deployment
Ensuring mobile devices adhere to strong baseline settings
Adherence to security standards that are crucial for maintaining organizational integrity
Failure to meet/maintain compliance due to rapid adoption of cloud-based services
Lack of understanding increased risk factors associated with the rise of hybrid work patterns
How the expansion of native apps challenge the current enterprise mobility model

While we could go on about endpoint security in general, the focus of this blog is specifically on mobile security and how the growth of this segment has led to mass adoption at a global level. Furthermore, said adoption has fueled incorporating mobile technology into many different industries, from education with a 1:1 program for students to supply-chain andlogistics where they serve as invaluable tools to get supplies where they need to go fast and to remote/hybrid work environments in every industry, thanks in no small part to its blend of powerful computing and lightweight form factor. The ubiquitous design lends itself to helping users access critical resources at any time, from anywhere.

And therein lies the rub, doesn’t it? How does an organization manage mobile devices without diluting the powerful, yet easy-to-use platforms while at the same time not compromising security at the expense of convenience? Or how about the common tradeoff that occurs when incorporating security by ensuring that it does not compromise end-user privacy in an all-consuming aim to secure mobile devices?

As we’ve seen historically, sadly there’s usually a tradeoff when implementing a mobile security plan. The compromise to efficiently being able to work from anywhere is often mobile security as organizations typically fall into the trap of over-protecting or under-managing. Regardless of the category your company falls into, however, the end result remains the same: devices, users and data are left vulnerable.

By ensuring that data security and privacy are always at the forefront (and never an afterthought) of any process running on mobile devices, they don’t have to be.

How does mobile security impact organizations?

Like cybersecurity in general, mobile security affects multiple aspects of an organization — not just its devices, users or data — though these are certainly factors that are critically affected and often what you hear about most in the media. Some of the other ways mobile security impacts organizations are:

Loss of company integrity and its public perception/reputation
Ceasing of business operations and preventing business continuity
Leaking of confidential information, like trade secrets
Civil and/or criminal liability stemming from violating compliance regulations
Device compromises that lead to lateral network movements and subsequent data breaches
Unauthorized access to protected user data, like PII and PHI
Hindering the potential of mobile workspaces and distributed workforces

It’s important to note that, while any or potentially all of these security issues may impact your organization, this information is not intended to scare, but rather to inform. Being aware of the mobile threats that exist and how they impact organizations is the first step toward implementing a defense-in-depth strategy that holistically and comprehensively manages mobile devices while mitigating the current and growing list of mobile threats.

Types of mobile security threats

Below is a list of key threats affecting mobile security. By no means is this list exhaustive or future-proof but doesprovide insight into various types of threats so that IT and users alike have a better idea of the vulnerabilities and attack campaigns threat actors are currently leveraging when targeting mobile endpoints.

Phishing: Social engineering, or campaigns that leverage SMS, email, phone calls, social media and messaging software that tricks end users into divulging sensitive information, such as passwords, or gets them to click on malicious links to compromise mobile devices.
Malware: Malicious code or applications that compromise the security and privacy of endpoints and users respectively in order to achieve a particular means, or several of them, depending on the malware type or how they’re combined. Examples are:
- Ransomware: Encrypts private data and prompts the user to pay a ransom for the decryption key or risk losing data forever.
- Spyware: Gathers information on users, such as what websites they visit, logs keystrokes and copies cookies to allow actors to attack their devices and hijack their sessions.
- Adware: Delivery of advertisements for products and services to get users to click on them to further compromise a device. Also used to deliver malware to devices.
- Stalkerware: Similar to spyware, data gathering takes steps to include webcam, photos, telephone and text conversations to track user’s whereabouts, including leveraging GPS to physically track victims.
- Cryptomining: A tiny program that utilizes hardware resources to mine cryptocurrency for bad actors. Reduces performance and may impact normal device operation.
- Potentially Unwanted Program (PUP): While PUPs do not have to be malware, typically unwanted apps are packaged together, residing unbeknownst to the user on their device, possibly leading to greater security risks in the future.
- Trojan: Programs that are masking their true intention, such as malware being repackaged as a legitimate app. Additionally, several trojan apps are legitimate apps that have been cracked (has their internal security broken) to include malicious code. These may be distributed via third-party app stores as free versions of commercially licensed software.
Loss/Theft: Mobile devices, by nature, are typically removed from offices and/or homes, taken to remote locations to work from alternative locations. This increases the likelihood that mobile devices are lost, misplaced or targeted for theft by criminals, placing the contents of those devices – sensitive data and privacy information – at risk of compromise.
Man-in-the-Middle (MitM): Also known as “eavesdropping”, this attack is quite common wherever unsecured Wi-Fi hotspots are available. This allows unsuspecting users to connect to unencrypted wireless networks, where attackers may intercept their communications and/or leverage it to gain access to their devices.
App Permissions: Granting app permissions to resources is not uncommon nor a big cause for concern generally. However, when apps are granted improper permissions or these apps abuse the permissions granted, this may lead to violations of privacy and/or data exfiltration.
Patch Management: Updates to apps, the operating system and hardware components are made available by developers to fortify the software and hardware, protecting it against known attacks by mitigating vulnerabilities. Without updates in place, devices and apps may become vectors for attacks, compromises and further data breaches.
Weak/No Passwords: Weak passwords that are easily guessed, not changed from their default or simply not enabled at all represent the “low-hanging fruit” for bad actors. Sometimes, the only protection standing between a compromised device and one that has not been compromised is a strong, unique password to keep data safe.
Encryption: Fitting hand in glove with weak/no passwords and device loss/theft above that, encryption is often considered the last bastion of security when a device is no longer accessible. Whole disk encryption scrambles the internal data using powerful algorithms that are nearly unbreakable (or may take a few thousand years, give or take) when a strong, unique password is enabled, utilizing multiple key spaces for greater complexity.
Unsecure d Connections: Open Wi-Fi hotspots do not offer any security protection – just internet access. This leaves your devices, data and the network connection being used to communicate all open to threats. It also leaves the resources you’re connecting to on the other end open to attack as well. Securing untrusted connections via VPN encrypts transmissions and connects to endpoints within a secure tunnel to keep free from unauthorized access. Zero Trust Network Access (ZTNA) offers the security of a VPN, while also providing device health checks before granting access each time a resource is requested.
Misconfigurations: Misconfigured devices, those that have kept default configurations in place or have fallen out of compliance are at a greater risk of being compromised by threats than those that have been hardened against common threats by limiting the available attack surface of your mobile device.

Benefits of having a mobile security solution

Let’s start with the most obvious reason, though it may seem like two reasons, they both go hand in hand as mobile device adoption rates worldwide have and continue to grow at breakneck speeds.

Just how deep is mobile penetration, you ask? According to a survey performed by Statista, in 2023, “the current number of mobile phone users is 7.33 billion, which makes 90.97% of people in the world cell phone owners.” If we factor out feature phones, choosing to only account for smartphones, then “the current number of smartphone users in the world today is 6.92 billion, meaning 85.88% of the world’s population owns a smartphone.”

That figure represents only smartphones. Despite taking a majority of the market share in the mobile device space, it still leaves out other popular device types, such as tablets and wearables, like smartwatches. Each of these devices are also being utilized by users for personal usage as well as at work.

Each mobile device that:

Processes business data
Uses work-related apps
Accesses organizational resources
Connects to company networks

Even if doing so alongside apps and data for personal use, that isn’t properly managed and secured, poses a risk to the enterprise, compliance and the user’s privacy.

A comprehensive mobile security strategy — one that integrates alongside your existing Mac environment — that provides a holistic management and security plan ensures that:

Protection extends uniformly across the infrastructure
All endpoints are secured against modern and evolving threats
Business resources and user privacy data are safeguarded, regardless of whether devices are company- or personally-owned
Users can work from anywhere, on any device and over any network connection securely
Ever-increasing risks impacting devices, users and data are effectively mitigated
Organizations maintain compliance with regulations

Types of mobile security solutions

If you haven’t guessed yet, there are a lot of real and potential threats affecting mobile security. And if it continues its rate of growth, it is estimated that approximately 8+ billion mobile devices will exist globally by 2024. While it’s unlikely that every single one of them will be attacked, any attempt to quantify a figure will be pure speculation given the number of variables.

What is known are the mobile security solutions available, how they work and why they’re necessary to protect your mobile fleet and keep your users, devices and data safe and secure.

Zero Trust Network Access: ZTNA as its referred to, secures network communications similar to VPN, while providing additional safeguards that protect resources, such as apps and services. With built-in device health checking, IT gains granular insight into devices, including patch levels, if devices are compromised or affected by malware and whether they meet organizational requirements, before access to individual resources is approved. Resources are segmented from others for the purposes of maintaining security; this way, if a user’s access has been compromised for a particular app, only that app is affected and users may continue to work on other resources without fear of lateral movement compromising other resources. Devices failing health checks are denied access, then placed into remediation where the issues are mitigated before access can once again be granted.
Mobile Endpoint Protection: Preventing malware is just one part of the mobile security equation. Mitigating threats from phishing, by identifying and blocking domains that leverage malicious URLs in their campaigns and zero-day attacks is a significant step forward in protecting your mobile fleet. Further security from network-based attacks, such as MitM, as well as compliance checking that allows organizations to align requirements to Acceptable Use Policies (AUPs) to minimize misconfiguration of settings through policy-based management further strengthens your device’s security posture and that of your infrastructure – regardless of whether it is local, cloud-based, public and/or private – or a combination thereof.
Website Content Filtering: Implementing intelligent content filtering of malicious websites to not only minimize the threat from phishing websites, but additionally the reduction in legal exposure from inappropriate use and/or illicit websites while leveraging network-aware security controls that safeguard cellular, wired, roaming and Wi-Fi connections provide an additional layer of protection. Seamless scaling across multiple management models, such as BYOD/CYOD/COPE, for enforcing AUPs on company-owned and personally owned devices alike ensure that organizational resources are protected equally as is end-user privacy – not at the cost of one another.
Patch Management: No device management would be complete without discussing the apps and devices through their lifecycle. Ensuring that both are sourced and updated, that critical configurations are set properly and consistently across all device types, all while providing a centralized management platform that allows end-users the flexibility to do their work from anywhere, at any time without placing limits on their efficacy – and simultaneously permitting IT and Security teams to quickly respond to any number of issues in real-time. And let’s not forget the capability of supporting the very latest security features, new functionality and software updates from day one.

Why your mobile devices need as much attention as your Macs

If your company secures Mac computers, why are you not securing mobile devices?

Regardless of your industry or regional location, organizations worldwide have and continue to adopt Apple devices for work. Consider that less than two years ago in 2021, Apple’s annual revenue was $365.8 billion dollars! The percentage of that revenue generated from iPhone (51.9%) and iPad (8.8%) combined sales was 60.7%. The Apple Watch alone sold more than iPad and Mac (9.8%) individually, accounting for 10.4% of the total revenue.

There’s clearly a demand for mobile devices running iOS and iPadOS, among others running Windows, Android and Chrome OS. More devices equals a higher potential of introducing risk into your organization.

If they are different, why do they need the same level of security?

Well, they are computing devices after all and more to the point, ones that utilize and rely upon the same types of apps, services and processes to get work done safely and securely. Sure there are differences in the ways which mobile device and desktop computer operating systems handle certain processes or the workflows by which users can be productive within these respective OS’s, but make no mistake — they share just as many similarities when it comes to data security as they share differences — making it critical for admins to embrace the similarities while minimizing the risk that the differences could introduce if left unchecked.

How do mixed environments, using personally- and corporate-owned devices, impact mobile security?

For organizations that do not have a mobile device security plan in place, the reality is that there is little difference discerning personally-owned devices from corporate-owned ones when viewed through the lens of risk management. Without the comprehensive protections in place to prevent malware, secure network connections or separate business data from personal data with segmented and encrypted volumes, organizations will experience great difficulty in determining if device meets compliance, is authorized to access sensitive resources or has opened the door to a data breach after a unpatched vulnerability has been exploited by threat actors.

In other words, IT and Security teams lack the necessary insight into device health in real-time to truly understand the security posture of the devices themselves or how that impacts the organization’s overall security posture.

Now, let’s flip this around. Your organization does have a mobile device security plan that’s integrated alongside the larger, holistic security plan. How does that change things?

For starters, there’s protection against modern threats. Not just ones that impact desktop or mobile operating systems, but rather all supported platforms — regardless of the device type or ownership model. Next, there’s coverage that protects the infrastructure comprehensively. It spans across devices, users, resources and data repositories to ensure that security is a fundamental requirement that is addressed top to bottom and end to end.

What are the use cases for mobile?

It used to be that mobile devices were not really used by consumers, let alone for business. This goes back almost a decade until the smartphone began to gain the interest of enterprise users, like those that relied on Blackberry to communicate over IM and email while on the go.

With the release of the first iPhone in 2007, users took to the sleek device with its promise of desktop-like features without carrying around a laptop or something far heavier. Years later, the rise of native mobile applications, increased adoption of cloud-based services and greater performance and efficiency have effectively placed a thin, lightweight computer in the pockets of billions of users globally.

Mobile devices have expanded since then, to encompass tablets and smartwatches, to greater fanfare and some incredibly simple yet powerful workflows that help keep users productive — working smarter, not harder.

Any scenario is a use case for mobile. That said, some of the more commonly seen ones by industry are:

Healthcare: Health practitioners have taken to mobile technology to perform wellness checks through tele-health sessions with patients.
Education: Students rely on 1:1 programs that have transformed how teacher’s deliver lessons while effectively exchanging multiple books, paper, pencils and other materials for a tablet.
Logistics: Cloud-based services combined with tablets and smartphones allow teams to manage inventory, ensure manifests are accurate or track product shipments anywhere across the globe.
Retail: Large, clunky POS systems and antiquated credit card imprint machines have given way to thin, large screened mobile devices that simultaneously handles sales transactions, keeps a database of customer information, provides up-to-date inventory data in real-time and does it all with a tap or two.
Finance: The FinTech industry has adopted mobile in ways that make it easier than ever before for consumers and businesses to keep track of their financial standing and myriad investments, all without having to stand in line at the bank.
Sales: Long the trappings of the road warriors, mobile devices lend themselves to greater performance while sipping battery power and allowing teams to keep in contact from just one, lightweight device.
Aviation: Pilots must carry nearly 40lbs. of documents, like navigational maps and aircraft manuals in their kitbags. With the adoption of tablets, the clutter and weight was reduced to 1.5lbs as part of their electronic flight bag.

Why is now the right time to invest in mobile security?

When it comes to security, there’s an aphorism, more anecdotal in nature that identifies the time before a security incident as being the time when businesses do not feel the need to invest in protection because it’s deemed an unnecessary expense…until a security incident occurs and then, businesses are much more willing to throw money at the incident in order to make it go away.

Simply put: when things are quiet, it’s easy to lose sight of the good endpoint security is doing because security incidents are being mitigated.

Another way of looking at it is that the best time to invest in mobile security is not when your organization is under attack, but rather when IT and Security teams can work together to properly implement the technologies they require to address the unique requirements of the organization without hasty measures being taken to “clean up the mess as quickly as possible.”

Conclusion

Mobile security is a critical, sometimes mismanaged and often overlooked aspect that is part of a greater, holistic security plan. One that comprehensively protects devices, as well as users and business resources, from the modern threat landscape that includes current and novel threats.

Exacerbating the mobile security dilemma is the fact that user adoption of mobile computing devices continues to rocket with global adoption rates that are second to no other hardware technologies. The increase in devices married with the advancements in mobile technologies means that greater usage and reliance across platforms and touching just about every industry.

When combining the above with continued business migrations toward distributed work forces and the increased targeting of mobile devices by threat actors, organizations shouldn’t want to protect their entire fleet of devices — company- and personally-owned alike — from threats…they need to protect their infrastructure to remain compliant and keep resources safeguarded.

And one of the keys to protecting your environment lies in the integration of mobile security alongside your existing security strategy to ensure there are no gaps in protection — just seamless security that protects all your endpoints without compromising the efficacy of solutions or impacts to user privacy while upholding the user experience.

Mobile security is a critical part of your infrastructure

and should be integrated alongside your existing security plan.

Request Trial

by Pieter Beckmann

JNUC 2023 Keynote

Month: September 2023

Author: September 19, 2023 by Haddayr Copley-Woods

Source: https://www.jamf.com/blog/jnuc-2023-keynote/

John Strosahl, Jamf’s CEO, kicked things off with a welcome to the excited crowd in Austin, as well as the thousands more joining remotely.

Austin was our biggest JNUC yet with more than 3,000 in-person and virtual attendees and over 150 sessions covering a wide array of topics.

“A lot has happened since we last got together,” said Strosahl. “I’m pleased and humbled to lead Jamf as its new CEO and to continue partnering with Jamf Nation to understand your needs and help you all positively impact the employees, students and patients you serve.”

Strosahl outlined the uncertainty we all face in our work lives and the challenge to do more with less.

“We are facing a more dynamic threat landscape than ever before,” added Strosahl. “Toss in a growing remote workforce, and it’s fair to say we all have a lot on our plates.”

“But one thing hasn’t changed,” he said. “Our focus on helping organizations succeed with Apple hasn’t and won’t change, because we are needed now more than ever.”

Apple growth

Apple adoption is on the rise. More enterprises are turning to Mac. The International Data Corporation (IDC) anticipates a 20% jump in Mac computers sold to business users this year and next. iPhones are already the dominant provider in many geographies for employee devices, and iPads are being used in more industry workflows than any other device.

“When given a choice,” said Strosahl, “today’s workforce chooses Apple.”

It’s because of that choice that we believe Apple will be the predominant endpoint in the enterprise.

Challenges of a platform-agnostic tech stack

The reality for many Jamf customers is that delivering a consumer-grade Apple experience in the workplace, school or medical facility is hard.

Some organizations try to stitch together different management and security solutions, which can lead to complex integration and will lead to a poor user experience.

“When you take a platform-agnostic approach to your tech stack,” said Strosahl, “you’re unable to support the rich array of experiences that are possible with Apple devices.”

Jamf AND

“We continue to offer and expand our industry-leading Apple management AND security solutions because customers have told us you need more from Jamf to make Apple successful in your organization,” said Strosahl.

Jamf helps our customers deliver an experience that their users love AND one that their organization trusts.

“And we relentlessly bridge the gap between what Apple provides AND what the enterprise needs,” said Strosahl, “everything we do and will do in the future is focused on that ‘AND.’”

“At Jamf, we’re not just thinking about the Mac,” he continued. “We’re thinking about the entire Apple experience across Mac AND mobile devices. That way, users can move seamlessly from Mac to iPhone to iPad without interrupting work— all while staying connected and productive.”

“We’re not just thinking about management,” said Strosahl. “Deployment is no longer the destination, but rather a step towards achieving a productive and safe workforce. We’ve expanded our capabilities to deliver integrated management AND security workflows so that your teams can focus more on delivering business outcomes with the confidence that your organization will meet IT and InfoSec requirements.”

“And we’re not just thinking about the traditional desk-bound worker,” he said. “Apple devices are used in many innovative ways across industries and around the world. The reason we are able to do all of these ANDs is because we focus on Apple. We’ve said many times ‘when Apple innovates, Jamf celebrates,’ and we follow their lead.”

Management, security, identity

Jeremy Butcher, Director of Product Marketing at Apple, joined us on the stage to discuss management, security and identity.

“We love seeing Apple devices being used every day at work and school,” said Butcher, “whether this is to teach a subject to a class or to enable and simplify business workflows.”

“We focus on three key pillars.” He continued.”Management, identity and security.”

Managed Apple IDs

Managed Apple IDs provide access to various Apple services and are owned by an organization. They can be created manually in Apple Business Manager and Apple School Manager, or automatically using federation with an identity provider.

Butcher announced updates and improvements Apple is offering:

Expand access to iCloud services
Access Wallet, Continuity, and iCloud Keychain
Access management controls

Account-driven enrollments

“You can now sign in to enroll your device into management. We think that is a way easier, much more friendly way for the end user to actually enroll,” said Butcher.

Apple users can enroll their devices using their Managed Apple ID directly from Settings and System Settings.

Zero-touch deployment

Butcher also announced new zero-touch deployment features:

Require minimum OS version
Enforce FileVault
Enforce enrollment

“We’re also bringing time and date update enforcement into the MDM protocol,” said Butcher. “We’re super excited to bring this into the protocol to make it easier to also tap into the operating system capabilities. So if you want to do something at 5:00, it’s going to be done at 5:00, no matter where that device is located.”

Management for watchOS

“Management is coming to Watch OS 10!” said Butcher.

With watchOS management, you can now:

Manage iPhone and Watch together
Enforce security settings
Configure networking and per-app VPN
Remote lock and erase

Jamf Nation was enormously pleased that Apple again sent a representative to talk to an excited JNUC crowd.

Manage and secure Mac and mobile

Sam Johnson, Chief Customer Officer for Jamf, discussed the necessary merging of management and security.

“Apple and Jamf couldn’t be more aligned: management, identity and security!” said Johnson.

“The reality of the world we live in is that these concepts of management, identity and security are no longer in isolation,” said Johnson. “The lines of responsibility between management and security are fluid, and we have to find a balance. It is now the combination of these concepts together that allows you to provision and secure your end users. And after 21 years, we remain dedicated to just that.”

Jamf does this by offering the most comprehensive tools that work with the Apple platform across all devices: no matter who owns them, no matter where they are working and no matter what network they’re on.

Jamf is how you simplify work and embrace and extend the Apple platform for your organization instead of separating the endpoints by device type.

Trusted Access

Jamf’s ultimate destination? Trusted Access: Jamf management and security combined. A truly purpose-built, Apple-best, zero-trust solution.

Trusted Access means that users who gain access to sensitive applications and data must be:

Authorized users
On enrolled devices
Secure and free from threats

So let’s start down the road to Trusted Access by wiping the slate clean. To fully appreciate the outcome, we start with the device itself. And there has never been a more powerful tool to manage devices than Jamf Pro.

Software Updates

Veronica Batista, Senior Manager in Product Marketing and Market Intelligence, took the stage to delve into Trusted Access.

Achieving Trusted Access starts, she explained, with a trusted device.

“Management is the foundation,” said Batista. “After all, you can’t secure what you can’t see.”

Most attendees to JNUC have already begun on the path to Trusted Access by using Jamf to enroll and automate their organizations’ device management.

Jamf Pro 11

“And we are always striving to make this better,” said Batista. As proof of this, Jamf recently released Jamf Pro 10.50: an exciting release that once again provided same-day compatibility for Apple operating systems.

Same-day compatibility with Apple OS’s

Same-day compatibility is important to Jamf because it is the best way to simultaneously protect our customers from unnecessary risk while also providing the best features and user experience possible.

“Same-day compatibility,” Batista continued, “has always been in our DNA.”

Realizing our vision

“We have a vision,” she said, “for how this should all come together. That’s why today we are taking that first important step on the path to a single Jamf platform experience.”

It all starts with Jamf Pro.

“Let’s say goodbye to Jamf Pro 10,” said Batista, “and hello to Jamf Pro 11!”

Jamf Pro 11’s new interface

“We’re so excited,” she continued, “to deliver this new version of Jamf Pro with an entirely refreshed user interface. This sleek and modern look complements the powerful workflows that only Jamf Pro can deliver, giving you a more versatile and enjoyable experience.”

The new interface also delivers important enhancements to accessibility compliance, including:

Color changes
Tab support for navigation elements
Improved screen reader behaviors

“But the evolution of Jamf Pro is more than just a pretty face,” said Batista.

New shortcuts and automated workflows

Jamf Pro 11 offers easy shortcuts and automated workflows for many of the most popular Jamf Pro tasks:

Guidance in creating a Smart Group
Integrations with Slack and Microsoft Teams, allowing for notification directly in Jamf Pro
Declarative Device Management
The ability for admins to schedule and enforce the latest software updates on managed devices by a specific date and time through Jamf Cloud
Automated device updates

Account-driven device enrollment

Jamf Pro 11 will also support Apple’s recently announced enrollment workflow enhancements with account-driven device enrollment for macOS Sonoma and iOS 17. This enables users to easily enroll their institutionally-owned devices.

These enhancements offer a consistent enrollment experience with identity federation for your organization’s cloud identity provider and prevent bad actors from pretending to be legitimate device enrollment sites to gain control of a device.

How account-driven device enrollment works with Jamf Pro

“Let’s say,” said Batista, “a device was procured by an individual department outside of formal procurement channels. If a user walks into the Apple Store and uses their corporate card, that device probably won’t enroll through automated enrollment.” In fact, IT may not even realize that the device exists— and that it may be accessing sensitive work resources.

Batista outlined the two options Apple users had in the past for enrolling a device into management: one, wiping the device and then sending the user through automated enrollment; unfortunately, that can hurt productivity. Two: directing users to an enrollment URL, which opens up a major risk vector.

Instead, Batista used an iPhone 17 to run attendees through the workflow that Jamf Pro supports today:

Navigate to settings
Sign in with work credentials
Follow guided enrollment steps that bring that device under management

The same workflow applies to macOS Sonoma, which Jamf will also support soon.

“This enrollment didn’t require any special app or URL and the user didn’t have any downtime,” said Batista, “which allowed them to get right back to work.”

And just like account-driven user enrollment, account-driven device enrollment maintains user privacy by separating personal and corporate data and apps on the device.

Onboarding

Coming soon in Jamf Pro 11: a simple, transparent Mac onboarding experience that allows users to monitor app installation progress while getting immediately to work. ”With this new onboarding experience,” said Batista, “we are able to show users information pertaining to Jamf apps, taking the first step in a journey toward unifying all Jamf experiences together for the user.”

Jamf Cloud Distribution Service (JCDS) 2.0

Updates to JCDS will interest those who host different types of content such as packages, in-house apps and books.

Jamf’s new version of JCDS:

Increases performance
Makes uploading larger file sizes easier
Offers public API endpoints to programmatically upload, download and delete content

NEW: Jamf Remote Assist

“When it comes to interacting with a remote device, easier is better. The integration within Jamf makes this process effortless . . .”

— Jonathan Krauet, Mac@IBM

Jamf Remote Assist offers secure in-product remote screen sharing, allowing admins to assist end users on macOS devices with troubleshooting steps.

“When a user has a support issue,” Batista explained, “Jamf admins can securely initiate a Jamf Pro remote assist session, even when the user is not on the internal network. This is all within the Jamf Pro UI, making it easy and secure to remotely access and manage devices within their fleet.”

”We are excited to let you know that Jamf Remote Assist will be available later this year,” added Batista.

Visit the “Experience Jamf Remote Assist” JNUC session if you’d like to learn more.

First beta of Jamf Pro available

“I’m excited to announce that the first beta of Jamf Pro 11 will be available later today!” said Batista. “We expect this release to be generally available in October.”

Trusted users

Johnson then welcomed Linh Lam, Jamf’s CIO, to the stage.

“Good morning, Jamf Nation! I’m so excited to be back on this stage this year; you can feel the excitement!” said Lam.

“Establishing trust with enrolled, managed devices is the start of the journey to Trusted Access,” said Lam. “A trusted device should be complemented with a trusted user. Identifying the users across your endpoints and maintaining granular access controls around sensitive data is an essential component of Trusted Access.”

Identity-based workflows

“Apple has continued to expand identity-based workflows, like the enrollment workflows we just heard about in addition to simplifying access workflows,” continued Lam. “Jamf was early to support both Platform Single Sign-On (SSO) for the Mac and Enrollment Single Sign-on for BYOD mobile devices.”

These new workflows can be supported by any identity provider to deliver this next-generation SSO experience across Mac and mobile devices.

Platform SSO

End users access everything they need for work on a device with just one sign-on with platform SSO, which reduces login fatigue and improves productivity.

Enrollment SSO for BYOD

iOS users enjoy a fast and secure authentication with Face ID or Touch ID to access company apps on personally-owned mobile devices with enrollment SSO. This simplifies the account-driven user enrollment onboarding process while dramatically enhancing login security on BYO devices.

Jamf Connect legacy and Zero Trust Network Access (ZTNA)

“In 2018, Jamf introduced Jamf Connect to solve a very real and prevalent access problem related to local Mac account management: Active Directory binding,” said Lam. “Jamf Connect has helped organizations around the world bring cloud identity to the Mac.”

In 2023, we face different access challenges as remote and hybrid workforces continue to grow and resources continue to be scattered across on-premises and cloud locations.

“This year,” said Lam, “Jamf Connect took the biggest leap forward in new functionality since its introduction six years ago: Jamf Connect now offers ZTNA.”

Jamf Connect can now securely route all of the data on a fully managed corporate-owned device with Jamf Trust installed.

Users can easily access their resources via browser or native app, and in stark contrast to many alternative solutions, the mobile experience is excellent as workers roam between networks and frequently reconnect to apps and email.

Jamf Connect enhancements

Lam also shared that Jamf will soon be enhancing Jamf Connect to automatically activate ZTNA upon deployment, ensuring that users have secure access to work resources from the moment they unbox a new Mac. Jamf also takes security a step further by protecting work traffic while your employees are working.

“This is really important,” said Lam, “because it’s not enough to just check that users have a secure connection when initiating a session. You need to ensure that all traffic with work resources is protected.”

Jamf’s focus on the best user experience combined with the highest security resulted in additional notifications for end users to inform them that a secure connection is required. ”The goal here,” said Lam, “is empowering users to return to secure productivity as quickly and easily as possible.”

The nuts and bolts of enhanced Jamf Connect for BYOD

For example, Jamf uses a per-app VPN that only applies to the work side of a BYOD device. “This means,” said Lam, “we can securely route and encrypt work traffic without having any visibility or control over the personal activities of the user.”

The BYOD user will see the per-app VPN light appear in the upper right when the Slack EMM app is opened. This indicates that the work app has a secure connection while respecting the user’s privacy by not routing any personal traffic.

SwiftConnect employee badge

Lisa Brown, Senior Director, Strategic Initiatives for IT at SAP, Kam Johnson, Access Partnerships at Apple, and Brandon Arcement, CCO at SwiftConnect, took the stage to explain an exciting development Jamf customers have been asking for: digital employee badges.

Apple Wallet has become a natural part of the iPhone experience; purchasing with Apple Pay and storing digital loyalty, rewards and transit cards. It can now house an employee badge and key.

Kam Johnson led off with a brief background of Apple Wallet.

“Apple introduced Apple Wallet with a bold but straightforward goal,” said Johnson. “To digitize consumers’ wallets and allow them to seamlessly carry and easily use all of their cards, including payment cards, loyalty cards, tickets, boarding passes, health insurance cards, student ID, and keys, in a more secure and private way through iPhone and Apple Watch.”

In February 2022, Apple launched the ability to add employee badges in Apple Wallet, which allows users to easily access workspaces with their iPhone or Apple Watch.

Johnson introduced Lisa Brown, who came to JNUC to share some details about SAP’s employee badge in the Apple Wallet initiative and how SAP, SwiftConnect, and Jamf are working together.

“I’ve been involved from the start in the employee badge project at SAP,” said Brown. “Last year, I sat where you are today and I watched Linh show us how employee badges and Jamf Trust works for Jamf, and that demo inspired me. I’m very excited to say that we are rolling out our first Apple Wallet employee badges this month.”

Brown outlined some issues with physical access cards:

They are easily lost or stolen
Employees must visit a specific place to get an employee badge, which is often inside the very building they need access to
Employees can forget to bring them to work

Employee badges added into an Apple Wallet, however:

Keep everything secure on a worker’s iPhone or Apple Watch
Are available on demand; employees can provision employee badges themselves
Are on a device very few people leave at home

Brandon Arcement filled the audience in on SwiftConnect: a SaaS platform that connects the many disparate parts of legacy keycard access control and facilities security infrastructure. This helps to bring businesses into the world of modern cloud applications, identity and technologies.

“In partnership with SAP and using the Jamf Trust app,” said Arcement, “we’re working to connect the broad range of SAP access systems, door readers, lockers, secure printers, and other employee services into one seamless credential in Apple Wallet.”

Arcement pointed out that with this addition to Apple Wallet, employees need only an iPhone or Apple Watch to access critical employee experience amenities. “On top of all of that,” added Arcement, “the Jamf Trust app will allow us to take this now dynamic digital credential lifecycle and link it to IT and InfoSec Trusted Access policies.”

Now, SAP can use device risk scores to discover if employee badges can be issued or not based on the device’s security state and if it meets corporate InfoSec requirements.

“One thing I want to make sure I add,” continued Arcement, “is that employee badges in Apple Wallet is without a doubt an employee experience driver. Our customers constantly tell us about how often their employees comment on the ease of use, security and overall delightful experience of using their iPhone or Apple Watch to gain access to their corporate facilities.”

Partner highlight: Jamf and Google

Prashant Jain, Head of BeyondCorp Strategic Partnerships at Google, joined Sam Weiss, Alliance Partner Manager at Jamf, to discuss some of the remarkable strides that Jamf and Google’s collaboration has taken in the past year.

BeyondCorp

The traditional security perimeter is no longer sufficient in today’s dynamic work environment. BeyondCorp, Google’s zero-trust framework, is shifting focus from the network and toward the user and their device. This allows for more secure access to company resources from anywhere and integrates seamlessly with Jamf Pro, ensuring that only trusted devices have access to critical systems— regardless of location.

“Jamf helps deliver a phenomenal, secure Apple experience for organizations that rely on Google Cloud and Google Workspace,” said Sam Weiss. “Jamf’s focus helps integrate and extend these Google products to users of Apple hardware in ways that make the most of both ecosystems.”

“This year,” said Prashant Jain, “we’re proud to partner with Jamf to extend BeyondCorp and Context-Aware Access protection to iPhone and iPad. Now Jamf can send compliance status for all the managed mobile Apple devices in your fleet, in addition to the macOS support we launched last year.”

“Jamf is excited to be the first BeyondCorp Alliance partner to integrate Mac and mobile Apple devices into the Google Cloud Security ecosystem,” said Weiss.

View “Jamf and Google: Leveraging BeyondCorp for Zero Trust Across the Entire Apple Ecosystem” to learn more about Jamf and BeyondCorp.

Chronicle

Jamf Protect and Google’s security operations platform, Chronicle, now integrates with Jamf to provide comprehensive Apple security visibility for Google Chronicle customers.

“With Jamf Protect’s advanced Apple threat detection capabilities combined with Chronicle’s powerful data correlation, enrichment and security analysis, businesses can rapidly identify and respond to potential threats in their Apple environments. You can leverage the rich contextual insights provided by this integration,” said Jain. “The integration enables IT and security teams to gain the upper hand in safeguarding their organization from cyberattacks.”

Chrome Enterprise browsing

”Google and Jamf’s work together is all about creating an exceptional Apple experience in the Google-equipped workplace,” said Weiss.

And Chrome Enterprise browsing takes the user experience to a new level.

”Chrome Enterprise offers a seamless and secure way for you to browse,” said Jain. “It’s in aligned with the needs of security and IT teams, and the ease-of-use that end users need.”

Organizations can now offer employees the performance and security of Chrome while also managing and configuring browser settings easily.

“Jamf has made it simple to enroll browsers into Chrome Browser Cloud Management, and we’ve made incredible strides to make it an even more powerful security ecosystem,” said Jain.

New features include sending critical security event information from Chrome to:

Chronicle
Splunk
Okta

Learn more by visiting the “Secure Enterprise Browsing with Google Chrome and Jamf” or “Take your Chrome Browser Management to a New Level – Basic to Advanced with Jamf Pro and Jamf School” sessions.

Protected endpoints

The power of Jamf is that it seamlessly integrates with Google, MS, Okta, etc. But you can also add to that or cover a lot of bases, all within Jamf. Michael Covington, VP, Portfolio Strategy at Jamf, took the stage to explain more.

“At Jamf,” said Covington, “we believe that the Apple platform offers not just the best end-user experience but the most robust foundation for handling sensitive business data. And yet there still remains several misconceptions about securing your Apple deployments.”

Organizations, he pointed out, must still be intentional about how they secure endpoints and prevent threats on Apple devices, just as they secure all endpoints.

“For Jamf, we believe that security should never be a bolt-on or an afterthought,” continued Covington. “And we don’t dilute your security posture or user experience by pursuing a lowest common denominator approach to endpoint security. We work tirelessly to expose all of the rich security capabilities that Apple frameworks enable.”

Jamf Compliance Editor

For most organizations, one of the very first security objectives they have with any new platform is compliance. “We’ve heard from our customers that understanding, defining and maintaining the various settings required to actually make your Mac fleet compliant with, say, CIS benchmarks, NIST 800 or DISA STIG can be really difficult.”

The challenge: to properly configure the required benchmarks, customers often have to implement over a hundred settings. Configuration profiles can’t set many of these benchmarks.

“Thanks to the macOS Security Compliance Project and Jamf Compliance Editor,” said Covington, “this work can now be accomplished easily, in record time, with a high degree of confidence. In fact, we even provide the receipts.”

The macOS Security Compliance Project is an open-source effort that works to update compliance baselines for each upcoming macOS version so that organizations can maintain compliance while also pursuing same-day support for the latest macOS release.

Jamf Compliance Editor integrates directly with the macOS Security Compliance Project to pull guidance for all of the supported benchmarks. Jamf Compliance Editor will upload all of the required configurations and scripts to Jamf Pro while also providing full documentation that you can hand to your compliance team.

Compliance dashboard

“Of course, compliance isn’t just about setting it and forgetting it,” said Covington, citing the fact that organizations must monitor their compliance statuses continuously to ensure all endpoints remain configured correctly. “This can be a difficult thing to stay on top of, which is why I’m excited to announce that a brand new compliance dashboard is coming soon to Jamf Protect.”

This new dashboard will offer a new view of business compliance based on organizational compliance rules. It will allow customers to easily identify and resolve the highest-risk areas across their environments.

“And soon,” added Covington, “we’ll also be offering new workflows to define pragmatic compliance rules within Jamf Protect that can be converted to actionable guidance with Compliance Editor and deployed across your entire fleet with Jamf Pro.”

Device vulnerability

This builds upon and extends Jamf Protect’s existing vulnerability management dashboards. With vulnerability management, customers can view the overall health of their fleets, based upon known Common Vulnerabilities and Exposures (CVEs) of various operating systems and app versions.

“Keeping track of all published CVEs across all apps and operating systems in your environment can be very tedious and time-consuming,” said Covington. “Thanks to Jamf Protect, you get a simple breakdown of your overall vulnerability distribution with access to granular details about specific vulnerabilities and risky devices.”

Jamf helps teams make well-informed decisions regarding access policies and patching priorities, all to mitigate risk from potential CVE exploits in their environments.

Inbound threats

As the Apple platform gets more attention from the enterprise, it gets attention from hackers, as well. Beyond the risk associated with CVEs, it’s also important to prevent the wide array of inbound threats that face users daily.

“Just this year,” said Covington, “we’ve seen the first viable ransomware designed specifically to attack macOS. We’ve witnessed the development of sophisticated cryptojacking malware that targets Apple silicon.”

Covington especially underscored the importance of phishing protections as they remain the leading threat facing users. “The simple truth is,” said Covington, “that security awareness training is important but alone, it is insufficient to mitigate the risk. Users are busy, phishing attacks continue to evolve, and are so much more difficult to identify by mobile users.”

The good news? Phishing protection is built into both Jamf Protect and Jamf Safe Internet, stopping threats in their tracks and giving users clear guidance when they encounter risky content.

Jamf Threat Labs

“Although there are a lot of bad actors out there, I’m very proud to highlight the great work that Jamf Threat Labs has contributed to Apple platform security,” said Covington, “including having multiple vulnerability discoveries attributed to them in the last couple of years. Jamf Threat Labs have made a significant dent in understanding the overall threat landscape.”

Jamf’s team of security researchers works tirelessly to identify all manner of threats that target Apple users.

Jamf Executive Threat Protection

When people hear about Jamf Protect or Jamf Threat Labs, they usually associate that with Jamf’s unparalleled visibility and security for Macs.

When it comes to mobile devices, however, there aren’t a lot of options for that same deep level of insight due to the sandboxed and secure nature of iOS.

Last year, Apple introduced Lockdown M ode as an additional layer of protection for users who might be personally targeted because of who they are or their access to specific information.

“While Lockdown Mode does reduce the attack surface of your device,” said Covington, “security teams still need supplemental visibility to assess the integrity of a mobile device and to understand what happened on a compromised device. Security teams have told Jamf that they require more.”

Earlier this year, Jamf introduced Jamf Executive Threat Protection: an advanced detection and response solution for mobile devices. It gives organizations a powerful and remote method to understand what has happened on their mobile devices, as well as tools to respond to advanced attacks.

Although these sophisticated attacks are highly targeted and less common for the average user, the risk associated with device compromise is significant. “Jamf Executive Threat Protection offers unmatched mobile endpoint telemetry and a security engine that synthesizes all of that telemetry,” said Covington. Users can then identify the breadcrumbs of an attack, and if a user’s device has been compromised, security teams will have all of the tools required to quickly identify and remediate a compromised mobile device.

“Hopefully you’re able to see how our intense focus on Apple platform security makes Jamf the preferred endpoint security solution for your Mac and mobile devices,” added Covington. “The broad array of endpoint security data signaled across the Jamf platform is the reason why our Trusted Access solution is so responsive and so secure.”

And thanks to the rich integrations available with partner solutions, organization technology stacks can access all of these Apple-best insights.

Partner highlight: Jamf and Microsoft

Naadia Sayed, Principal Product Manager at Microsoft Security, stepped up to discuss security for all.

“Now, some of you might be wondering what a Microsoft person is doing at a conference for Apple admins,” said Sayed. “Well, let me tell you, attackers don’t care what device or operating system you are on. At Microsoft, we believe in security for all.”

Microsoft’s research has shown that there are 4,000 password attacks globally per second. “That makes security a team sport,” said Sayed.

The Jamf team has developed integrations with Entra ID and Microsoft Sentinel for Office 365 users.

Entra ID

“As you may know,” said Sayed, “we rebranded Azure Active Directory to Microsoft Entra ID. Microsoft Entra is our family of Identity and Network access products that help address security challenges that come with increasing attack surfaces.”

The Jamf Pro integration, explained Sayed, improved admin ability to:

Share compliance data with Microsoft Intune
Enforce conditional access criteria
Offer remediation paths

This means that Apple device users set up with Entra ID authentication enjoy automated compliance management.

“Our customers are asking for zero-trust device compliance,” said Sayed. “You, our IT admins, can now establish compliance criteria to ensure devices meet security standards before accessing organizational resources.”

Microsoft uses device information Jamf collects to evaluate device compliance before sending traffic to Entra ID and grants access to Office 365.

“We have worked closely with Jamf to dramatically improve the device compliance onboarding user experience,” said Sayed.

Microsoft Sentinel

Microsoft Sentinel allows Microsoft customers using Apple products to automatically forward macOS activity, malicious attacks, and malware notifications directly into existing Microsoft Sentinel workflows and dashboards.

What’s on the horizon for Jamf and Microsoft?

“Last year at JNUC,” added Sayed, “there was a lot of talk about Platform SSO for macOS. We heard your feedback loud and clear, Jamf Nation! Enterprise SSO is now generally available with Microsoft Enterprise SSO plug-in for Apple devices.”

Sayed also announced that Microsoft teams are working on a powerful enhancement called Platform SSO for macOS, which will be in public preview in the upcoming months.

This integration will streamline authentication and improve security by further simplifying the device compliance onboarding process.

Trusted Access login and training for in-person JNUC attendees

Sam Johnson thanked Naadia Sayed as he joined attendees to explain more about Trusted Access.

“As you can see,” said Johnson, “this is how we deliver Trusted Access: our zero-trust vision of Apple at work.”

“This is really a story of how Jamf Pro, Jamf Connect and Jamf Protect work together to deliver the most delightful and secure workplace experience across different device types,” said Johnson. “It’s the culmination of management, identity and security working together at their best.”

JNUC attendees: experience Trusted Access at JNUC

Johnson shared an exciting announcement to those in-person JNUC attendees: Jamf is providing a login and training so that admins can test the full Jamf platform — regardless of what product they own.

Customer highlight: Secrid

Sam Johnson was pleased to welcome Sander Schram from Secrid, a family-owned Dutch company that makes RFID-secure wallets in a socially responsible manner. They chatted about Secrid’s journey to Trusted Access.

An Apple shop with far-flung employees

Secrid uses mainly macOS computers and iOS mobile devices at every level of the organization, as well as in their brand store in Rotterdam. Some work from the organization’s headquarters in the Netherlands, some remotely from home or while traveling.

“Our journey with Jamf started with the implementation of Jamf Pro to manage the deployment of software, settings and policies to our growing number of Apple devices,” said Schram. After a full deployment of Jamf Pro, Secrid implemented Jamf Connect, and they use Okta as their IdP.

Jamf also makes it easy and safe for Secrid to implement iPads for point-of-sale in their brand store in Rotterdam.

Reaching Trusted Access

“We wanted modern and secure authentication for our Mac devices,” said Schram. “This gave our users a great zero-touch enrollment experience and they could authenticate to their devices with just one source of authentication; Okta.”

After a consequential phishing attack, last year the organization implemented Jamf Protect, which Schram believes would have prevented the attack had it been in place at the time. ”Training and educating our users was not good enough,” said Schrma. “The impact was enormous, mostly because of the amount of hours we spent on communication with the involved companies and parties but also reporting the GDPR data breach incident to the Data Protection Authority (DPA).”

Security wins with Jamf

“This spring,” said Schram, “there was a security incident with the software of our VoIP solution, which Jamf Protect was able to quickly detect, block and remediate.”

“We’ve even had a few attempts to steal our iPads at our retail location,” Schram said. “But with Jamf, we were able to lock these devices down and prohibit any access to sensitive information.”

In addition, Secrid is saving time, effort and cost with the full Jamf offering. “All the devices,” said Schram, “no matter where they are located, are always secure and trusted.”

What’s next for Secrid?

“As we sat in the JNUC audience last year and heard about your partnership with SwiftConnect to make physical access a reality,” said Schram, “we are extremely intrigued by the possibility of bringing this level of digital protection to our physical buildings.”

Jamf improvements for education

Mat Pullen, Jamf’s Senior Product Marketing Manager, Education, joined the audience to catch educators up on Jamf’s ongoing commitment to education. Jamf, which started at the University of Wisconsin-Eau Claire, believes that a strong educational framework, equitable access to resources, stellar educators, and best-in-class educational technology can shape who we become as adults and leaders.

“iPad and Mac in education are devices that all serve a purpose,” explained Pullen. “The purpose of these devices is to teach and learn.” The core purpose? To transform teaching and learning, not to increase personal productivity as with Mac and iPhone.

On-Device Content Filtering for Jamf Safe Internet

Jamf recently launched Jamf Safe Internet: a robust content filtering and mobile threat solution to ensure students only access safe and approved resources on the internet. It now supports Apple, Chromebook and Windows devices.

“But we’re not done there,” said Pullen. “Let’s talk about a few new and exciting tools we’re bringing to help complement that solution.”

With the adoption of Apple’s network-filtering framework, Jamf further protects schools and districts with web protection enforcement that is directly on Apple mobile devices. On-device content filtering bolsters existing security measures by strengthening web filters for schools. It stops both inbound threats and unsafe outbound activity while ensuring greater privacy for students.

“You may be wondering: ‘Don’t existing content filtering solutions already do this?’” said Pullen. “Yes and no. Traditional content filtering methods are a great place to start, but by adding on-device content filtering we’re offering additional layers of security and extra privacy protections.”

These additional protections safeguard against:

Phishing
Social engineering
Credential theft

Jamf’s on-device content filtering is part of Jamf Safe Internet and is currently available for supervised iOS and iPadOS 16+ devices. Jamf is planning macOS support for on-device content filtering later this year.

StateRAMP status: Ready

The rise in ransomware and cyber threats to schools has increased dramatically over the last few years.

With this in mind, Jamf has achieved StateRAMP status ‘Ready,’ and can now deliver StateRAMP instances of Jamf School and Jamf Pro to US schools. StateRAMP is a non-profit organization that promotes cybersecurity best practices for public institutions. While StateRAMP is a US-focused initiative, this benefits to all of our customers as Jamf focuses on high-compliance models.

“If you are interested in taking on a StateRAMP instance,” said Pullen, “we will provide you with the necessary information you need to get the migration going. Best of all, there is no need to re-enroll your devices.”

Usability improvements for Jamf School

Jamf School has added usability improvements for Jamf School beyond the new interface outlined by Veronica Batista.

”We are proud to serve a large community of educators with our education solutions,” said Pullen. “We know that Jamf Teacher is a tool they love to use daily to help them transform teaching and learning, including the ability to maintain contact with the restrictions you have in place for your learners,” said Pullen.

Jamf Teacher users can now see all student restrictions as well as the time left on those restrictions. This enables teachers to add or remove any of those restrictions without having to reset the whole system.

App Installers for Jamf School

“Oh, and one more thing,” added Pullen. “We bringing the most requested feature to Jamf School: App Installers.” Available today, this adds the functionality currently available on Jamf Pro to Jamf School and provides educators with a more complete Mac management experience.

Customer highlight: Mesa Community College

Alvin Bridges, Associate Vice President for College Technology Services at Mesa Community College, joined Mat Pullen to discuss how Jamf has helped his school. It is the largest non-statewide local community college district in the nation, with ten sister colleges. The school has implemented a 1-to-1 iPad program and Bridges secures the college’s data and network with Jamf Protect and Jamf Safe Internet.

Why?

“Jamf is just easy to use,” he explained. For instance, when the college received an executive order from the governor to block a certain social media site, “We were up and compliant in four hours,” said Bridges.

“The successes of our iPad program have been monumental,” said Bridges. “48% of our students are first-generation college students. One student thought he wasn’t going to finish school until he discovered our iPad program. He is now in his third semester.”

The college secures their devices with both Jamf Protect and Jamf Safe Internet: Jamf Safe Internet to ensure appropriate access and to protect their network, and Jamf Protect to secure data and apps on each device.

What’s coming next for Mesa Community College?

“We are going to expand our program to 80,000 students,” said Bridges. “We continue to work tirelessly to close the digital equity gap.”

Customer highlight: Richardson ISD

Morgan Cave, Director of Instructional Technology at Richardson ISD, spoke to the audience about her school’s successes with Jamf.

They use Jamf Pro to manage 30,000 mobile devices and 5,000 Macs for students and teachers.

“When I first started teaching,” said Cave, “I wanted most for my students to love the experience of learning.” Her classroom was completely transformed in 2013 when the campus introduced a 1-to-1 iPad program. “I saw how iPad created pathways for my first-grade writing and language students,” said Cave, “And my fifth-grade classroom found that the creative capabilities of iPad reignited their love of learning”.

However, Cave’s lesson prep meant touching 85 iPads after school. “That’s why I very much understand the value of Jamf Pro!” Cave said.

Cave particularly values the guidance that Jamf provides. “Working with our engineer,” she said, “we can understand the instructional implications of every configuration and all of the possibilities to customize and personalize for our users.”

Last year, the schools needed access to new iPads. “We refreshed 20,000 iPads in January 2023,” said Cave. Not only was the refresh fast and seamless, but using enrollment configuration resulted in little to no loss of instructional time. “Students signed back into their devices and picked up right where they left off,” she added.

They turned over entire campuses in one day, and sometimes in a few hours.

“Our students are challenged to think critically and use technology to solve problems as they creatively apply learning and demonstrate mastery,” said Cave, adding: “Jamf Teacher allows our teachers to design engaging learning experiences that align with district initiatives.”

Jamf Teacher started testing in two classrooms, and now all 41 elementary campuses are using Jamf Teacher. “Since starting with Jamf Teacher,” said Cave, “Our teachers feel confident and empowered with technology and they can stay focused on what matters most: teaching and learning.”

AI’s role in device management and security

Akash Kamath, Senior Vice President, Engineering, Jamf, stepped up to tackle the sometimes controversial topic of Artificial Intelligence (AI).

“AI has become a buzzword in the tech industry today,” said Kamath. “We have all heard the prophecies ranging from AI saving us all to AI taking over the world.”

Kamath invited the audience to pause for a moment and cast their minds back to the origins of computers and the role they have played in the popular unconscious.

”50 years ago,” said Kamath, “computers were enigmatic machines, confined to labs, touched only by the lab-coated elite.” Then, in 1984, “the heavens split open, and down came the Apple Macintosh,” he continued.

The Apple Macintosh wasn’t just a computer. “It was a bicycle for your mind, an invitation to dream,” said Kamath. Just as the Mac removed barriers between humans and computing, Kamath argued, generative AI makes artificial intelligence personal.

“It takes it out of the hands of the few and places it into the hands of many,” he continued. “It’s not some far-off theoretical future; it’s here, now, shaping our world in ways we’re just beginning to grasp.”

“It’s impossible to ignore the seismic shifts AI is causing across industries,” said Kamath. For instance, McKinsey’s “Generative AI and the future of work in America” report predicts that by 2030, generative AI could be behind the automation of nearly one-third of all work hours.

“That’s a game-changer,” said Kamath, “but let’s not forget the cautionary examples like ChatGPT’s ‘hallucinations,’ which can lead to misinformation. This is particularly alarming for us at Jamf, where we believe that ‘Trusted Access’ isn’t just a tagline—it’s a commitment.”

Jamf Collaboratory

“So how do we harness the unprecedented capabilities of AI without compromising the trust you place in us?” asked Kamath. “That’s the question that led to the creation of the Jamf Collaboratory: a cross-functional internal team of visionaries, tinkerers and problem-solvers. We aren’t just dabbling in algorithms; we’re pioneering a new era of intelligent solutions meticulously crafted to enhance Apple device management and security.”

“I’m thrilled to give you a sneak peek of what we’re actively developing,” said Kamath.

One cornerstone project: a specialized language model that marries the capabilities of state-of-the-art large language models with proprietary data, derived from Jamf Pro documentation and insights gleaned from Jamf Nation user forums.

A model intentionally shaped to grasp the complexities of Apple management and security, this adapted language model will serve as the foundation for a series of future innovations.

One example: an admin wants to schedule a policy to run at a specific time of day. Is this in our standard documentation? “When we posed this question to ChatGPT,” said Kamath, “it fabricated a ‘schedule tab;’ something that doesn’t exist.”

Jamf Help presents two viable solutions: first, using client-side limitations in policy configuration. If that doesn’t suffice, Jamf Help offers a step-by-step guide to creating a launch agent for timely policy execution.

If an admin wants to query an SQL database for each endpoint during inventory updates, Jamf Help will provide a hands-on tutorial for crafting the necessary extension attribute.

“We’re encouraged by the early results from Ask Jamf but acknowledge there’s room for improvement,” said Kamath, inviting attendees to visit the Jamf station in the expo center to test it for themselves and to offer insights.

“Our aspirations don’t end with a language model,” said Kamath. “The ultimate goal of AI integration into Jamf products is to function as a silent partner that amplifies your effectiveness.”

Kamath then showed attendees a preview of the threat research work Jamf has been performing.

Organizations today are under pressure to maximize efficiency, often expecting IT professionals to wear multiple hats. “One significant shift we’ve noticed is the increasing expectation for IT staff to manage cybersecurity tasks, especially for endpoints, in addition to their day-to-day operational responsibilities,” said Kamath. “This can be a tall order, particularly when many IT professionals lack specialized cybersecurity training.”

Even mature information security teams often lack the expertise or bandwidth to keep up-to-date on Apple security. IT is often deluged with security alerts and vulnerabilities that they may not be fully equipped to navigate.

“In a world where one missed alert could spell catastrophe for your organization, what you need is both efficiency and precision,” added Kamath.

Kamath outlined a few scenarios in which AI would be very useful in an admin’s workday.

First: an employee is duped into running a counterfeit version of Google Chrome designed to harvest login credentials. Second: a coworker pranks another by directing them to execute a harmless command in their Terminal.

“Here’s the paradox,” said Kamath. “If you’re using Jamf Protect, both of these scenarios trigger alerts that look nearly identical. Distinguishing between them demands expertise and time—luxuries that most of us don’t have.”

Hypothesis

“With hypotheses,” said Kamath, “you’re not alone.”

Using AI technology, this feature instantaneously analyzes an event and its associated telemetry data, producing a comprehensive, three-dimensional view of the situation. It also offers explanations and evidence used in its analysis, along with tailored suggestions for further investigation and remediation.

“In essence,” says Kamath, “This function acts like an additional member of your security team, adeptly helping you separate the critical from the benign.”

For an in-depth look at this feature, view “Hypothesis: GenerativeAI at Jamf.”

“Your roles in IT and InfoSec are rapidly evolving,” said Kamath, “and we’re committed to evolving right alongside you. Intelligence-backed management, endpoint security, and a more streamlined workflow are not just catchphrases; they are our collective future. We invite you to be a part of this journey by sharing your invaluable insights, challenges, and aspirations. Let’s continue to push the boundaries of what’s possible together.”

Enterprise technology choice

Sam Johnson took the stage to talk about the many organizations that have partnered closely with Jamf to speak up about enterprise technology choice. Upfront cost, Johnson argued, isn’t a good reason for passing on Apple.

He reminded attendees that at JNUC 2015, Fletcher Previn of, at the time, IBM, asked: “When did it become OK to live like the Jetsons at home but the Flintstones at work?”

“Well,” said Johnson, “Fletcher’s back, baby.” Now as the CIO at Cisco, Previn continues to ask that question. And once again has validated the cost, time and resource savings of allowing employees their choice in hardware.

Previn will be presenting much more insight and data during his “Mac in the Enterprise: a CIO’s Perspective by the Numbers” session.

“But IBM and Cisco are not the only choice programs Jamf has helped spearhead,” said Johnson. “We are getting into the rhythm of it by now. Enterprise juggernauts like SAP and HSBC are also on the record dispelling the notion that Mac is too expensive.”

These numbers show that you can have the best hardware at the lowest cost.

Trusted Access: Jamf’s present and future

Jamf CEO John Strosahl rejoined Jamf Nation to get the day started.

“Simply said,” Strosahl explained, “Trusted Access is an outcome you can achieve when you Manage and Secure your Mac and Mobile devices with Jamf, regardless if it’s deployed for a person or for a purpose.”

“I’d like to thank all of our presenters,” continued Strosahl, “and our sponsors for making this a keynote and JNUC to remember. A special thank you to our premier sponsors AWS and Insight.”

JNUC 2024

Strosahl then revealed the location of JNUC 2024: Nashville, Tennessee.

“Take care, Jamf Nation,” said Strosahl. “I look forward to connecting with you this week.”

Watch the entire keynote presentation.

View Keynote

by Pieter Beckmann

What OS 17 brings commercial organizations

Month: September 2023

Author: September 18, 2023 by Sean Smith

Source: https://www.jamf.com/blog/what-ipados-ios-tvos-17-brings-for-commercial-organizations/

As Apple announced its new iOS 17, iPadOS and tvOS 17 operating systems, Jamf is once again excited to bring you same-day compatibility support. Read more about the importance of same-day support in this release blog.

As Apple continues to evolve how employees work, Jamf is evolving how we enable organizations to succeed with their new operating systems. At Jamf, our same-day commitment means delivering compatibility for Apple’s releases on the day they are available, strengthening security from out-of-date software, minimizing downtime from breaking workflows, and keeping end users happy and productive.

Commercial organizations are always looking for ways to improve management and security processes, increase security protocols, and enhance the end-user experience. With the release of iOS 17, iPadOS 17 and tvOS 17 on Sept. 18, and the anticipated release of macOS Sonoma on September 26, Apple has once again helped organizations do exactly that. Read on for highlights of key features new to iOS 17 and how they may impact you and your organization.

Managing software updates via Declarative Device Management(DDM)

Declarative software updates add more functionality to the existing DDM protocol by empowering IT admins to better communicate, schedule and enforce the latest software updates to managed devices. In the past, devices could defer updates, challenging admins to keep devices safe from out-of-date software. With software update management, admins can specify and enforce the date and time of updates and notify end users more frequently and with more transparency.

The workflow is a much simpler process: in one action, the IT administrator schedules an enforcement date and targets a specific update version and deadline to a group of devices. Once the update plan is defined, iOS will handle user notifications and reminders leading to the eventual enforcement deadline and update. Devices will proactively and autonomously give feedback to the Mobile Device Management (MDM) regarding the update’s progress.

Once the update is complete, the status reports back to the MDM, providing administrators with the most up-to-date status of OS versions of managed devices. This helps devices stay compliant.

Account-driven device enrollment

Account-driven device enrollment lets users enroll an institutionally owned mobile device into MDM without downloading and installing profiles. This provides a better workflow for users to enroll iOS or iPadOS devices by eliminating the need to enroll into MDM via a link or a portal and also separates organizational and personal data by creating a new data volume for managed data and apps, just like in account-drive n user enrollment.

Account-driven device enrollment also provides organizations a more flexible way to manage devices. Admins will have the ability to manage passcodes; install, manage and view apps and accounts; and remotely lock or wipe devices to mitigate any breaches of company data of devices lost, stolen, or compromised.

Return to service

Return to service is a new MDM action that will send an EraseDevice command along with the previously selected language, region and critically — a Wi-Fi profile. Previously, these un-skippable user selections had to be performed each time an iOS or iPadOS device was wiped and re-enrolled to MDM. Now, organizations will be able to reconfigure devices with minimal effort, as all on-device steps post-wipe are automated to complete re-enrollment.

Jamf support for your updates

Apple releases are always an exciting time for Apple IT and security admins. At Jamf, we look forward to exploring how we can support these new features and help our customers integrate them into their device ecosystem.

Request Trial

by Pieter Beckmann

The Jamf 240 Course: Apple device management with Jamf School

Month: September 2023

Author: September 18, 2023 by John Greenash

Source: https://www.jamf.com/blog/jamf-240-course-introduction/

Jamf has a history of creating hands-on, practical training courses that date back to 2006. While historically focused on Jamf Pro — our flagship enterprise management tool — back in 2021 we introduced the Jamf 370 Course to the world, focusing on endpoint security with Jamf Protect. Since then, our products, certifications and tools to deliver training have continued to evolve, but the commitment to our customers’ success at managing and securing Apple devices in any environment hasn’t wavered. Enter the newest offering in the Jamf training portfolio — the Jamf 240 Course. This offering is solely dedicated to helping customers succeed with Jamf School, our education-focused management solution.

The Jamf 240 Course is a two-day remote instructor-led offering based on using Apple computers and devices in an education setting. It covers the following topics:

Introduction and configuration of Jamf School
Creating User Groups and Classes
Enrolling computers and mobile devices using Automated Device Enrollment
Organizing devices into groups and configuring Shared iPad
Managing devices with profiles and Quick Action Commands
Delivering apps and content to computers and mobile devices
Building and managing packages for deployment to computers
Creating incident types for internal device tracking
Configuring Jamf Teacher, Jamf Parent and Jamf Student

The course requires a basic understanding of macOS, iOS and iPadOS, and attendees should expect to finish the course with a broad understanding of Jamf School and a deeper understanding of Apple technologies used when managing devices.

As this is a 200-level course, there are no formal prerequisites for this offering. Furthermore, after attending the offering you will be ready to attempt the included certification exam. Upon passing the exam, you will receive Jamf Certified Tech for Jamf School certification.

Visit the Jamf 240 Course page to obtain more information on course requirements and a listing of what is included for each course attendee.

Finally, Jamf 240 Courses are now available for registration in a variety of time zones. Sign up today via Jamf Account!

We look forward to welcoming you to a class soon.

P.S. — If you want to learn about Jamf School, but cannot wait for a Jamf 240 Course — no problem, we have you covered! There are a number of self-paced modules in the Jamf Online Training Catalog to explore and some Jamf Shorts videos available too, both at no cost. Happy learning!

Get Certified!

Learn More

by Pieter Beckmann

Platform Single Sign-On and the future of user logins

Month: September 2023

Author: September 14, 2023 by Sean Rabbitt

Source: https://www.jamf.com/blog/wwdc-2022-sso-extension/

What is the Single Sign-On extension?

Also known as the extensible Single Sign-On or SSOe, the single sign-on extension is a configuration profile payload for macOS, iOS and iPadOS introduced by Apple at WWDC 2019. This configuration profile redirects the request to authenticate to a website, app or service that is gated by a cloud Identity Provider (IdP).

The SSOe configuration profile payload tells the Apple device that when a user logs into a service with a SAML, OAuth 2.0 or OpenID Connect 2.0 authentication methods to redirect this request to the SSOe app locally installed on the device. Consider the payload as process requests through a local proxy. For example, if you wish to visit Microsoft’s SSO-enabled website, it launches the Microsoft Authenticator app instead.

Upon launching, the app, it will first request authentication for the user from the IdP, to validate that the requestor is really the user in question. Next, it will obtain an “access token” and a “refresh token” to keep the user’s login alive until the next time the user changes their password. The authenticator app is then responsible for authenticating the user to services, like logging into Salesforce via Safari or accessing your Office 365 email account within the native Microsoft Outlook app.

Note: SSOe configuration profiles can be set up to work either as a redirect or to provision a credential within the SSOe app. Currently, Microsoft Entra ID uses a redirect payload, while Okta FastPass uses a credential payload. In the latter, the FastPass authenticator app obtains a certificate from the Okta Certification Authority (CA) to authenticate the user. Both are important to note for future deployments as the technology continues being developed.

What is Platform Single Sign-on (PSSO)?

Platform SSO builds on the SSOe configuration profile by tying the local user account on a Mac to the Single Sign-On application. In this model, the user is presented with an identity provider login when they arrive at the macOS login screen.

But wait, doesn’t that sound a bit like Jamf Connect? More on that in a moment. Once the user enters their credentials at the Mac login window, the PSSO will either update the local account password for the user or use a token stored in the secure element of the Mac to authenticate the user locally — the workflow executed depends on how the PSSO extension is written by the developer or how the administrator has configured the deployed option for login handling. Depending on how the PSSO extension is written or how the administrator has set up the option for login, the PSSO will either update the local account password for the user OR it will use a token stored in the secure element of the Mac to authenticate the user locally.

After the user has successfully logged in, they can start accessing any resources gated by the IdP and the SSOe app will intercept the login and automatically authenticate the user, without additional password prompts. Pretty cool, right?!

So, how can I get started with PSSO at my organization?

Jamf Pro was early to ship support for the creation and management of PSSO profiles for increased efficiency, user productivity, and security. But to make use of PSSO, customers depend on their identity provider to provide a single sign-on extension host app. So while Jamf Pro supported PSSO, customers could only take advantage of this functionality once their identity provider also offered support. Jamf teamed up with Okta to update the Okta Verify app for Mac so that Okta and Jamf Pro customers can use the combination of platforms and enjoy the benefits of single sign-on for their Mac. This will make Jamf and Okta customers the first to make use this new capability that was originally showcased by Apple.

What does this mean for Jamf Connect users?

It’s an amazing case of “working better together” since there are no provisions for creating local macOS user accounts with the PSSOe by itself. PSSOe only works when a local user account is created on a Mac. In this case, a user account would need to be created either by running the Setup Assistant when first starting up their Mac for the first time or an administrator would need to go to create a new user account through some other means before the benefits of PSSOe can be realized.

Jamf Connect, on the other hand, can create the first user account on the Mac — or any additional user accounts needed. Furthermore, it can enforce linking the local account to the identity provider credentials and also determine if a user should be made a local admin or a local standard user.

From there, the PSSOe can attach itself to a local user account and magically log users into their organization’s IdP-gated tools and resources.

What if my organization doesn’t use Okta?

Jamf Connect is the portion of the solution that you can deploy right now, knowing that it supports integration with SSOe, to augment the user experience when it’s made available. With Jamf Connect:

Users log onto their Mac with their common identity provider credentials. This gets users accustomed to using the IdP login when accessing organizational resources.
User account permissions are secured by the IdP. This means that you can manage who gets assigned admin-level privileges from one centralized place. Additionally, this adheres to the best security principle of only creating an administrator account on a Mac until you absolutely need it.
You can customize the onboarding experience. Jamf Connect helps IT streamline onboarding for the end-user to get them working productively from the moment they first power on their device.
If your IdP supports it, try out the previews of the existing SSOe apps with an account created by Jamf Connect. The experience of accessing organizational resources so simply and easily is a truly transformative experience.
Review the implications of SSOe and PSSO with your company’s Security team. Concerns may exist surrounding the new technology’s efficacy, prompting them to favor a more mature security stack, like with Jamf Protect.

Additional security with Zero Trust Network Access (ZTNA)

The combination of Jamf’s integrated solutions, including built-in Zero Trust Network Access (ZTNA), leverages your IdP to upgrade organizational security by:

Frequently checking device health
Assessing app vulnerability status
Securing network communications
Mitigating risky user behaviors
Establishing microtunnels to securely access resources
Denying access to devices/users found to be compromised
Maintain optimal productivity by blocking access to only affected resources
Automatically execute workflows to remediate devices

Integrate Jamf Connect into your authentication and IdP workflows to benefit from a mature authentication stack.

Request Trial

by Pieter Beckmann

StateRAMP for Jamf School and Jamf Pro

Month: September 2023

Author: September 12, 2023 by Mat Pullen

Source: https://www.jamf.com/blog/stateramp-cybersecurity-for-education-with-jamf/

What is StateRAMP?

StateRAMP was born in early 2020 from the clear need for a standardized approach to the cybersecurity risk management standards required by educational organizations and state and local governments. This critical cloud security assessment and authorization program is designed to ensure that products address the specific technology and compliance requirements of these public sector organizations.

With the increased focus on cybersecurity in the public sector, many education institutions and state and local governments are partnering with StateRAMP to streamline their cloud procurement processes.

What does this mean for education?

Cybersecurity in education is a large and ever-growing concern. Cybercriminals see education as a target due to the rapid deployment of devices over the last few years. With the fast pace of change, institutions need to trust that their cloud providers are appropriately managing their cybersecurity risk to protect their users and institutions. Learn more about Jamf’s commitment to education.

What has Jamf done to achieve this state?

In order to ensure our public sector customers are able to meet their various regulatory requirements, Jamf has gone through the rigorous process to achieve StateRAMP Ready status for Jamf School and Jamf Pro. Although this certification applies most specifically to public-sector customers in the US, this work helps Jamf to advance our overall security maturity and increase our safeguards— which benefits all Jamf School and Jamf Pro customers globally.

We will continue to move through the stages of StateRAMP in order to ensure our systems meet these standards to keep our customers compliant and, more importantly, to keep our customers safe.

For more details, read our press release.

See for yourself how Jamf can help with your institution’s StateRAMP requirements.

Request Trial

by Pieter Beckmann