Jamf Connect Archives

Mitigating social engineering attacks

Jamf Connect

Author: October 16, 2023 by Braden Newell

Source: https://www.jamf.com/blog/mitigating-social-engineering-attacks/

Protecting user devices against malware is one of the first endpoint hardening tasks an IT administrator or Information Security (InfoSec) team will likely implement. When securing a fleet of devices, regardless of the operating system, ensuring that users cannot install malicious software like ransomware, spyware and rootkits is a basic level one CIS requirement. Jamf Protect’s macOS endpoint security and malware prevention capabilities have long made preventing known malware from launching on corporate and education Macs easy.

It’s great that organizations place a tremendous focus on stopping malware from entering their environments. However, another threat is often overlooked — social engineering. Social engineering is the practice where attackers manipulate and trick individuals into providing sensitive data or access credentials. Social engineering is challenging to defend against because many of us have a trusting nature and have so much to do on the go that we sometimes overlook the out-of-place.

Social engineering continues to be a serious threat, and the risks it poses are only growing. According to the IBM 2023 Cost of a Data Breach Report, social engineering is involved in ~8% of attacks, costing on average $4.55 million. And this statistic doesn’t even include phishing — responsible for 16% of breaches and costing $4.76 million on average. In other words, it’s nothing to sneeze at.

Attackers are attempting to masquerade as corporate executives, and there seems to be more spam than ever hitting our inboxes. Fortunately, there are several tactics your organization can put in place to help mitigate the risk social engineering poses, and, of course, Jamf has a solution or two to create another layer of defense against those digital threats.

Learn how to recognize phishing attacks and how to defend against them.

Read our phishing basics blog. >>

Strong passwords and two-factor authentication

Strong, unique passwords are the first line of defense when strengthening your organization’s security posture. Sufficiently long and complex passwords mitigate the risk of shoulder surfing by making them tricky for someone to glance at a user’s keyboard or touch screen and remember what they typed. Jamf’s management products, Jamf Pro, Jamf Now and Jamf School, all offer the ability to implement and enforce password policies on users’ Macs, iPhones and iPads.

However, a complex and/or long password isn’t enough to prevent social engineering. If a bad actor executes a successful phishing attack, for example, the user has provided the password outright, regardless of its complexity. This is why ideally passwords should also be unique for every application and never reused. If a particular application has a data breach and that specific password is compromised, it won’t give the attacker access to other systems. The first thing an attacker tries once they have a user’s application username and password is to try it against other applications.

A way to achieve this is by using a password manager and/or SSO solution. Jamf integrates with directory services and cloud identity providers (IdP) like Okta and Microsoft Entra ID to support SSO. And Jamf Connect keeps users’ Mac passwords synced with their single sign-on (SSO) password, which likely can have its own enforced password policy. This way, users only have to remember one password, reducing password fatigue.

For SSO to be secure, two-factor authentication (2FA) or multi-factor authentication (MFA) should be implemented; otherwise bad actors have access to everything if they obtain a user’s master password. In two-factor or multi-factor authentication, not only does a user need their password, they also need either a randomly generated six-digit code or another form of authorization, biometric technology such as Face ID or Touch ID, or something physical like a Yubico YukiKey to access the requested application. 2FA and MFA help reduce the risk that attackers can access systems — especially when biometrics are used — since they may not be able to confirm the authentication prompt.

If your organization doesn’t already have a password policy and password training or resources, champion their development to create formal and consistent messaging around passwords and two-factor authentication.

User training

Never underestimate the power of user training. Social engineering attacks often follow a consistent playbook. Spelling errors, strange icon placement, email spoofing and a sense of urgency are all strong indicators that an email or phone call is a social engineering attack.

However, bad actors are improving, making spoofe emails or websites look nearly flawless. AI is even helping attackers enhance their attacks. Users need to know what a convincing attack can look like, and how to proceed if they suspect a social engineering attack.

Therefore, one of the best ways to prevent social engineering attacks is to train users regularly on the common indicators of social engineering. Most organizations deliver this sort of training once or twice per year to account for changes in tactics and to keep employees vigilant. It’s essential to have a blame-free culture to encourage users to report attacks as soon as they happen. Suppose a user does fall for a social engineering attack. In that case, it’s better for the user to feel comfortable reporting it to IT early rather than further damage caused by a delay in reporting.

Some organizations leverage spam tests and training simulations to test their users’ susceptibility to social engineering attempts. However, organizations have to be careful with this sort of testing. While data can be valuable, users may grow distrustful of their organization. Instead, organizations may want to consider incentive or reward programs for users reporting spam and phishing attempts. Work to create a culture of support, education and prevention around social engineering.

Principle of least privilege

The “principle of least privilege” is an InfoSec concept where users should only be granted access to the specific applications and functionalities required to do their job. For organizations that use applications with user access levels, consider implementing and reviewing them regularly. In a situation where a user’s credentials are compromised, the attacker’s access can be limited to the user’s specific access level. This ensures that the attack has a restricted scope of access and, ideally, is limited from accessing critical or sensitive data.

After gaining initial access, attackers will attempt to move laterally through the network until they reach their final target. The “principle of least privilege” helps limit and mitigate the spread of social engineering attacks but is not a complete solution. Training users on being vigilant and cautious when receiving an odd request from a team member is a great additional step.

Zero trust network access

Even with strong password policies, least privilege access to applications and user training, social engineering attacks can still succeed. Zero trust network access (ZTNA) adds to your defense, taking the principle of least privilege further by segmenting network access beyond role-based access to applications.

With ZTNA, applications and other resources are accessed via micro-tunnels that are continuously reevaluated even after a user signs in successfully. This is done independent of user or device location. In other words, ZTNA connects users to company resources only after they have strictly verified their identity, continuously checks that the user and the device meet identity and security requirements, and totally prevents access to resources the user is not allowed to access (as the user can’t even reach the part of the network those resources exist on).

ZTNA is a helpful addition to a security stack. If the identity of a user or the security status of a device comes into question, ZTNA can restrict network access to all or some of the network. This prevents and/or reduces the spread of a bad actor in the corporate network, regardless of whether the device is compromised.

How Jamf can help

Jamf Pro

Policies in Jamf Pro help manage and secure devices by configuring devices to meet security requirements. Jamf Pro helps keep devices and software up to date with the latest security patches, helping to keep devices compliant with CIS benchmarks.

Jamf Pro supports Self Service — an enterprise, IT-approved app store where users can download and update apps as they need, without a help desk ticket. This reduces the risk of shadow IT and the download of malicious apps.

Jamf Connect

Jamf Connect helps with access control. With cloud IdPs, users can unbox their device and connect to their corporate applications using a single password. Jamf Connect enables ZTNA connectivity, keeping networks safe and users productive with effortless but secure authentication.

Jamf Protect

Jamf Protect has long been a powerful endpoint security solution preventing known malware from launching on macOS. Recently, Jamf Protect’s capabilities expanded with the addition of web threat prevention, formally known as network threat protection.

Web threat prevention is a network security capability that, among other things, prevents users from accessing known spam, phishing and malicious websites. Web threat prevention is available not only on macOS but on iOS, iPadOS, Windows and Android.

Jamf takes care of domain recognition and threat filtering; all organizations must do is deploy Jamf Protect’s web threat prevention capability to their operating systems of choice. Once deployed, even if a user clicks a known malicious link, they are prevented from accessing it and redirected to an informative block page.

Adding network security capabilities to Jamf Protect is a significant win for organizations looking for solutions to help reduce the risks of social engineering and other network-related threats. Plus, with Jamf Protect’s web threat prevention capability available for both Apple and non-Apple operating systems, all of your organization’s devices can be secured with the help of a partner you know and trust.

Jamf Protect also has built-in compliance with CIS benchmarks for macOS. Depending on an organization’s needs, CIS has two levels of profiles with different security recommendations. Level one profiles contain practical security practices that have little to no impact on the user experience. Some examples are:

Ensuring automatic software updates are enabled
Automatically setting the date and time
Basic password management controls like minimum length and character diversity

Level two profiles may restrict a user’s experience in favor of tighter security. Some examples are:

Disabling media sharing
Disabling the sending of diagnostic information to Apple
Restricting iCloud Drive document and desktop sync

Organizations can implement profiles from either level based on their security needs. CIS benchmarks are extensive, which is why they’re conveniently built into Jamf Protect where admins can verify if their fleet is in compliance with chosen benchmarks. With this information, admins can use Jamf Protect and Jamf Pro to maintain adherence to these benchmarks.

Jamf Safe Internet

Educational institutions can reap the same network protection offered in Jamf Protect with Jamf Safe Internet’s content filtering and network security. Jamf Safe Internet is built specifically for the education market with a price point and feature set catered to educational institutions.

Jamf Safe Internet focuses on helping schools meet their regional online child safety regulations while maintaining student privacy, supporting macOS, iOS, Chromebooks, and most recently, Windows. Jamf Safe Internet is straightforward to configure and deploy, and once again, Jamf handles all of the domain identification and network filtering for you.

Adding Jamf to your security stack helps defend against social engineering attacks.

Request Trial

by Pieter Beckmann

A holistic approach to security: endpoint protection

Jamf Connect

Author: October 9, 2023 by Jesus Vigo

Source: https://www.jamf.com/blog/endpoint-protection-apple-devices/

The modern threat landscape continues to evolve to meet the changes in modern computing. One that sees companies migrating to remote and hybrid work environments, adopting Apple in the enterprise and varying device ownership levels. All in service to permit users to work:

Where they feel most comfortable
On their preferred device
From anywhere and at any time

What is endpoint protection?

To best answer this question, we must first know what we need protection from. Armed with an entire arsenal at their disposal, threat actors actively target all endpoints in a concerted effort to compromise your device fleet, as well as your users to gain access to critical and sensitive organizational data for their own nefarious purposes.

The days of merely installing antivirus on your computer are both wholly inadequate and asking for trouble given the array of threats that exist across the threat landscape that impact modern devices — not just computers but mobile devices across multiple platforms too.

To that end, endpoint protection is the umbrella term that describes a group of security solutions that work in synergy to keep endpoints (devices), users and data safe and secure against the current and evolving modern threat landscape.

What is the primary purpose of endpoint protection?

Protect against new and evolving threats

Alas, it’s a brave new world and that includes a whole slew of threats and attacks that impact the security of your endpoint— regardless of whether users are at the office or home, connected to any network, or on macOS, iOS, Android or Windows.

How does it differ from antivirus software?

While malicious code is still very much a thing to be wary of. Historically, antivirus software only provided protection against malware and possible variants but that was it! As you can tell from the list of threats below, challenges to a device’s security posture — and to a greater degree, the organization’s security posture — have evolved to encompass a variety of threat types. Ones that merely protecting against malware cannot address. A few examples of modern threat types are:

In-network attacks
- Man in the Middle (MitM)
- Zero-day phishing attacks
  - SMS
  - Email
  - Social media
  - Messaging
- Lateral movement attacks
On-device attacks
- Living off the land (LotL)
- Malware
  - Spyware
  - Trojans
  - Ransomware
  - Cryptojacker
  - Potentially unwanted programs (PuP)
- Unauthorized data exfiltration

Layered security protections to combat convergence

And while some of the threats above carry identifiable fingerprints that can tip IT and Security admins off to their whereabouts, an increasing number of bad actors are combining threats (referred to also as convergence), employing the latest tactics to remain unknown, and therefore able to carry out attacks stealthily over time.

Hence a need for comprehensive security solutions to protect against modernized and converged threats that place devices and users at risk by blending attacks that target multiple vectors. By implementing a defense-in-depth strategy, IT and Security teams gain the features necessary to keep endpoints safe while users get the support they need to stay secure while upholding organizational and privacy data security.

Minimizes costs associated with security risk

Risk from security incidents doesn’t just refer to a device’s vulnerability to threats. The cost(s) that stem from risk that — when left unchecked — leads to a data breach have been increasing steadily year-over-year. In fact, below are a few statistics that further underscore the real-world need organizations have for an enterprise-wide endpoint security solution that comprehensively protects company- and personally-owned endpoints used to access business resources:

The global average cost of a data breach in 2023 was USD 4.45 million, a 15% increase over 3 years
Nearly 60% of companies affected by a data breach are likely to go out of business due to reputational damage
41% of respondents report a regulatory violation in the past two years
74% of all breaches include the human element, with people being involved either via error, privilege misuse, use of stolen credentials or Social Engineering
For the second year in a row, manufacturing was the top-attacked industry. With finance and insurance in second place again by a margin of nearly 6%
64% of vulnerable devices accessed collaboration tools while 34% accessed enterprise email

Features of robust endpoint protection

Jamf Threat Labs (JTL)

You may be thinking, how can you possibly stop that which you cannot see? With Jamf Threat Labs, that’s how. Jamf’s team of cybersecurity experts and data scientists works tirelessly to assess macOS and iOS-based endpoints, performing threat hunting to successfully identify and prevent both novel and unknown threats from affecting your Apple fleet. Not only are they great at what they do, but their research feeds the threat intelligence engines that drive Jamf’s endpoint security solutions. By incorporating their findings, detecting unknown threats through advanced behavioral analytics and frequently updated YARA rules work in tandem to mitigate security threats that may be lurking within your fleet before they have a chance to escalate to something worse, like a data breach.

The work performed by the JTL has a direct impact on Jamf Protect, which cascades and causes a ripple effect that reaches our users in the form of security benefits: From identifying new Mac-based and mobile threats to developing analytics for detecting them to stopping the sophisticated malicious actions of applications, scripts and even risky user behaviors. Keeping administrators alerted to detected threats, logging findings, and informing both administrators and users during each step of the way.

Speaking of logging threat data, the telemetry gathered by Jamf Protect is not only used by JTL to hunt for the latest threats — both unknown and known threats that have evolved in an attempt to evade detection — but this very same telemetry data can be used to aid your organization’s IT and Security (or authorized third-parties) in hunting for malicious threats that may be embedded within your device fleet, quietly gathering intel on your business processes, awaiting the right time to perform a data breach. By having access to your device’s health status through rich telemetry data, organizations can be better equipped to identify potentially malicious threats and risky behaviors, subsequently containing incidents before they have a chance to occur, ensuring compliance is maintained (but more on how Jamf Protect can help you with achieving your compliance goals a little later).

Key takeaways:

Supported by Jamf Threat Labs team of cybersecurity experts and data scientists to research, identify and prevent novel threats
Advanced threat intelligence engine and machine learning (ML) aid in threat hunting to identify potential attacks before they can happen
Protect endpoints from new and existing, known and unknown threats, risky apps and suspicious behaviors
Active hunting of threats — both unknown and in the wild — leading directly to the patching of vulnerabilities that impact macOS and iOS-based devices
Constant incorporation of threat intelligence data, research and findings into Jamf Protect by a dedicated team of cybersecurity experts to enhance security protections

Monitor

In addition to the Jamf Threat Labs team constantly monitoring macOS and iOS-based operating systems across the expanding threat landscape to identify and thwart the latest threats facing organizations, Jamf’s endpoint security solutions actively surveil endpoints for known, unknown and suspected threats across all supported platforms, including Windows and Android.

This minimizes risk from various Apple-focused and mobile device security threats while serving as one of the foundational components in the comprehensive, multi-prong endpoint security protections. Jamf solutions keeps a watchful eye over your organizational devices and users by:

Consistently and actively monitoring endpoints 24x7x365
Gathering rich telemetry logging and reporting data
Providing insight into device health, aiding compliance auditing

Key takeaways:

Active monitoring of managed endpoints — regardless of the ownership model (BYOD/CYOD/COPE) — logging device health status
Obtain detailed logging and rich telemetry data through deep visibility and insight into endpoints and threat trends
Stream logging of gathered data to your preferred SIEM solution for centralized management of threat intelligence
Leverage MI:RIAM and machine learning to find (and stop) new, advanced threats, like zero-day phishing and Cryptojacking attacks
Maintain careful watch over managed endpoints, locking down unwanted software and limiting the execution of suspicious file types

Detect

Keeping vigil over endpoints is just one aspect of protection, the next is identifying threats. Whether known, unknown or suspected – IT and Security administrators will have visibility into device health, including real-time alerts that inform stakeholders of detected threats that affect their devices.

Further, logging data is gathered for each endpoint, providing in-depth information about the security of your entire fleet. The rich telemetry data collected serves administrators well in not only quickly identifying what risks impact their endpoints but also allows them to:

Perform threat hunting to identify potential threats
Leverage granular information to refine protections
Mitigate risky behaviors to mitigate potential attack vectors

Key takeaways:

Speed up incident response, resolution and remediation times with MI:RIAM and automated workflows
Isolate affected devices and perform a clean-up of endpoints under attack using secure, managed processes
Prevent malware, potentially unwanted apps and risky behaviors performed by end-users from impacting device performance or productivity with lean resource utilization
Alert IT and Security teams, and critical stakeholders of security incidents in real-time with deep visibility into each endpoint
Extend security protections across your Apple fleet — including personally- and company-owned devices so that business data is accessed securely from any supported device type

Prevent

Every threat, like malware, is a potential risk to exposing user and/or company data, so it’s important that organizations choose an endpoint protection solution that specializes in detecting the unique and evolving threats that target users on Mac and mobile devices – inside and out.

The on-device and in-network protections provided by Jamf endpoint security solutions mean faster detection, notification and threat response to known and unknown threats thanks to our:

Advanced machine learning (ML) and threat intelligence engine – MI:RIAM
Customizable behavioral analytics mapped to the MITRE ATT&CK Framework
Data policy enforcement ensures data remains only on secured, compliant storage
Blocking of network threats, such as phishing, malicious downloads and command and control (C2) traffic, including risky domains

Key takeaways:

Stops threats that occur on-device, like malware while also preventing in-network attacks, like zero-day phishing and lateral movement
DNS-based content filtering, purpose-built for Apple, prevents access to websites hosting malicious code, used in attacks or simply to block inappropriate content on managed devices
Limit data exfiltration by enabling removable storage controls to enforce encryption of removable media, manage permissions or disable external storing of protected data altogether
Implement ML for enhanced threat intelligence gathering to prevent advanced, novel threats from compromising endpoints, users and/or data
Utilize rich telemetry data and MI:RIAM to perform both manual and automated threat hunting to detect unknown threats that may be lurking in your devices and stop them before a data breach can occur

Remediate

Even with increased visibility and compliance, granular reporting, real-time alerts, advanced threat intelligence and protection against novel threats, the modern threat landscape evolves so frenetically that endpoints may be impacted or drop out of compliance. What then?

Once again, Jamf endpoint security solutions – with their multiple layers of protection – facilitate powerful remediation workflows to correct deviations from your OS hardening configurations, quickly bringing endpoints back into compliance.

Jamf solutions flexibly provision manual and automated workflows to respond to and remediate incidents in real-time.

Key takeaways:

In-depth visibility into all macOS security tooling activity and system processes in real-time
Eradication of malicious, unwanted and potentially risky files, apps and downloads
Isolating devices found to be out of compliance or that pose a risk to data security
Aligning with CIS Benchmarks to develop, enforce and monitor secure device baselines
Prevention of potentially unwanted apps and risky behaviors to ensure data remains secure while devices are free from end-user-introduced risk

Compliance

For some, compliance is nothing more than a term in a sea of other words. However, for others, particularly those tasked with ensuring that systems, data and processes are aligned with local, state, national and/or regional laws in highly regulated industries, compliance represents a potential nightmare. One that if left unchecked could lead to disastrous consequences for the regulated organization as well as its stakeholders — perhaps even impacting the customers that depend on the organization to protect and safeguard sensitive data types.

Thankfully, Jamf Protect users can sleep a little easier at night knowing that the endpoint security solution goes beyond just malware prevention. In fact, it goes well beyond with tight-knit integration (discussed in more detail below) by mapping analytics to the MITRE ATT&CK Framework to prevent known threats while remaining flexible and allowing administrators to customize existing analytics (or create entirely new ones) to meet the demands of your regulated environment.

Taking it further, Jamf Protect’s rich telemetry data combined with behavioral analytics — and enforced via Jamf Pro — form a covalent bond by securely sharing this data between solutions. The result? Jamf Protect establishes the requirements necessary for managed endpoints to be compliant. At the same time, integration with Jamf Pro enables the use of policy-based management to enforce compliance. Should a device, say miss a critical security update, have a vulnerable app installed or perhaps a curious user is performing risky behaviors, Jamf Protect’s logging system will share this data with Jamf Pro. In turn, this triggers a policy contained within the MDM that executes an automated workflow to remediate the issue, bringing the endpoint back into compliance…all without IT or Security teams having to lift a finger and without impacting end-user productivity.

But how does it actually help administrators meet compliance standards? That’s a great question and one that we’ll answer right now. As mentioned above, Jamf Protect can be configured to align with regulatory governance. By doing so, endpoints are actively monitored and report back on any changes to device health that would otherwise impact compliance status. Threat prevention works to limit the impact of threats on endpoints, mitigating the risk in one fell swoop. And when Jamf Protect is integrated with Jamf Pro, compliance is enforced through policy-based management, ensuring devices remain compliant and remediating any deviations from regulatory compliance through both manual and automated workflows.

Below is a sampling of the security frameworks supported by Jamf to help organizations realize their compliance goals:

Center for Internet Security (CIS)
National Institute of Standards and Technology (NIST)
Defense Information Systems Agency (DISA)
International Organization for Standardization (ISO)
macOS Security Compliance Project (mSCP)

Key takeaways:

Behavioral analytics mapped to MITRE ATT&CK Framework for powerful, customizable prevention of threats, tailored to the unique needs of your organization
Automated incident response and remediation workflows eradicate malicious, risky and unwanted files while isolating devices that pose a risk to data security
Develop, enforce and monitor secure device baselines aligned with CIS Benchmarks to drive compliance and aid in auditing compliance tasks
Adapt secure configurations and device hardening profiles to Apple-based endpoints in accordance with NIST, DISA and mSCP guidelines for secure computing
Jamf cloud operations are certified for compliance with ISO 27001/27701, SOC 2 and FBI Infraguard, among many others for data security and corporate governance practices

Multiple layers of security – one solution

Look at the fingers on your hand. They work independently to accomplish certain tasks, yet work in tandem when needed to perform larger-scale functions, do they not? A single, yet powerful security solution similarly relies on many individual layers that – while capable of performing independently in their own right – also work together to form a holistic, multithreaded net to monitor, detect, prevent and remediate against attacks from bad actors and the various security threats they employ to target your device, users and critical data.

Defense-in-depth

“…loved by good, feared by evil.” – Voltron

In the show by the same name as the quote above, the first season saw a team of five pilots, each of whom commands a robot lion with unique strengths and abilities. In their quest to maintain peace and protect Earth from evil, the team of five would combine to form a larger, more powerful robot named Voltron, Defender of the Universe, to further aid them with their task.

Though it was a beloved cartoon from 1984, the premise of Voltron shares much with the strategy of defense-in-depth(DiD) to best secure assets, users and resources across the modern threat landscape. Specifically, the belief that a singular, “one size fits all” application will holistically keep organizations protected is a myth a best – and one that often leads to data breaches at worst.

The premise of DiD is simple, yet both efficient and effective. Layer security protections, just like the layers of cake, so that they overlap their strengths while minimizing weakness, in the service of identifying, stopping and if it comes to it, remediating against a variety of security challenges that threaten the integrity of your endpoint, the safety of your users and confidentiality of your data.

Simply put: should one layer fail, the next one exists to intercept it.

Integration

Jamf’s endpoint protection solutions, much like all of our solutions, are designed to work alongside numerous first- and third-party solutions to extend capabilities and enable automation while establishing feature-rich workflows to ensure data flows securely between solutions.

For example, Jamf Pro, our flagship mobile device management solution, is known for its seamless deployment and management capability, which includes installing patches. However, when integrated with Jamf Protect, not only is deploying endpoint security to your endpoints possible with just a couple of clicks but secure endpoint health data is shared in real-time between both solutions.

What does this mean for your organization? We’ll tell you. Event information relating to incidents, such as phishing attacks and other network-based threats are automatically synced to inform the risk status of any individual device. This connection between management and security is critical to taking real-time action to protect your environment. A few examples of the automated workflows that are made possible, thanks to the native, secure integration between Jamf solutions:

Consider how crucial to endpoint security it is that devices keep up-to-date with patches. As part of a defense-in-depth strategy, organizations using Jamf Protect will receive alerts from endpoints found to be non-compliant with patches. This telemetry data is communicated with Jamf Pro, where IT can implement patch management policies to enforce compliance. Once triggered, Jamf Pro will execute workflows to deploy necessary updates to apps and OSs, bringing them into compliance.
Organizations can leverage Smart Groups in Jamf Pro to dynamically update and respond when a device’s risk status changes in Jamf Protect. This trigger can automatically update a user’s access permissions via Jamf Pro’s conditional access integrations with Microsoft or Google Cloud BeyondCorp solutions.
Use the advanced reporting options found in Jamf endpoint security solutions to automatically stream rich telemetry data to your preferred SIEM solution, like Azure Sentinel or Splunk, providing MacAdmins a single pane of glass view into the health of their Apple endpoints while further extending the capability to transform data using visualizations for added depth and granularity.

Key takeaways:

Develop advanced workflows via integration with Jamf Pro and first- and third-party solutions
Implement advanced security orchestration, automation and response workflows through integration
Leverage Jamf’s API to communicate and share data securely between solutions while enhancing your endpoint security capabilities
Extend features to support greater management and security capabilities across the Apple ecosystem of desktop and mobile devices
Establish automation to simplify endpoint management while ensuring compliance with organizational policies and industry regulations

Purpose-built endpoint protection for Apple, Windows and Android

Jamf’s purpose-built, Apple-first endpoint security solutions offer IT and Security teams several benefits that firmly establish its solutions as best-of-breed, for example:

Same-day support allows users to adopt the latest, safest releases from Apple as soon as they’re available – upgrade on your schedule, not ours
Leverage Apple’s Endpoint Security API to embrace the latest security capabilities available natively for Apple devices
Low-impact performance means battery life isn’t affected, won’t slow down machines or get in the way of user productivity
Implement Apple-best security to your Apple fleet while supporting mobile platforms from Windows and Android, providing them with network-based endpoint security protections as well

Speaking of user productivity, being Apple-first (but not Apple-only) means Jamf designs and optimizes each of our endpoint security solutions to take advantage of the OS on which it operates so that protecting your devices does not come at the expense of user experience nor compromise the user’s privacy.

Key takeaways:

Purpose-built for Apple to address the challenges of the modern threat landscape across macOS and iOS-based devices, but also designed and optimized for Android and Windows mobile devices
Defense-in-depth strategy layers multiple protections to monitor, identify, prevent and remediate a variety of security challenges – should one layer fail, the next one intercepts it
Extend services, features and capabilities by leveraging the Jamf Risk API, securely sharing pertinent device health data with first- and third-party solutions
Update to the latest and safest releases from Apple the day they are released with same-day support across all Jamf solutions — no delaying critical updates until your MDM and/or endpoint security solution gets around to supporting it
Minimal impact equals better performance, allowing users to utilize resources for productivity — not having to choose between getting work done or the security of their device

This post is one of a series on a holistic approach to security. See a roundup of all of the posts

Do you trust Jamf to help IT manage your Apple fleet efficiently and effectively?

Then you’ll love the way Jamf security solutions keep your endpoints, users and data safe across multiple platforms, securing them across your infrastructure.

Request Trial

by Pieter Beckmann

Platform Single Sign-On and the future of user logins

Jamf Connect

Author: September 14, 2023 by Sean Rabbitt

Source: https://www.jamf.com/blog/wwdc-2022-sso-extension/

What is the Single Sign-On extension?

Also known as the extensible Single Sign-On or SSOe, the single sign-on extension is a configuration profile payload for macOS, iOS and iPadOS introduced by Apple at WWDC 2019. This configuration profile redirects the request to authenticate to a website, app or service that is gated by a cloud Identity Provider (IdP).

The SSOe configuration profile payload tells the Apple device that when a user logs into a service with a SAML, OAuth 2.0 or OpenID Connect 2.0 authentication methods to redirect this request to the SSOe app locally installed on the device. Consider the payload as process requests through a local proxy. For example, if you wish to visit Microsoft’s SSO-enabled website, it launches the Microsoft Authenticator app instead.

Upon launching, the app, it will first request authentication for the user from the IdP, to validate that the requestor is really the user in question. Next, it will obtain an “access token” and a “refresh token” to keep the user’s login alive until the next time the user changes their password. The authenticator app is then responsible for authenticating the user to services, like logging into Salesforce via Safari or accessing your Office 365 email account within the native Microsoft Outlook app.

Note: SSOe configuration profiles can be set up to work either as a redirect or to provision a credential within the SSOe app. Currently, Microsoft Entra ID uses a redirect payload, while Okta FastPass uses a credential payload. In the latter, the FastPass authenticator app obtains a certificate from the Okta Certification Authority (CA) to authenticate the user. Both are important to note for future deployments as the technology continues being developed.

What is Platform Single Sign-on (PSSO)?

Platform SSO builds on the SSOe configuration profile by tying the local user account on a Mac to the Single Sign-On application. In this model, the user is presented with an identity provider login when they arrive at the macOS login screen.

But wait, doesn’t that sound a bit like Jamf Connect? More on that in a moment. Once the user enters their credentials at the Mac login window, the PSSO will either update the local account password for the user or use a token stored in the secure element of the Mac to authenticate the user locally — the workflow executed depends on how the PSSO extension is written by the developer or how the administrator has configured the deployed option for login handling. Depending on how the PSSO extension is written or how the administrator has set up the option for login, the PSSO will either update the local account password for the user OR it will use a token stored in the secure element of the Mac to authenticate the user locally.

After the user has successfully logged in, they can start accessing any resources gated by the IdP and the SSOe app will intercept the login and automatically authenticate the user, without additional password prompts. Pretty cool, right?!

So, how can I get started with PSSO at my organization?

Jamf Pro was early to ship support for the creation and management of PSSO profiles for increased efficiency, user productivity, and security. But to make use of PSSO, customers depend on their identity provider to provide a single sign-on extension host app. So while Jamf Pro supported PSSO, customers could only take advantage of this functionality once their identity provider also offered support. Jamf teamed up with Okta to update the Okta Verify app for Mac so that Okta and Jamf Pro customers can use the combination of platforms and enjoy the benefits of single sign-on for their Mac. This will make Jamf and Okta customers the first to make use this new capability that was originally showcased by Apple.

What does this mean for Jamf Connect users?

It’s an amazing case of “working better together” since there are no provisions for creating local macOS user accounts with the PSSOe by itself. PSSOe only works when a local user account is created on a Mac. In this case, a user account would need to be created either by running the Setup Assistant when first starting up their Mac for the first time or an administrator would need to go to create a new user account through some other means before the benefits of PSSOe can be realized.

Jamf Connect, on the other hand, can create the first user account on the Mac — or any additional user accounts needed. Furthermore, it can enforce linking the local account to the identity provider credentials and also determine if a user should be made a local admin or a local standard user.

From there, the PSSOe can attach itself to a local user account and magically log users into their organization’s IdP-gated tools and resources.

What if my organization doesn’t use Okta?

Jamf Connect is the portion of the solution that you can deploy right now, knowing that it supports integration with SSOe, to augment the user experience when it’s made available. With Jamf Connect:

Users log onto their Mac with their common identity provider credentials. This gets users accustomed to using the IdP login when accessing organizational resources.
User account permissions are secured by the IdP. This means that you can manage who gets assigned admin-level privileges from one centralized place. Additionally, this adheres to the best security principle of only creating an administrator account on a Mac until you absolutely need it.
You can customize the onboarding experience. Jamf Connect helps IT streamline onboarding for the end-user to get them working productively from the moment they first power on their device.
If your IdP supports it, try out the previews of the existing SSOe apps with an account created by Jamf Connect. The experience of accessing organizational resources so simply and easily is a truly transformative experience.
Review the implications of SSOe and PSSO with your company’s Security team. Concerns may exist surrounding the new technology’s efficacy, prompting them to favor a more mature security stack, like with Jamf Protect.

Additional security with Zero Trust Network Access (ZTNA)

The combination of Jamf’s integrated solutions, including built-in Zero Trust Network Access (ZTNA), leverages your IdP to upgrade organizational security by:

Frequently checking device health
Assessing app vulnerability status
Securing network communications
Mitigating risky user behaviors
Establishing microtunnels to securely access resources
Denying access to devices/users found to be compromised
Maintain optimal productivity by blocking access to only affected resources
Automatically execute workflows to remediate devices

Integrate Jamf Connect into your authentication and IdP workflows to benefit from a mature authentication stack.

Request Trial

by Pieter Beckmann

User Privacy + Private Relay

Jamf Connect

Author: August 17, 2023 by Jesus Vigo

Source: https://www.jamf.com/blog/byod-security-solutions-private-relay-jamf/

There was a school of thought behind IT management that admins always had to lock everything down. Just completely button it all up for a device (and its data) to be considered “secure”. I put secure in quotes because this iron-fisted approach often came at the cost of system usability, and almost always at the cost of the end-user experience.

This was long before the modern-day computing landscape we have today. The iPhones of today – and for that matter, most of the iPhones released – have more computing power than most computers twenty-plus years ago, pound for pound. Something else the devices have today that wasn’t really a thing back then is metadata. Specifically, all the various bits of data recorded, timestamped, and cataloged about the user when using cameras, microphones, taking photographs or sharing data across the Internet, such as through social media platforms. This metadata can be and is used by several sources the instant it’s recorded to answer many of the following questions about the user:

When was something done?
Who did it?
What are their individual characteristics?
Are there ties between this person and other data bits?
Can a profile be created from this data?
How can the profile be used to link the person to ‘XYZ’?

The questions are endless. The result though is straightforward, however, to be able to use this privacy data against you, the user, in some way, shape or form. Regardless of whether it’s something as seemingly benign as curating advertisements to target your interests to maliciously assembling all this data to steal your identity.

How do you balance that? Do you lock the device down so tightly that it can barely even be used? Or do you leave it as open as possible and permit users to take control over the dissemination of data in all forms? The answers to that are beyond the scope of this blog because, at its core, it really depends on your organization’s policies, how much and what types of data users share of their own volition and the risk appetite of both entities.

Here we’ll address:

The different ways IT can address privacy vs security in mobile devices
Some features of iOS/iPadOS 15 to protect privacy
Resolve some of the issues that pertain to BYOD programs
Use Jamf Pro’s recent additions to strike a balance between company-owned and personal devices

BYOD privacy concerns got you feeling blue?

Learn more about reaping the benefits of enhanced security without compromising user privacy with our technical paper on balancing privacy and the user experience.

User Privacy and Private Relay

Privacy data, as explained in the previous paragraph, but to recap, is essentially any data that can and does personally identify a user and/or can be used to build profiles about the user, including shopping habits, interests, web history and so on.

Private Relay on the other hand is a new technology from Apple introduced in iOS/iPadOS 15 that, when enabled, limits the amount of private data that is leaked to websites and services when establishing connections to them over the Internet. Acting like a shield of sorts, Apple Private Relay works by routing your requests through Apple’s servers first where your DNS records are encrypted to hide the name of the website you’re requesting to access. The encrypted request is then sent to a second relay, which generates a temporary IP address, masking your real IP address before connecting you to the site you requested.

Over management = Underserving users

So how do user privacy, privacy relay and managing users and their devices tie together? That’s a good question and I’m glad you asked. See, in the larger security scheme, device management just doesn’t apply to updating the apps and patching the OS. While that’s a big part of it, securing access, what users can and cannot do is another part of it, but how to go about balancing both so that your users are free to use their BYOD devices for their own personal uses while still ensuring that the device is secured against security threats ultimately means that some compromises will need to take place on both sides.

Locking a personally owned device down to a state where it is largely unusable outside of company-provided apps and services is an easy way to foster discord among your users. Furthermore, while the device is technically configured for work, this approach can also backfire in a big way given that mobile devices will still collect some form of personally identifiable information (PII). Without a way for users to manage this themselves, the organization may very well run afoul of laws and regulations that are in place to protect users from these very practices.

Similarly, there’s a saying that a former supervisor would say to me during my years as a Sysadmin. “You touch it, you own it.” Intended as words of caution when considering working on certain projects that didn’t technically fall within our wheelhouse to support. The concern is that even though it’s not our problem to solve, sometimes in providing assistance for a problem we inadvertently create another in the process – that of taking on responsibility for the issue moving forward – despite our best intentions. This is very much the case with over management in this case, by taking upon yourself to turn management of privacy data exclusively into an IT function, end-users are left with no choice but to turn to IT for every single privacy-related matter – whether it pertains to work-related tasks or not. Not only is this a very slippery slope to skate on for IT, but may very well also present difficulties for HR, regulatory compliance concerns, worker’s unions and the organization itself, alongside the users as well.

Making mobile device programs work

Hence the “iron-fisted” approach written about above simply doesn’t work in this day and age. The sheer variety of users, their needs, different types of mobile devices, use cases, and the disparity in distance between each user and the office for remote and hybrid work environments all mean that one size most definitely does not fit all. Oh, and adding BYOD into the mix means that the devices are personally owned, so it wouldn’t be exactly fair nor sustainable to lock a user out of their device due to BYOD security risks. After all, users can simply “opt out” of management at any time when enrolling personal devices in company MDM solutions.

So, what’s the answer then? You might be asking. Well, that’s tough because each organization is different with varying needs. BYOD security solutions ensure the security of corporate data while keeping a balanced, “hands-off” approach to safeguard user privacy matters, which is a solid goal to aim for.

Luckily, there are several models available that may be a better fit for your organization. They each offer their own trade-offs, of course, but may provide the solid foundation to move forward with developing a management plan that works to the benefit of all stakeholders.

BYOD

(Bring Your Own Device): The user owns the hardware and is free to use it as they see fit. Device management offers control of the user-based functions of the device, but not full control by design. This is the least costly option for organizations. It is important to note that while BYOD limits what your employer can see on your device, it does allow IT to focus solely on managing the apps/services/data that are tied exclusively to securing company resources. Users retain control of their devices and their use, while corporate data – which they do not govern – is still safeguarded to company standards and adherence to corporate policy.

CYOD

(Choose Your Own Device): The company owns the hardware and provides it to employees to use for work-related purposes. This is the costliest model as it requires the company to purchase and manage the devices and infrastructure. With this model, IT may opt to restrict devices as they see fit in theory, but as mentioned before that doesn’t really work out so well in practice if devices are so locked down users simply cannot use them. Instead, users feel forced to carry a secondary mobile device that is more flexible in terms of allowing them to do their work and use it for personal uses. A big downside to this is, if corporate data is not being managed appropriately in the backend, users will figure out quickly that they can use their personal device to meet their needs, eschewing the corporate-owned device altogether. This represents not only a waste of funds for the organization but potential security risks as IT will have no insight into the personal device, meaning company data may be open to compromise at any point.

COPE

(Corporate owned, Personal Enabled): The company owns the hardware in this model as well, which keeps the costs up for both devices and management infrastructure. However, the biggest delineation between COPE and CYOD is that the former shares more flexibility with BYOD than with CYOD’s locked-down model. In other words, the ability for companies to own the hardware means they can secure corporate resources as needed without compromising security. However, the user-based policies provide the ability for users to utilize the mobile device for personal tasks in addition to work, without one infringing on the other. Company data remains protected and personal data remains with the user.

Lastly, there is one piece to this equation that we’ve only touched upon: the MDM component. Specifically, the software used to manage the mobile devices regardless of which deployment model is chosen. In this case, the new additions Apple has incorporated into iOS/iPadOS 15 have a heavy focus on security and privacy. Jamf has also adopted these features into the latest version of Jamf Pro to streamline user enrollment and provisioning access to company resources while maintaining user privacy on their personal device.

Leveraging Apple’s Account-Driven user Enrollment, Jamf Pro allows organizations to take advantage of the onboarding workflow to allow end-users the ability to securely enroll their personal or corporate-owned devices by authenticating with their cloud-based credentials and utilizing both personal and managed Apple IDs to keep personal and corporate data respectively separate.

Frankly, it’s the best of both worlds, having two Apple IDs allows users able to keep privacy data linked to their personal Apple ID; while company data is linked to their organizationally provided managed Apple ID. Furthermore, personal devices allow limited IT management without allowing access to commands that may be considered too heavy-handed, such as viewing personal data, location tracking or collecting privacy data from the device. Conversely, It can still lock devices that are reported lost or stolen, install/update corporate apps & data and apply configurations to secure corporate resources, like VPN or Email remotely.

The end result is a mobile device management strategy where all stakeholders win: users can benefit from a unified experience, blending personal and professional from just one device with transparency into IT management capabilities, protection of privacy data and access to corporate resources. Organizations strike the all-too-important balance between security and end-user privacy by keeping employees protected and productive while allowing for flexibility to use devices for personal tasks that are secured, without infringing on the privacy of their users.

Protect end-user privacy while achieving parity with security across your network

company-owned and personal devices you support as part of your BYOD program with Jamf Pro.

Request Trial

by Pieter Beckmann

G2 Summer 2023 Report

Jamf Connect

Author: July 18, 2023 by Jesus Vigo

Source: https://www.jamf.com/blog/g2-jamf-reviews-2023/

It brings us immense pride and appreciation to announce that we have received the highest accolades in the Summer 2023 Report, a publication by G2, the prominent tech marketplace and peer-to-peer review platform.

G2 scores products and vendors based on authenticated community reviews, aggregated online and social network data points, and algorithmic calculations of satisfaction and real-time market presence. You can find a detailed explanation of the report scoring methodology here.

Jamf continues to be ranked a leader with our mobile device management (MDM) solutions, Jamf Pro and Jamf Now, along with the authentication and identity management solution Jamf Connect. Endpoint management solution Jamf Protect continues to be a high performer, with Jamf School also making its debut on the MDM list.

Highlights from the G2 Summer 2023 Report

Jamf product solutions scored well in G2’s Summer 2023 report, with first-place rankings in 30 categories plus other high marks for Jamf Pro, Jamf Now, Jamf Protect, Jamf Connect and Jamf School.