SCEP is a very simple certificate enrollment protocol developed 10 years ago for routers and switches to enroll for.
Post on 19-Dec-2015
241 Views
Preview:
Transcript
Spark the future.
May 4 – 8, 2015Chicago, IL
Windows 10 for Mobile Devices: 10 Steps for a Successful Deployment Roel SchellensArchitect World Wide Modern Devices Center of Excellence Microsoft
BRK3300
A Typical ExperienceAfter the sales person is gone.
Your Manager says: “Let’s buy these devices and connect them to our Infrastructure” That is where you come in the picture!You ask:
“Which Infrastructure?”
Understand what is required to prepare your supporting infrastructure for a successful deployment of Windows 10 mobile devices.
1. Prepare and Setup:BRK33000: Windows 10 for Mobile Devices: 10 Steps for a Successful DeploymentTuesday, May 5 - 1:30 PM - 2:45 PM
2. Operate:BRK33008: Windows 10 for Mobile Devices: Get and Stay in Control of Your Mobile Fleet Wednesday, May 65:00 PM - 6:15 PM
Objective
1. Basic understanding of Windows 102. Windows 10 still under development3. Supporting Infrastructure based on Microsoft solutions4. Todays Recommended Practices, not the ones of
omorrow 5. Familiar with Enterprise Mobility concepts
Assumptions
Early Deployment Program (EDP) Windows Phone 8.1 It is all about the supporting infrastructure PKI, S/MIME, VPN
Windows 10 Technical Adoption Program Windows Desktop becomes mobile Mobile Infrastructure Preparation
First Wave (Windows 10) Goal:
Bigger, Better, Faster 1000+ Win10 devices RTM +30 days and 5000+ before end of 2015
TAP and Early Deployment ProgramsLessons Learned (and still learning)
1. Secure a Sponsor2. Agree on Requirements3. Setup a Test Environment 4. Make sure your Public Key Infrastructure supports
Mobile!5. Ensure the Identity solution supports mobile6. Learn and prep for Mobile Device Management
(MDM) 7. Choose a Mobile Device Provisioning and Enrollment
approach8. Protect Your Data9. Allow to Work from Anywhere from any Device10. Make your Applications mobile and manageable
10 Steps for a Successful Mobile Deployment
For the best Windows Mobile Story!
1 – Secure a Sponsor
1. Why a good sponsor is important? Resources Escalations New standards and policies
2. How to find the best sponsor? Who will profit most Show business value Come well prepared
1 – Secure a Sponsor
2 – Agree on Requirements
Ask the Business for their functional mobility needs Common Understanding Define the End-Goal (Not Technical!) Pre-defined Questionnaire and Requirements list Quantify requirements based on business impact
Examples: Improved Acceptance by…, Improved Productivity through…, etc.) Structure Requirements
Personas Scenario’s and Processes Business Impact and Success Applications and Data required to become mobile
Define your starting point and end-goalBusiness Requirements
Ask IT for their (non-functional) mobility needs Common Understanding Agree on the End-Goal
The Business Needs is the End-Goal Pre-defined Questionnaire and Requirements list Quantify requirements based on business impact
Accept that (security) policies and standards most likely need to be revised Structure Your Requirements
Identity MDM MAM Security, etc.
Define your starting point and end-goalTechnical Requirements
3 – Setup a Test Environment
1. Proof – Validate Requirements2. Identify issues and gaps early3. Education4. Build Your Own Enterprise Mobility Lab
3 – Setup a Test Environment
Blog: The Mobility Guys From the same people as the Deployment Guys Mobility Experts blogging about Microsoft Mobility solutions Blog Series: Build Your Own Enterprise Mobility Lab
Part 1: Register, Obtain and Setup all Prerequisites for the Build Your Own Enterprise Mobility Lab
Part 2: Setup and Configure the On-Orem Identity infrastructure (in Microsoft Azure) Part 3: Setup Web Application Proxy (for publishing services) Part 4: Setup and Configure Identity Synchronization Part 5: Setup AAD Premium and Office 365 Part 6: Setup and Configure Mobile Device Management with Intune Part 7: Configure Certificate Management for Mobile Devices (NDES)
3 – Setup a Test EnvironmentBuild Your Own Enterprise Mobility Lab
4 – Make sure your Public Key Infrastructure supports Mobile!
1. Security for Mobile solutions = PKI2. Challenge number 13. Microsoft PKI or 3rd Party PKI4. Required for:
Identity (Passport) Enterprise Data Protection Remote Access (VPN and Reverse Proxy) Application Protection S/MIME Signing and Encryption
5. Simple Certificate Enrollment Protocol (SCEP)6. Direct Certificate Enrollment (new in Windows 10)
Why Public Key Infrastructure (PKI) is Important?
What is SCEP?Introduction to Simple Certificate Enrollment Protocol SCEP is a very simple certificate enrollment protocol
developed 10 years ago for routers and switches to enroll for x509 version 3 certificates from a Certification Authority (CA).
Generally used by Mobile Device Management (MDM).
A standard implementation of SCEP is not considered secure1
Private Key is generated on the device and marked as Non-Exportable1CERT warns that SCEP does not strongly authenticate certificate requests. Gartner,
Mobile Device Certificate Enrollment: Are You Vulnerable?
Certificate Deployment
DMZ
Understanding the flow – Intune Only
ADFS
CA
MDM (Intune) (and Azure AD)DC
1. Deploy root CA cert2. Deploy SCEP
certificate profile. Intune generates a challenge string.
3. Device gets SCEP profile that contains URI for NDES. Device contacts NDES and presents challenge.
4. NDES forwards to NDES Connector policy module, which validates the request
5. If valid, NDES passes on request to issue Cert “on behalf”
6. Cert is delivered to the device
7. NDES Connector reports event back to Intune
1 23
NDES + Intune NDES
Connector
4
6b
DirSync
Web Application Proxy
5 6a
7
Non-Microsoft PKI Windows 10 SCEP Agent
NDES Server (Hardening Guide1) NDES role placement (DMZ vs Internal) NDES Windows Server 2012 R2 required
S/MIME Encryption (private key non-exportable) New in Windows 10: Allow Direct Install of Certificates
“Passport for Work” Certificate Management/Troubleshooting
Certificate Management App
Challenges and Solutions for CertificatesHow these are addressed with Windows 10
1NDES Hardening Whitepaper for Intune Stand Alone and Hybrid Link
5 – Prepare and Setup Identity
Identity Challenges TodayIdentity needs to be Accessible outside of Organization IT boundariesMobile users roam and need access from everywhere
Windows Mobile Devices have to be activated with an MSAImpossible to manage
Users and IT don’t like a complex Device Unlock
Passwords not secure enoughNot enough to protect against modern security threatsUsers are required to provide their identity to more places than ever
Choosing the right Identity Solution
Cloud Identity
Independent cloud identity
Synchronized Identity
Single identity, enabling a same sign-on experience with password hash sync
Federated Identity
Single federated identity, enabling single sign-on in some scenarios and additional flexibility
Azure Multifactor AuthenticationAny two or more of the following factors:Something you know: a password or PIN.Something you have: a phone, credit card or hardware token.Something you are: a fingerprint, retinal scan or other biometric.
Stronger when using two different channels (out-of-band).
Certificates
PhoneSmartcard
Hardware token
01234
Azure Multifactor Authentication
Windows HelloBiometrics AuthenticationUsing fingerprint, face, iris
Integrated Biometrics FrameworkFalse Acceptance Rate 1/100,000False Rejection Rate 2-4%No personal identifiable data is storedEnable anti-spoofing detection
MDM Managed
Microsoft PassportReplace passwords with a private key Unlocked with solely through a “user gesture” (PIN, Windows Hello)To IT it’s familiar as it’s based on asymmetrical key pair or certificateTo the user, it’s familiar (Windows Hello or PIN)
Choice of Identity Providers (IDP)Identity providers validate and proof user by OTP, PhoneFactor …IDPs map Passport public key to a user account
Private key is never sharedKeys are ideally generated in hardware (TPM)Hardware bound keys are attested (Trusted Computing Group Protocols)Single “unlock gesture” aka “Windows Hello” provides access to multiple credentials (origin isolated)
So do I
Deployment RequirementsPer Directory deployment configuration
Need more info on Microsoft “Passport”? See session here @ Ignite on “Secure authentication with Windows Hello” by Nelly Porter
NGC Azure AD only Hybrid AD AD on-prem
onlyKey-based AAD subscription AAD subscription
AAD Sync w/ NGC key write-back
AD DS 10 DCsAD FS 10
Cert-based AAD subscriptionPKI infrastructureIntune
AAD subscriptionPKI infrastructureSCCM 2015/Intune
AD DS 10 schemaAD FS 10PKI infrastructureSCCM 2015
6 – Learn and Prep for Mobile Device Management (MDM)
Mobile Device Management
BYOD: simple security settings
Device Lockdown
Fully managed corporate device
Phone
Desk
top
Desk
top
Phone
Windows 8.1 Windows 10
Significant investments in added functionality for both mobile and desktop devices
Windows 10 Management Architecture
MDM Client
Common Device Configurator
WMI providers
Provisioning Engine
MDM Configuration Service Providers (CSP’s)
EAS Client WMI Bridge
DEVICE/OS
SERVICE/SERVER
EASProvisioningMDM (Intune) ConfigMgr
Common component PC component
Windows 10 – OMA-DM Communication
MD
M C
lien
t
MDM Configuration Service Providers
(CSP’s)
Com
mon
D
evic
e
Con
fig
ura
tor
MDM (Intune)
SyncML
Configuration Service ProviderA CSP is an interface to read, set, modify, or delete configuration settings on the deviceSyncMLFile with all information to configure CSP
Sample Policy in Intune MinDevicePasswordLength CSP
Sample SynML - MinDevicePasswordLength<SyncML xmlns='SYNCML:SYNCML1.2'>
<SyncHdr> <VerDTD>1.2</VerDTD> <VerProto>DM/1.2</VerProto> <SessionID>1</SessionID> <MsgID>1</MsgID> <Target>
<LocURI>{unique device ID}</LocURI> </Target> <Source>
<LocURI>https://www.contoso.com/mgmt-server</LocURI> </Source> </SyncHdr> <SyncBody> <!-- update device setting --> <Replace>
<CmdID>2</CmdID> <Item>
<Target> <LocURI>./Vendor/MSFT/PolicyManager/My/DeviceLock/MinDevicePasswordLength</LocURI>
</Target> <Meta>
<Type xmlns="syncml:metinf">text/plain</Type> <Format xmlns="syncml:metinf">int</Format>
</Meta> <Data>6</Data> </Item>
</Replace> <Final /> </SyncBody> </SyncML>
OMA-URIOpen Mobile Alliance
Uniform Resource Uniform Resource
Identifier
Syn
cM
L
Syn
cH
ead
er
Syn
cB
od
y
Device
Value
Mobile Device Management Lifecycle
One consistent set of MDM capabilities
across Mobile, Desktop, and IoT
•Provisioning•Bulk enrollment•Simple bootstrap•Converged protocol•Azure AD Integration
• Extended set of policies
• Context based policies• Client certificates –
Direct install (PFX)• Enterprise Wi-Fi
profiles• VPN profiles• Email provisioning• MDM Push when user
not logged in• Kiosk Mode, Start
screen configuration and control
•Curated Windows Store•Volume Purchase Program and app distribution •License reclaim/re-use•Enterprise App management•LOB app management•App inventory (MDM/Store)•App allow/deny list•Enterprise data protection
•Remote Lock, PIN reset, Ring, Find•Full device wipe
•Un-enrollment with alerts•Removal of configuration & EDP protected data
ENROLLMENT
INV
EN
TO
RY
APPLICATION
MANAGEMENT
DEVICE
CONFIGURATIO
N AND
SECURITY
REM
OTE
ASS
ISTA
NC
E
UNENROLLMENT
•Enhanced inventory for compliance decisions
See @ Ignite on “Windows 10 Mobile Device Management (MDM)” by Janani VasudevanSee @ Ignite on “Windows 10 for Mobile Devices - Get and Stay in Control of Your Mobile Fleet” by Sumit Parikh and Roel Schellens
Custom URI settings for Windows 10 devicesReferencesCustom URI settings for Windows 10 devices
Configuration service provider reference
7 –Mobile Device Provisioning and Enrollment approach
ORGANIZATION OWNED
PERSONALLY OWNED (BYOD)
• Computer joins AD to establish trust
• User signs on using AD account
• Group Policy + System Center
Active Directory
• Computer registers with AAD via Workplace Join to establish trust for remote resource access
• User signs in with a Microsoft account, associates an AAD account
• MDM
Azure AD
• Computer joins AAD to establish trust
• User signs on using AAD account
• MDM
• Single sign-on to enterprise and cloud-based services
Enrollment OptionsDevice Ownership & Identity Choices
Auto MDM enroll with Azure ADAAD join: Company owned
Add AAD account: Personally owned
Bulk enrollment and provisioning simplifying IT setup Removable media (SD/USB) on Desktop and
Mobile NFC (Mobile only) Click on .PPKG file (from email, local
storage, media, URL) USB tether (Mobile only)
Windows 10 Provisioning and EnrollmentGives you more options
Password
Sign in to your work or school account
Sign inCancelPrivacy statement
Forgot your password?
If your organization uses Office 365 or other business services from Microsoft, use the same user name and password to sign in here.
Sign in
What account should I
use?
|someone@example.com
Work or school account
Allow this PC to be managed ?
Accept
Cancel
Contoso requires this PC to be managed before it can access org resources.
What you get on this PC:• Email, Calendar, Contacts• OneDrive for Business • Access to company apps
How this PC is controlled by Contoso:• Enforce PIN lock• Partial device wipe• Enforce password policy• Monitor device location
Questions? Contact Contoso IT Help Desk at (206) 555-1234.
StartStart
Contoso Corp
Curious to know AAD Join? See session here @ Ignite Managing Windows 10 with Microsoft Intune and System Center Configuration Manager Jason Githens, Mark Florida, E450
Need more info on Bulk provisioning? Session here @ Ignite on “Provisioning Windows 10 Devices with New Tools” by Vladimir Holostov
ENROLLMENT
INV
EN
TO
RY
APPLICATION
MANAGEMENT
DEVICE
CONFIGURATI
ON &
SECURITY
REM
OTE
ASS
ISTA
NC
E
UNENROLLM
ENT
What can be Provisioned
Initial Setup Edition Upgrade Certificates Connectivity Profiles
Management Enrollment
Modern Applications
Win32 Applications Scripts
Enterprise Policies
Offline content Browser SettingsStart Menu
Customization Assigned Access
8 - Protect Your Data
Data Protection Challenges TodayHow to prevent access to Company data by non-compliant mobile devicesInsecure devices put your company data at risk
Keep Company data separate from Personal DataCompany owned data should be protected and controlled
End users don’t like “Containerized” solutionsUsers prefer to work with applications they are familiar with (e.g. Mail, Web browser, File Explorer) Users don’t like to switch between different environments on the same device
How to prevent data loss by lost devices and unenrolled (BYOD) devicesEnsure Company Data will be wiped or is unaccusable
Condition Access / Health AttestationNeed access? Prove you’re healthy
MDM evaluates compliance
HealthAttestation CSP
Device health attestationWindows health attestation service Here @ Ignite “Securing Access to Microsoft Exchange and SharePoint Online services with Microsoft Intune“ by Dilip
Radhakrishnan & Chris Green
Important resources
Documents
1
2
Access please
You’re in
Important resources
Documents
Email2
1
5
3
4
Here is my proof
Prove to me you are healthy
Access please
MDM & Windows Attestation Service
Enterprise Data ProtectionCompany data stays separate & secure
Here @ Ignite: “Protecting your data with containers without boxing yourself in” by Yogesh Mehta
“Enterprise data protection”
User friendly work-personal separation
Manage what data is “Enterprise”
Audit intentional data disclosure
for business
personal
Business Apps & DataManaged
Personal Apps & DataUnmanag
ed
Data exchange is blocked or audited
9 - Allow to Work from Anywhere from any Device
Intranet DMZ
DC
ConfigMgr2012 R2
DirSync
ADFS
CA NDES
MDM (Intune) (Azure AD and O365)
SharePoint/
EASVPN
WAPADFS Proxy
Remote Access
DNS
(CNAME)Web Application Proxy
Challenge today: Kerb.DomJoined New in Windows 10:Passport
2 Types of Remote Access VPN - New in Windows 10
“Auto Connect” / Always on VPN Per App VPN (New in Windows 10) VPN Plugin and vSC Support
(Passport)
Need more info? Session here @ Ignite “Secure Enterprise Network Access and VPN” by Aman Arneja
10 - Make your Applications mobile and manageable
Windows 10 Application Store and Portal Options
Screen shot
Windows Store
Modern appsSign in with MSAPay with credit card, gift card, PayPal, mobile operators
Business Store
Modern appsLeverages Azure ADPrivate store in the store for Store and LOB appsPay with credit card or PO/invoiceModern app license management
Company Portal
MDM-drivenDeploy Line-of-business modern apps from catalogueDeploy Windows Store apps (even when the Store UI is disabled) and as well as uploaded LOB apps through BSP integration
Here @ Ignite: “Windows 10 for mobile devices Enterprise business apps and app management” by Alan Meeus
Here @ Ignite: “BRK3338-Using the Business Store with Windows 10 Devices” by Ford McKinstry and Patel
Related SessionsMay 5, 9:00 AM - 10:15 AM BRK2348 - Windows 10 for Mobile Devices: What’s Next
Augusto Valdez; Nick Hedderman, S502May 5, 10:45 AM - 12:00 PM BRK2348 - Windows 10 for Mobile Devices: Making the Mobile Shift and Drive Business Performance and Innovation
Arno Harteveld, S501May 5, 1:30pm-2:45pm BRK3300 - Windows 10 for Mobile Devices: 10 Steps for a Successful Deployment
Roel Schellens Tuesday, E351May 5, 3:15 PM - 4:30 PM BRK2330 - Windows 10 for Mobile Devices: Top 5 “Get Ready” Activities to Prepare for Windows 10
Frank Pinto, S505May 5, 5:00 PM-6:15 PM BRK3305 - Windows 10 for Mobile Devices: To Bring Your Own or Not?
Alain Meeus, S502May 6, 9:00am-10:15am BRK3309 - Windows 10 for Mobile Devices: Secure by Design
Alain Meeus , S503May 6, 10:45am-12:00pm BRK3301 - Windows 10 for Mobile Devices: Provisioning Is Not Imaging –
Samesh Singh, S502May 6, 1:30pm - 2:45pm BRK3310 - Managing Windows 10 with Microsoft Intune and System Center Configuration Manager
Jason Githens, Mark Florida, E450May 6, 3:15 PM - 4:30 PM BRK2328 - Windows 10 for Mobile Devices: Tips and Tricks Demo Fest
Augusto Valdez; Nick Hedderman, S505May 6, 4:35pm - 4:55pm THR0333 - Windows 10 management with Microsoft Intune and System Center Configuration Manager
Jason Githens, THR0333May 6, 5:00pm - 6:15pm BRK3308 - Windows 10 for Mobile Devices: Get and Stay in Control of Your Mobile Fleet
Sumit Parikh, Roel Schellens, S105DMay 7, 10:45am - 12:00pm BRK3312 - Windows 10 for Mobile Devices: Enterprise Business Apps and App Management –
Alain Meeus, S105DMay, 7, 1:30 PM - 2:45 PM BRK3313 - Windows 10 Mobile Device Management (MDM) in Depth
Janani Vasudevan, N426May, 7, 1:30 PM - 2:45 PM BRK2301 - Windows 10 for Mobile Devices: From the Support Trenches
David Alessi; Mike Danoski, S502
Windows 10 Mobility Links and Blogs
• Windows 10 MDM documentation ONLINE http://aka.ms/kw2vwj
• Microsoft Intunehttp://www.microsoft.com/en-us/server-cloud/products/microsoft-intune/
Blog: The Mobility Guys A new blog originating from the Deployment Guys A group of Mobility Experts blogging about Microsoft Mobility
solutions including EMS and Windows 10. Blog Series: Build Your Own Enterprise Mobility Lab
• Blog: Microsoft IntuneOfficial Microsoft Intune blog of the Microsoft Intune
Connect with Microsoft Services about enterprise mobile and cloud strategies for your business
Learn more about what we’re doing at Ignite: aka.ms/digitalforbusiness
Join the conversation on Twitter@MSservices #MSIgnite#Windows10
Visit our interactive Ignite booths • Daily raffles for mobile devices
and wearables
• Ask us about scheduling a free Windows 10 Deployment Assessment or Enterprise Strategy Briefing
Visit Myignite at http://myignite.microsoft.com or download and use the Ignite Mobile App with the QR code above.
Please evaluate this sessionYour feedback is important to us!
© 2015 Microsoft Corporation. All rights reserved.
top related