Sophos Mobile Control
25 Send messages to devices
From the web console, you can send user-defined messages to managed devices. After an iOS device has been bootstrapped and the Sophos Mobile Control app is installed, APNs messages are sent. After an Android device has been set up, GCM push messages are sent.
You can send messages to individual devices or device groups.
25.1 Send messages to individual devices
1. In the web console menu bar, go to Inventory and click Devices.
The Devices view is displayed.
2. Click the Show or Edit icon next to the required device.
The Show device or Edit device view is displayed.
3. Click the Send message button.
The Enter message view is displayed.
4. In the text field, enter the message you want to send. A character counter below the field counts from the number of available characters to 0. After 0 has been reached, you cannot enter any further characters. After you have entered the message, click Next.
5. Click the Finish button.
6. A message prompting you to confirm that you want to send the message is displayed.
7. Click the Yes button.
25.2 Send messages to device groups
1. In the web console menu bar, go to Inventory and click Device groups.
The Device groups view is displayed.
2. The next step depends on whether you want to send the message to all or only selected device groups:
■
■
To send a message to all device groups, click the Send Message button in the Device groups view.
To send a message to a specific device group, click the Show icon next to the required group and click the Send Message button in the Show device group view.
The Enter message view is displayed.
140
Administrator guide
3. In the text field, enter the message you want to send. A character counter below the field counts from the number of available characters to 0. After 0 has been reached, you cannot enter any further characters. After you have entered the message, click Next.
The Set execution date view is displayed.
4. Under Scheduled date, select Now or specify a Date and Time for the execution of this task.
5. Click the Finish button.
The message is sent at the specified date and time.
141
Sophos Mobile Control
26 Managing Sophos Mobile Security from Sophos Mobile
Control
Sophos Mobile Security is a security app for Android phones and tablets that protects devices from malicious apps and assists end users in detecting apps permissions that could be a security risk.
The Sophos Mobile Security management functionality is an optional Sophos Mobile Control module. In order to manage the Sophos Mobile Security app from Sophos Mobile Control, a license needs to be available and activated in the Sophos Mobile Control web console.
You can manage the Sophos Mobile Security app on managed devices from the Sophos Mobile
Control web console as follows:
■
You can configure settings for the Sophos Mobile Security app on all managed end user devices remotely and centrally in the web console.
■
You can make sure that the Sophos Mobile Security app is installed on end user devices and runs scans at defined intervals. You can define this as a compliance criterion.
■
You can trigger scans for specific devices.
■
You can view scan results for devices in the web console.
For further information on Sophos Mobile Security, see the Sophos Mobile Security help.
26.1 Licenses for managing Sophos Mobile Security
In order to manage the Sophos Mobile Security app from Sophos Mobile Control, valid licenses are required. After purchase you receive the license key for activating your Sophos Mobile Security license. How you activate the license in the web console depends on the Sophos Mobile Control variant in use (on-premise installation or Software as a Service).
26.1.1 Activate licenses for on-premise installations
For on-premise Sophos Mobile Control installations, Sophos Mobile Security licenses are managed by the super administrator in customer management. For further information, refer to the Sophos
Mobile Control super administrator guide.
26.1.2 Activate licenses for Software as a Service installations
1. In the web console menu bar, go to Settings and click System setup.
The System setup view is displayed.
142
Administrator guide
2. In the SMSec License tab, enter the license key you have received from Sophos in the License
key field and click Activate.
The Sophos Mobile Security license is activated. The Active license key field shows the activated license key. The Number of licenses field shows the number of available users. The Valid until field shows the license expiry date.
26.2 Configure settings for Sophos Mobile Security
Prerequisite: A license for managing Sophos Mobile Security from the Sophos Mobile Control web console is available.
Note: Default settings are preconfigured. While you are changing settings you can reset them to the default values any time by clicking the Restore default settings button.
1. In the web console menu bar, go to Settings and click General.
The General settings view is displayed.
2. Go to the SMSec tab.
3. Under General, you can specify the following: a) In the Cloud scan mode field, define when Sophos Mobile Security should scan for the latest malware information. Select one of the following options to define when the app should use a cloud lookup:
■
Always
■
Not while roaming
■
Wi-Fi only
With this setting you can control the data traffic of the app. If you set Cloud scan mode to
Wi-Fi only, the cloud lookup will only be performed when the device has a Wi-Fi connection.
If you set Cloud scan mode to Not while roaming, a cloud lookup will never be performed while the device is roaming in a foreign network.
b) In the Scheduled scan interval field, select how often scans are carried out.
c) Select Enable user to allow apps to enable users to allow apps although they have been identified as malware. The user can mark them as ignored. In subsequent scans, these apps will not be shown as threats.
4. Under Targets, you can select the following: a) Select Scan system apps to include system apps in scans.
143
Sophos Mobile Control
System apps are not scanned by default as they are protected by the Android OS and cannot be removed by the user. But you can activate the scanning of system apps here.
b) Select Scan SD Card, USB, ... to scan all files on SD cards, USB and other external storage devices in addition to per default scanning of all installed apps on the device.
c) Select Detect PUAs to scan for Potentially Unwanted Applications.
Potentially Unwanted Applications (PUAs) are apps that, while not malicious, are generally considered unsuitable for business networks. The major PUA classifications are Adware,
Dialer, System monitor, Remote administration tools and Hacking tools. But certain apps that can fall into the PUA category might be considered useful by some users.
If you select this option, Sophos Mobile Security will detect PUAs during scans and notify the end user accordingly.
5. Under Live Protection, you can select the following: a) Sophos Mobile Security scans apps during installation on the Android device by default.
To deactivate this behavior, deselect On install scan.
b) Make sure that Scan notification is selected to receive scan notifications.
c) Select Monitor SD Card to monitor the SD card for any changes. If new files are stored on the card, they are scanned.
a) In the Webfilter mode field, define the settings for filtering web pages with inappropriate or offensive content:
■ If you select Never, users can view any website on their devices, regardless of content.
■
If you select Standard, a warning message is displayed as soon as a user opens a website with inappropriate content. The user can choose to ignore this message and continue to the website.
■ If you select Maximal, websites with inappropriate content are blocked.
Websites are categorized based on contents by SophosLabs. Data is updated constantly.
6. Click the Save button.
The settings are valid for all Android devices with the Sophos Mobile Security app installed in the customer you are logged on to. The settings defined in the Sophos Mobile Control web console cannot be changed on the end user device. They are greyed out.
26.3 Define Sophos Mobile Security compliance settings
Prerequisite: A license for managing Sophos Mobile Security from the Sophos Mobile Control web console is available.
144
Administrator guide
You can configure compliance settings that relate to Sophos Mobile Security in the web console.
1. Add a new compliance rule or open an existing set for editing. For further information, see
Configure compliance rules
(section 12).
2. Go to the Android tab.
3. In the Max. SMSec scan interval field, you can specify the maximum scan interval for malware scans performed by the Sophos Mobile Security app on the device.
4. In the Malware apps allowed field, select whether detected malware apps are allowed on devices.
5. In the Suspicious apps allowed field, select whether detected suspicious apps are allowed on devices.
6. In the PUA allowed field, select whether detected PUAs (Potentially Unwanted Apps) are allowed on devices.
7. After you have configured all required settings, click the Save button.
26.4 Trigger a scan for a specific device
Prerequisite: A license for managing Sophos Mobile Security from the Sophos Mobile Control web console is available.
1. In the web console menu bar, go to Inventory and click Devices.
The Devices view is displayed with all devices registered with Sophos Mobile Control for this customer.
2. Click the Show icon or the Edit icon next to the required device.
The Show device or the Edit device view is displayed.
3. Click the Start SMSec scan button.
The device is scanned according to the Sophos Mobile Security settings configured in the web console.
26.5 Trigger a scan through a task bundle
You can define a scan task in a task bundle, for example to trigger a scan on multiple devices and to combine the scan with further tasks.
1. Create a new task bundle or open an existing one for editing. For further information, see
Create task bundles
(section 18.1).
2. Click the Create new task button.
3. In the Select type view, select Start Sophos Mobile Security scan and click Next.
The Edit task properties view is displayed.
145
Sophos Mobile Control
4. In the Task name field, specify a meaningful name for the task and click Next.
The task is displayed under Tasks in the Edit task bundle view.
5. After you have added all required tasks to the task bundle, click the Save button in the Edit
task bundle view.
26.6 View Sophos Mobile Security scan results
Prerequisite: A license for managing Sophos Mobile Security from the Sophos Mobile Control web console is available.
1. In the web console menu bar, go to Inventory and click Devices.
The Devices view is displayed with all devices registered with Sophos Mobile Control for this customer.
2. Click the Show icon or the Edit icon next to the required device.
The Show device or the Edit device view is displayed.
3. Go to the Scan results tab.
The tab shows the Sophos Mobile Security scan results. The non-clean packages, for example potentially unwanted apps, are shown in a table below. Under Threat name, you can click on the shown links to display further information on the relevant threat from SophosLabs.
4. Go to the Compliance violations tab to view the compliance violations related to the scan results. The violations shown depend on the Sophos Mobile Security compliance settings defined.
146
Administrator guide
27 Appendix: Common web console buttons
This appendix provides an illustrated overview of all common buttons throughout the web console and their functions.
Button Name
Next
Back
Information
Duplicate this bundle
Yes
No
Group selection
Select device(s)
Description
Navigates to the next view, for example after a process step has been completed.
Navigates to the last view.
Provides further information on a specific topic
Duplicates a profile/command bundle/task bundle.
Confirms an action.
Cancels an action.
Switches to the
Select device
group(s) view. In this view, you can select one or several device groups for a process.
Switches to the
Select device(s)
view. In this view, you can select one or several devices for a process.
147
Sophos Mobile Control
Button Name
Finish
Edit
Save
Reload
Create new <item>
Delete
Import <items>
Creates a device report (CSV file).
Description
After you have completed the required steps for a specific process, this button executes the relevant action.
Opens an edit view where you can change settings or information.
Saves changed settings.
Reloads the contents of a table.
Adds an entry, for example a device.
Deletes a selected entry
Imports entries, for example devices from a
CSV list, to Sophos
Mobile Control.
Exports device information to a
CSV file.
148
Administrator guide
28 Technical support
You can find technical support for Sophos products in any of these ways:
■
Visit the SophosTalk community at
http://community.sophos.com/
and search for other users who are experiencing the same problem.
■
Visit the Sophos support knowledgebase at
http://www.sophos.com/en-us/support.aspx
.
■ Download the product documentation at
http://www.sophos.com/en-us/support/documentation.aspx
.
■ Send an email to
[email protected]
, including your Sophos software version number(s), operating system(s) and patch level(s), and the text of any error messages.
149
Sophos Mobile Control
29 Legal notices
Copyright
©
2011 - 2013 Sophos Ltd. All rights reserved.
No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.
Sophos is a registered trademark of Sophos Ltd. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.
150
