Tags Guide Part V: macOS

Exchange ActiveSync

Email

Passcode

With passcode settings, you can ensure that your users' managed devices are protected from unauthorized third-party access by requiring a passcode, for example. You can also set other security-related settings associated with the passcode configuration, such as the length and complexity of required passwords, or resetting the device to factory defaults after a certain number of failed attempts. 

Screen Saver

This feature sets controls if a password is required when the Screen Saver is unlocked or stopped, the delay of passwords can be defined and the idle time, before the screen saver starts.

Restrictions

Restrictions are usually simple on/off settings that extend the configuration options of your managed devices and increase the security options. By enabling or disabling them, users are either authorized or explicitly prohibited from configuring certain settings on the device.

Virtual Private Network

Wi-Fi 

Silverback offers the ability to pre-populate multiple Wi-Fi Profile and settings on your devices, so the user does not need to know the password for these networks. If you having a WPA Enterprise protected network (e.g. with a RADIUS Server), please refer to WPA Enterprise Settings  for additional information. 

Firewall

macOS Firewall can be set up to prevent unauthorized applications, programs and services from accepting incoming connections. The configuration is supported from macOS Sierra and newer (10.12+). 

FileVault

FileVault full-disk encryption uses XTS-AES-128 encryption with a 256-bit key to help prevent unauthorized access to the information on your startup disk. When FileVault is turned on, macOS devices always require log in with an account password.  The encryption occurs in the background and only while the device is awake and plugged in to AC power. Users or Administrators can check the progress in the FileVault section of Security & Privacy preferences. Any new files that are created are automatically encrypted as they are saved to the startup disk. In case users will lose or forget their account password, the devices can be recovered by an reset using the Reset Password assistant with the Recovery Key from the users. Administrators will see the corresponding Recovery Key in the device information under the Security Information sections. Due to the possibility of changed personal recovery keys in the device cycle for the users, a Recovery History will be saved and can be revealed by Administrators. Each reveal action will create an entry in the Audit Logs.

System Extensions

Apple did with macOS Catalina a step in modernizing and improving the security and reliability of macOS to provide a better architecture for kernel extensions and drivers. The outcome is a separation between System Extensions (macOS 10.15+) and Kernel Extensions . System extensions on macOS Catalina and later allow software like network extensions and endpoint security solutions to extend the functionality of macOS without requiring kernel-level access. System extensions are divided into Driver, Network, and Endpoint Security Extensions. They run in user space, where they can’t compromise the security or stability of macOS. Once installed, an extension is available to all users on the system and can perform tasks previously reserved for kernel extensions. 

systemextensionsctl list

enabled active  teamID  bundleID (version)  name    [state]

Kernel Extensions

In general, applications like antivirus software, firewalls,  VPN clients, USB driver etc, install kernel or system extensions to extend native capabilities of the macOS operating system. The applications gain features access that are of the OS that applications without extensions can't access.  Apple announced the plans to deprecate macOS Kernel Extensions and replace them with the macOS System extensions to modernize the platform, improve security and reliability, and enable more user-friendly distribution methods. The first step from Apple towards that was the introduction of system extensions for macOS Catalina. 

sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy

SELECT * FROM kext_policy;

kextstat

kextstat | grep -v com.apple

cd /System/Library/Extensions/

Privacy Preference

Privacy Preference settings allows Administrator to predefine approvals or denials for device feature requests from applications. On macOS devices, apps and processes often prompt users to allow or deny access to camera, microphone, files, calendars and address books. Use the ability to manage data access consent on behalf of your users and to overrule previous decisions made from the users. Privacy Preferences are supported in macOS Mojave (10.14+) and later. Press New Privacy Preference Profile to control data access on an app level basis. 

Notification Settings

Notification settings offers Administrators the capability to define specific per app notifications, using their bundle identifiers. Notification settings are supported for devices running macOS 10.15+ and later. Notifications can be disabled at all or can be permitted to options like Show in Notification Center or Show on Lock Screen. This profile helps to ensure that users don't accidentally disable notifications for important applications. To configure the new Notification Settings, press New Notification Setting and select the App Store Country and start with a search for the app. After entering an app name, you receive the choice to select your application. After that, configure the following notification controls to your needs:

Software Updates 

Provides the capability to control Software Updates settings on macOS devices. 

Global HTTP Proxy

Enabling the Global HTTP Proxy will force all Network Traffic through a designated proxy server.

Time Server

This profile is used to define a time server on a managed device and a desired time zone. Upon activation of the profile, the default setting is the Apple time server (time.apple.com). However, this can be changed to an alternative time server such as (time.windows.com). It is also possible to set the desired time zone for the device using the drop-down menu. For additional information, please refer to Set and configure Time Zones for Apple devices.

Extensible Single Sign-On

Extensible Single Sign-On streamlines and secures user authentication across apps and services by allowing customized, centralized login experiences. You can use the Extensible Single Sign-On profile to define extensions for multifactor user authentication on your enrolled iPhone, iPad, or Mac devices. This extension is for use by identity providers to deliver a seamless experience as users sign in to apps and websites. When properly configured, the user authenticates once then gains access to subsequent native apps and websites automatically. This should result in an enhanced user experience and reduced login friction, while improving security and reducing support costs while having consistent authentication policies. Please refer to Streamline User Authentication with Extensible Single Sign-On for additional information. 

<key>AllowList</key>
<string>com.imagoverum.com</string>
<key>Enabled</key>
<integer>1</integer>

App Portal

The Application portal is where devices can access Enterprise applications and recommended Third Party applications via a web clip icon. To enable access to the Application portal for end users and push the app portal web clip icon to devices, ensure App Portal Enabled box is ticked.

Custom Profiles

Custom Profiles are a very helpful option to configure additional payloads for your managed devices. You can utilize the Apple Configurator 2 to create custom profiles in a *.mobileconfig format. Additionally, you might create or receive a custom XML from a third-party vendor, like for the Cisco Security Connector Umbrella Setup for iOS and iPadOS. Depending on the format or the way how you create or receive the profile, you can either upload the *.mobileconfig to Silverback or add the XML content into the provided section inside the profile. Created profiles with the Apple Configurator 2 can easily be adjusted by replacing the file type to *.txt (e.g., on Windows 10) or opening these files directly with the Text Editor (e.g., on macOS devices). System Variables are supported in the Use XML option or by uploading a *.mobileconfig file that contains a System Variable. Silverback will adjust the XML or the mobileconfig on the fly and convert the System Variables to the individual values and install this payload with the desired content on your devices.

• Click New Custom Profile

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>allowRapidSecurityResponseInstallation</key>
            <false/>
            <key>allowRapidSecurityResponseRemoval</key>
            <false/>
            <key>allowUSBRestrictedMode</key>
            <false/>
            <key>allowUniversalControl</key>
            <false/>
            <key>PayloadIdentifier</key>
            <string>com.example.myrestrictionspayload</string>
            <key>PayloadType</key>
            <string>com.apple.applicationaccess</string>
            <key>PayloadUUID</key>
            <string>53bec1be-ffec-4f88-acbd-b02aee8f04a9</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Restrictions</string>
    <key>PayloadIdentifier</key>
    <string>com.example.myprofile</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>6020206c-12c2-4ada-987a-dd4c560ca73a</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Web Clips

Silverback allows administrators to push down Internet shortcuts to their Managed Devices, giving users easy access to the websites the administrator wants.

• Click New Web Clip

OS Version Compliance 

Administrators have the ability to control which OS versions are allowed within their environment. To allow an OS version, simply ensure the checkbox next to the respective OS version is ticked. Enrolling a device with a disabled OS version will result in the device automatically being blocked.

• Alert Administrators: When the checkbox is checked, all administrators will receive an email when a device that violates OS compliance is detected, or when a new OS version is discovered.
• Automatically Approve New OS Versions: When an OS platform is enrolled to Silverback for the first time, the OS is automatically added to the list. By default, unknown OS platforms are disabled and relevant devices will be blocked. To automatically authorize new OS versions as they are discovered, ensure the checkbox is ticked.

Use this feature where you do not want devices to be automatically blocked when a user upgrades their device to a new future OS version that is released by their software vendor.

OS Updates

A common question that you may face is how can we prevent our devices from updating updating to the latest version of macOS and how can we test the new macOS update before all of our users will install it?  Often, organizations wish to check the latest macOS release, verifying that the business-related apps they use will continue to function properly on the devices used by their organization. For that Apple offers the possibility to specify a number of days to delay software updates, with a maximum of 90 days. With this option enabled, the user of the device will not see a software update until the specified number of days has passed since the release.

Hardware Compliance 

Administrators have the ability to enforce a hardware compliance policy through Silverback. Simply uncheck the boxes for hardware types that should not be supported and any devices that match the hardware type and are managed by Silverback will be blocked. The list of hardware types is managed via the Device Types option in the Admin Tab of the Silverback Console. If a mapping from device type to hardware type exists, the hardware type will be displayed in the hardware compliance list. When a Device Manufacturer release a new version of their hardware the model numbers may not be known by Silverback, in this case Silverback will ‘learn’ them and store them as ‘Unknown’ in the Device Types section under the Admin Tab where the Administrator can update them manually. To allow these devices into your system you enable the ‘Unknown’ checkbox option. This will allow the device into your Silverback Environment and you can later re-classify this device type in the Admin > Device Types section.

• Alert Administrators:  When the  checkbox is checked it will ensure that administrators receive an email when a device that violates hardware compliance is detected.

Lockdown

The Lockdown screen allows you to determine what device compliance policies are enabled and what action should automatically occur when a violation is detected. Each policy is enabled/disabled through their associated checkbox. Enabling a lockdown policy ensures that the device is inspected to ensure it is compliant with that policy during the initial enrollment as well as at regular intervals as defined by the ‘Perform check every’ drop down.

App Types

Three different App Types are available for macOS devices:

Assign Apps 

Once Apps are uploaded into the Silverback App Portal Tab, they can be distributed to devices via a Tag they have been associated with.

• Navigate to Apps
• Click Assign More Apps
• Select any applications from the shown Assign Applications page 
• Click Add Selected Apps 

Change Deployment Options

By default configurations will be inherit from the App Portal. To customize the settings perform the following steps for each application:

• Click the Edit button in the Manage Config column
• Update Deployment Options
• Click Save

Overview

Already assigned applications are displayed in the Apps section of any Tag with the following columns: 

Change Deployment Options 

By default configurations will be inherit from the App Portal. To customize the settings perform the following steps for each application.

• Click the Edit button in the Manage Config column
• Update Deployment Options
• Click Save