Hi there.
Thanks for joining this JNUC session
about a new feature
we've added to Jamf Protect
called Network Threat Prevention.
My name's Lucas Kemperman.
I'm senior manager of program management
here at Jamf,
and I'm one of the people of the Jamf team
who've been working on delivering
this feature to you.
What we'll be doing today
is, first of all, give you
a little bit of background information
about network threat prevention
and what problems we're trying
to help you solve here.
After that, we'll jump
into the actual interactive lab session
where you yourself will be able
to deploy, configure, and use the tool
and get insights out of this solution.
Feel free to post questions at any point
during this session in the chat,
and I'll be there to try and answer them.
So first of all, just a little bit
of background information on Jamf Protect
and the original features.
The deployment of Apple tech in business
has grown rapidly
over the past five years.
So has the demand for solutions
to easily and securely enable
these platforms to be used
within this new environment.
Employees across the business
have been demanding the right
to not only use their preferred technology
[inaudible] Apple at work,
but also, the same level of security,
management, and usability
as their counterparts in other platforms.
And IT admins are in the middle there
as the superheroes that are managing
all of this complexity.
They simplify the end user experience.
And our purpose here at Jamf
is to bring them enterprise
secure solutions that are consumer simple
and protect the privacy of their users.
Jamf Protect was built with all of that
in mind and provides capabilities
to monitor compliance,
to protect corporate data,
and prevent both known and unknown malware
and make it easy to remediate any issues.
What we've been seeing
is that the threat landscape on macOS
has been changing.
Macs are becoming
evermore prevalent within businesses,
enterprises, health care,
and also innovation across the world.
One example, one stat that I wanted
to highlight is that, within the U.S.,
we've seen that 23% of enterprise devices
now are Macs in 2020,
according to [inaudible].
Now, this is all happening as a result
of a number of factors,
including the fact that we're seeing
more and more millennials
not just joining, but also taking on
more important roles within the workforce.
The global shift from working
in the office to working from home
is also a factor here
as is the introduction of Apple's
silicon chips.
And just as Jamf has rapidly adopted
the new Apple silicon architecture
for our products, so did malware authors.
Indeed, it didn't take long
to see the first malware appear that had
native support for universal binaries.
Clear indicator that bad actors are paying
attention to the developments
and are seeing enough of a return
on investment
for continuing to adapt their attacks
to significant platform changes
such as these.
So what we're seeing in this changing
landscape is that there's also
a need for prevention on multiple levels
and to keep fighting all of the threats
that we're seeing.
First, on the left-hand side here
are the on-device threats,
the more traditional type of threats
that Jamf Protect was already
perfectly suited to prevent.
This includes
configuration-based vulnerabilities
that can be monitored and eliminated,
thanks to our CIS-based insights,
as well as known Mac malware that can be
prevented and quarantined upon execution.
Also malicious activities
and suspicious behaviors that can be
tracked and automatically remediated.
Then there's a whole other category–
network threats.
And that includes things such as known
and zero-day phishing attacks,
malicious network connections,
and even risky and inappropriate
websites access–
which does not necessarily sound
like a security threat–
can present risks when it comes
to legal and regulatory compliance
as well as reputational damage
for your organization.
Network threat prevention has dramatically
expanded Jamf Protect's ability to secure
a Mac in the enterprise
without compromising
the end user experience,
allowing you to prevent inbound threats
from even reaching your endpoints.
It can block phishing,
malicious network communications,
cryptojacking attacks,
and other attack factors.
Secondly, the Network Threat Prevention
technology also gives you a very robust,
content-filtering solution
allowing IT admins to fight
against risky, inappropriate, and illegal
content access on corporate devices,
using our category-based filtering.
Now with that, my aim here today
is to guide you and demonstrate
how you can quickly set up and get started
with this new feature that is included
in Jamf Protect and is available
to all of our Jamf Protect customers,
including those that have purchased it
as part of their business
or enterprise plan.
So let's jump into our Interactive Labs
environment where we'll start to deploy,
configure, and learn how to get value
out of Network Threat Prevention.
You can scan the QR code that you can see
here on the screen.
Or you can simply follow the link
that's also in the screen now
to get started and get this set up.
Network Threat Prevention is based
on technology that Jamf acquired
from the Wandera purchase last year.
We at Jamf are working very hard
to bring all of this together
and integrate the products more closely.
But for now, we'll be using
an additional portal called RADAR
with its own username and password
to access Network Threat
Prevention features.
Now, all new Jamf Protect business
and enterprise customers since July
automatically received a RADAR login.
For customers that have been using
Jamf Protect for longer,
you should have received an invite
from Customer Success
in the past few weeks.
But for this demo,
we're going to assume that you did not
have time to act on that invite back then.
So let's go to the radar.jamf.com portal
and click on that Reset,
Forgot Your Password link.
And let's request a password reset email.
Once you've done that, you should receive
an email from Jamf in just a few minutes.
And in that email,
you'll find a Reset button.
So let's click on that
once we receive that.
Once you've clicked on that button,
you'll be able to set a new password.
So this will be a different password
or can be a different password
from your normal Jamf Protect
or Jamf Pro login details.
Once you've chosen that,
let's click on the Change Password button.
And then click on Back To Sign In.
And then log in with our new
Jamf Protect credentials.
So once you've entered that,
click on the Login button.
And you'll log into the RADAR portal.
Now, the first thing we'll do
is deployment.
So let's click on Deployment
on the left-hand side.
And then click on Activation Profiles
and select the Default Activation profile
that we've already created.
Here, scroll down and you'll see
that we're already on Jamf Pro SMDM,
which is the one we want to be on.
And let's select macOS Devices
and download the Configuration
Profile here.
And we'll just use that later,
once we switch to Jamf Pro.
Before we do that, however,
we also want to set up UEM Connect.
UEM Connect is a feature that allows us
to sync information between Jamf Pro
and RADAR.
So let's click on Integrations
and then UEM Connect
on the left-hand side
and select Jamf Pro as our UEM.
Here, you'll want to enter the information
relating to your Jamf Pro account.
So you'll be entering the URL,
first of all, as well as a username
and password of an administrator
with admin permissions.
And that will allow us to sync information
between the two systems.
And that means that you'll also not
have to log in to RADAR
to manage your users.
Everything can be done from Jamf Pro.
And the information is just automatically
synced back and forth
between the two systems.
Once you've done that and you've clicked
on the Test and Save button,
you'll see a confirmation saying
this has been successfully connected.
And let's just click Save.
And that's it.
That's the integration or setup.
So at this point,
let's switch to the Jamf Pro portal.
This will probably look a lot more
familiar to most of you.
Let's log in to Jamf Pro.
And what we'll be doing here is,
we'll be uploading that configuration
profile that we just downloaded
out of RADAR.
So once we are in,
let's click on Computers
on the left-hand side.
And then let's select
Configuration Profiles.
And then click on the Upload button.
Once we're there, we'll choose Files.
And we'll pick the file that we just
downloaded out of RADAR
and click on Upload.
Now, in here, there are no settings
or options that need to be configured.
Everything is already there.
Everything's preconfigured.
The only thing you'll need to do
is go to the Scope tab and actually choose
what devices to deploy this to.
What we recommend is that you always start
with just one or two test devices
just to make sure everything works
before you deploy to your whole fleet.
So in this case, I'm just going to select
my old test laptop
and click Save to scope that out
and deploy to that device.
And that's all that needs to be done
in Jamf Pro.
So at this point, the device will receive
the configuration, and there is nothing
that the end user needs to do.
It's going to be completely
seamless for them.
So now that that's all configured
in Jamf Pro, let's switch back to RADAR.
And let's just refresh this page here.
And what we'll see is that
we now have one device
syncing across our test device.
So that information is
just coming through,
and that device has been deployed
successfully into RADAR.
Let's click on Devices
on the left-hand side and click on Manage.
And then you'll see here
in the Default Group one device.
And you can see my MacBook Air
here as well.
And we'll see a green tick
next to Network, which means
that information is being sent
via the Jamf Security Cloud,
and one next to UEM
as well, indicating information
is syncing from Jamf Pro.
So that's great.
That's the deployment section
completely done.
Next up, we're going to actually configure
some policy, starting with a block policy.
So here, there are millions of domains
within these categories.
We're just going to block three
of the most common
blocked categories here–
gambling, adult, and illegal.
So that means all websites that are
categorized in any of those domains
will be blocked for all our users.
And let's just click Save and Apply.
Now, on top of that, I'm just going
to configure a custom rule as well.
In this case, I'm going to block
wikipedia.org just to have
one more site that we can test
and make sure that all
of our blocking functionality
is working successfully.
Then, let's click Save and Apply.
Now, you can get a lot more granular here.
You can create different policies
for different groups.
For example...
we're not going to go into that now.
Let's just start
with a simple, basic policy.
And then also go and let's have
a look at our security policy.
So click Security and then Threat Response
on the left-hand side.
And let's click on Laptop to only see
those threats that are relevant
for our laptop devices.
Here, under Malware,
I'm just going to enable
the notifications.
You'll see that all threats are already
being blocked and detected.
We're just going to enable End User
and Admin Notifications as well.
Now, at this point, let's actually
have a look on the test device.
So here, what we're looking at
is my test device.
I'm going to go
to the Network Preferences.
And what I'll see here is a new profile
that's been sent
completely seamlessly to the device,
called DNS Settings.
And it's constantly running on the device.
And that means that this device is
definitely successfully deployed.
Now, let's actually run a test.
Let's open up Safari.
And first of all,
I'm just going to make sure
that things are working as they should.
I'm just going to browse to jamf.com,
first of all just to make sure
that the internet's working.
That's all looking good.
Next up, let's try a different tab.
And let's try google.com.
And let's make sure that everything is
working there as well.
And now let's actually try and access one
of the sites that should be blocked now.
So let's go to gambling.com,
for example, which is a website that falls
under the gambling category
that we've blocked.
And you'll see this Site Blocked page
show up, notifying the user that this is
a website that they can't go to
on their corporate device.
Same thing, if I go to wikipedia.org,
the custom site that we also added
just as a test, so you'll see
that that is blocked as well.
Now, this technology doesn't
just work in Safari.
So I'm also just going to open up Firefox
and run the same test there
just to make sure everything works.
It works in all browsers
as well as other apps.
So it's really blocked
on the network level
and not on the app level,
providing good security across the board.
So here as well, if I go to google.com,
you'll see that page also loads
as it should.
And now, let's try and go
to gambling.com here.
And we'll see the site blocked page again,
indicating that traffic is
being blocked as part
of my content-filtering policy.
So at this point, let's switch back
to RADAR.
And let's have a look
at the actual reporting.
So this is where we can actually see
what's been going on.
And if I click on Reports, Internet,
and then Usage,
I'll be able to see my test device here.
And I can actually have a look at
all of the transactions
that have gone from this device
as well as filter by Blocked transactions
to see those sites that have been blocked
on this device.
So all of this happens in real time.
This is constantly updated.
And you'll also be able to export any
of this information for further analysis
should you wish to.
Next up, we can go to Sites and Apps
as well.
Similar story here.
Here, we can actually see all of those
specific sites and apps that have
been visited by my users–
in this case, just the test users.
And again, I can dig into that.
I can click on the Plus icon
to expand any of this
and see the sites that have been visited
by my users.
That's important to also note that we have
a number of privacy options available.
We are able to anonymize or pseudonymize
this information should you wish to.
More information on that
can be found in our Documentation Center.
Now, lastly, let's have a quick look
at the security reporting as well.
And so click on Security
and then Device View.
And here, you'll see my Mac.
And you'll see that it shows up
as completely secured.
Let's just click on the Desktop Dashboard
as well.
And here, you'll also see an overview
of everything that's going on
within my state and also an option
to go to the Documentation,
again, to find out more
about all of the advanced options
that we're not covering
in this interactive labs.
So that's it.
That was just a quick introduction
to help you get started
with this new functionality.
I hope that was useful.
There's a lot more to explore
and a lot more information and collateral
that you can review yourself.
Or you can get in touch with any of us
in case you need any help.
Our Customer Success team are there
to help you with any questions
and with deployment
should you need any help.
So thanks very much for going
through this interactive lab session
with me.
I hope you enjoyed it.
And I look forward to answering
any of your questions.
And thanks, again, and enjoy
the rest of your JNUC.