- Welcome to remediating security events
with Jamf Pro, Connect, and Protect.
I’m Catey McKay, Consulting Engineer
for security here at Jamf.
- And I’m Sean Rabbitt,
Consulting Engineer for Identity
and Access Management.
Since this session is being recorded and
will be available after JNUC, we’ll have
the handouts, including scripts and
links to the tools we used available
on GitHub, as well as any changes or
a rattle found after this recording.
Remediating security events with Jamf Pro,
Jamf Connect, and Jamf Protect, or,
also known as, two people in front
of two curtains,
a big, long name for a session.
But, boy, howdy, have we got a lot to
get through in a short period of time.
So let’s actually start at the end.
Catey, would you like to walk us through
what the ultimate result will be?
- Absolutely, Sean.
So what we’re gonna show you here is a
computer enrolled in Jamf Pro
with Jamf Connect installed and
handling the logins on a machine
and monitored with Jamf Protect.
This will be the end results of what
you can do with the tools combined.
First, Dwight starts his day
the way he usually does,
logging in into his Mac,
as you can see here with the
logo of his org and a customized
background image, very pretty.
And now in a twist of events, he’s going
to install a bitcoin wallet and trading
program that he found on a thumb drive
out on the parking lot, silly Dwight.
Ignoring all the warnings that macOS
is throwing at him that this a bad app
and will damage his computer,
Jamf Protect halts the process
and isolates the crash-reported malware.
Our IT team has had to deal with
Dwight, in the past of course.
So having detected that there is yet
another new malware installed on this
machine, we’re gonna lock Dwight out of
his computer until someone on the IT team
can figure out if this was a blocked
threat to other devices on our network.
Jamf Protect tells Jamf Pro to drop
this device into a special smart
computer group of pawn machines.
Jamf Pro then updates the config
profile for Jamf Connect almost
instantly, locking Dwight out of the
machine and rebooting the computer.
Now presented with a brand-new warning
lock screen to easily identify the
computer as possibly compromised, Dwight
desperately tries logging in, thinking
he could somehow still cover his tracks.
He is, of course, denied.
Dejectedly, he calls Kelli and since
she’s a member of the IT team
access group, she’s able to have an
admin account created on the machine
just in time with Jamf Connect.
The security team can now perform a
forensic analysis of the machine
to make sure that nothing bad
can affect the rest of the org.
Lastly, Kelly opens the self-service
for Jamf Pro to run a script to
clear the Jamf Protect blocks.
Jamf Pro then nearly instantly sends the
original config back down to the
machine to let Dwight stumble
forth in his day, pretending to work.
- These are all automatic Jamf
Connect settings.
And hey, we’re back to normal.
Life is good.
Go forth and work, Dwight.
Life is good.
Now Jamf is the only enterprise
management solution.
It’s the entire life cycle of Apple in the
enterprise, including device deployment,
management security, without negatively
impacting the end-user experience or
requiring IT to even touch the device.
Also known as blah, blah sales pitch,
why you’re not here.
So let’s dig into what we
actually used to get this done.
This solution uses three specific products
of the Jamf Product Portfolio.
And if you’ve been paying attention so
far, they are Jamf Pro, used to manage
a computer and make it do pretty much
anything up to and including telling it to
sing happy birthday on a Tuesday
afternoon if it’s scheduled to rain.
Jamf Connect to gain access to
macOS client machines and create
new user accounts just in time.
And Jamf Protect, the purpose build Mac
endpoint protection software.
So let’s actually break down what we saw.
Catey, can you walk us through it?
- So when Dwight installed that malware on
the machine, a combination of the native
macOS, XProtect, and Jamf Protect
kicked into gear immediately
and blocked the malware from
being installed on the machine.
Because Jamf Protect can communicate with
the Jamf Pro binary on the client machine,
it triggered an inventory update
called Jamf Recon, which then went out
to the Jamf Pro server in the cloud.
The Jamf Pro server then saw the inventory
had updated and that Jamf Protect marked
the machine as being compromised
with an extension attribute
collected during the inventory.
This then told Jamf Pro to put the
device into a smart computer group.
And since this smart group can be used as
a target for things like policies or
config profiles, Jamf Pro sent
a command to the device to execute
a remediation script and
a config profile for Jamf Connect.
The script, in this case, ran a
message with Jamf Helper, a messaging
tool included with the Jamf Pro binary
when a device enrolls in management.
Another great tool you can use
to really block anything on the
device is the open-source tool
from Jamf called DEPNotify.
Joel Rennich’s great program can
put a customized message up on
the screen in full-screen mode,
completely blocking a user from doing
really any other interaction and
forcing a computer to reboot after
a user has read the message.
It should also be noted that these
messages are completely customizable.
The config profile sent down was
an updated set of instructions
for the Jamf Connect software.
Sean, wanna walk us through that?
- Absolutely, Jamf Connect uses
an application, defined in the
cloud identity provider to determine who
gets access to a client macOS device.
Now, normally, you’d have that
application set up to let everyone in
the organization log into a computer.
But there’s absolutely nothing
stopping you from setting up multiple
applications in your identity provider.
Think of that as having a special
access control list
for security staff only.
So when Jamf Connect goes out to
the IDP to say,
"Hey, can this dude log in?"
The identity provider
responds, "None shall pass."
- Now, while all of that was happening,
Jamf Protect was also busy sending the
full details of the security
incident to the Jamf Protect cloud
incidence and optional to some
of the organization’s choice.
Now, when Kelly goes to investigate
Dwight’s computer, she’s got details
about the detection type, where the file
originated from, who executed the command,
and if we detected a unique targeted
piece of malware, a signature
that can be blocked from any
other devices in our orgs fleet.
- With an automated policy, Kelly then
told the computer to run a script to
clear the extension attribute and
update the inventory in Jamf Pro
after she investigated the machine.
This then removed the computer
from a smart computer group
with restricted access.
The updated inventory then removes the
device from a smart computer group,
which tells the Jamf Pro server to send an
Apple Push Notification Service or (APNs)
command to remove the config profile
for restricting access and add
the config profile to return
the normal access to the computer.
- Now, let’s get into the nuts and
bolts of how this workflow is set up.
And in addition to this session,
you can read all about this process,
how to update analytics to include
Jamf Pro smart groups, and more at the
Jamf Protect documentation link above.
- Or below, depending on where
we’re at in this picture.
I have no idea anymore
It’s all good.
- So first, we need to set up
a communication path between
Jamf Protect and Jamf Pro.
So to do that, we’ll Jamf Protect
to add an extension attribute
to the device inventory record.
This attribute is set on
each analytic of interest.
In our examples, we used a concept
of high, medium, low,
and a special category of malware.
Why is that?
Well, analytic may be something
innocent a developer running a script
to do some automated action which
ask for input for a suited command.
Or it could be a non-malware signature
or behavior, and we may be a
target of a new script kitty
stealing our developer certificate
and targeting our organization.
Our IT security team can set priorities
based on what they think is the
risk factor in each analytic.
Next, we essentially tell Jamf Pro
to collect this information.
Built into Jamf Pro under extension
attributes is a template that collects
this information from Jamf Protect.
Now that analytic detection notices is
part of the device inventory record.
And lastly, to act on that analytic
automatically, we’ll create
a smart computer group.
Smart computer groups can be used
as the target for a policy or
a configuration profile to be applied
to a machine or a group of machines.
We’ll use some of more this later
when we make some config profiles
appear and disappear.
- Now the trick here is the computers may
not always be connected to the internet.
And they may not always be able to
receive commands from Jamf Pro.
To work around that, we’ll actually
tell our policies that they should be
able to run offline in Jamf Pro.
In the execution frequency in our policy,
we have a simple option,
"make available offline."
Just enable that option
on any policies that would be
triggered by the smart device group join.
- So now that we’ve got our event
detected, we’ll want to have
a policy run that actually does
something on the machine,
maybe a script to alert the user
that, "Hey, we’re not blaming you.
But something just happened
on the machine, and we’re shutting down
right now.
The policy can do literally
anything on the machine since it runs
as a superuser with admin rights.
Now, in this case, we’re just
running a quick script, and we’ll
get into that magic in a second.
But the real trick is how to
trigger the policy happening.
When the Jamf Protect agent finds
an analytic which will cause
an extension attribute to be created,
it also does the equivalent of
running the Jamf policy event command with
a custom trigger of "protect."
Custom events are amazingly
powerful tools, which can trigger
a cascading series of events
to happen within the Jamf Pro agent.
The last two pieces of the puzzle are
to set the execution frequency to ongoing,
as we never know if there’s going to be
a lightning strike twice
in the security space,
and to make sure the policy is
available to run offline if a computer has
become disconnected from the network.
And then, this particular action
is creating a little pop-up window
in the Jamf helper script.
We’ll put a link to this in the handouts.
But this script can be quickly modified
to suit your needs and could
even be pass fields with the script
parameters from Jamf Pro to Jamf Helper.
In this case, we’re setting the
default path to the Jamf Helper app,
which comes installed when the Jamf binary
is installed on an enrolled machine.
We’ll put some variables
to set text shown to the user.
And then when the user clicks
out of the message, we’ll run
a shutdown with a reboot command.
- Now that script looked very complicated,
but you can actually simplify a lot of it
by using the Jamf Help Constructor app.
And while we’re putting the message up
just as a box on the screen,
note that you can have
a whole bunch of different settings.
So we can also force it into a full-screen
application to prevent the user from
doing and switching to anything else.
And we don’t have to limit ourselves
to just Jamf Helper.
No, our script can get fancy, so fancy.
Our script could use other tools,
like Joel Rennich’s DEPNotify script
to give even more information
to the user of what’s going on.
It could run additional Jamf Pro
policies to delete potentially
dangerous files or quick processes,
reboot machines, and more.
What we’re showing you is just
the idea and the base level.
The limit is really only your imagination.
Now, the smart computer group is
doing more than just triggering the
policy for isolating the machine.
It’s also modifying the configuration
profiles issued to a machine.
Jamf Connect requires two things.
First, you need to have the
Jamf Connect program installed.
Second, you need a configuration
profile to tell Jamf Connect
where to authenticate the user.
Now, this can be used to our advantage.
First, Jamf Protect dropped the
dime on this computer.
And therefore fell
into a smart computer group.
Smart computer groups can also
be used as an exclusion group to
take a configuration off a machine.
So, in this case, we can use that group to
drop the standard Jamf Connect to let
everyone login off a computer.
Next, we can use that same group to scope
on additional settings for Jamf Connect.
So, in this case, we’ve added
a special subset of users
to our Okta tenant.
Made it so you absolutely
had to authenticate with the network,
change the background wallpaper of
the login screen to screaming red.
And you’re not limited to just
Okta in this case.
There’s really no limit to making
additional applicational registrations
in all of the identity providers.
In this case, we’ll only assign
members of the infosec team to
allow to use this application.
And this picture being shown right now
is an option in Microsoft Azure.
Then we’ll apply config just for the
infosec team, so they can access
Jamf Connect and log in to the mac.
- Now, after all the action has taken
place, you’re really gonna need
visibility into what actually happened.
In the Jamf Protect console post-incident,
you can see intricate details about the
processes that ran, where it came from,
its signing info, and much more.
- And now that we’ve got all the
information about the security incident.
Now, that we’ve limited the damage to
the rest of our fleet by restricting
Dwight's access to his own computer.
Or Dwight's access--who’s the
person in this again?
I can’t remember.
I need to rewatch "The Office."
Now that Kelli cleaned up the computer
and made sure there was no lasting damage,
let’s let him get back to work.
Jamf Pro self-service lets administrators
create policies that can do many things,
like install applications,
apply settings, and run scripts.
In this case, we’ve created
a self-service policy that’ll clear the
extension attribute information written by
Jamf Protect on the client machine.
The clearing script is possibly one of the
simplest policies you may ever write.
Simply run a Unix command to clear
the Jamf Protect smart groups
directory shown here.
And then tell the machine to
submit an inventory update.
This’ll clear the extension attribute,
clear the smart group, fix the
Jamf Connect login screen, and return
the computer to normal automatically.
It’s really that simple.
- Now what to do next.
So when you choose an analytic to apply
this workflow to, you’ll really
want to access the impact to your
organization if by chance that
targeted malware was ever successful.
Then you’ll want to decide
what to say to your end-users.
Do you want to give them
a lot of detail or a little?
Do you want your company logo on it,
just so you don’t scare them?
And speaking of scaring your end users,
you may wanna educate them on
what will happens if make an
oopsie and download malware.
You’ll want to make sure you successfully
implemented your workflow, but in a
harmless way by launching something like
an EICAR file and not actual malware.
- And remember...
- And again--
- The stuff that we’re gonna be showing--
Ooh, sorry.
The stuff that we’re linking in the GitHub
script here is really just the beginning.
We’ll give you some samples,
and then anything that you wanna do to
those scripts to modify them
is entirely up to you.
Sorry, back to you, Catey.
- And lastly, remember that Jamf support
is available for any of the individual
products we discussed here, but they’re
unable to help with custom scripting.
So if you need assistance with
configuring Jamf Pro, Jamf Connect,
or Jamf Protect, please reach out.
If you do need help with custom scripting,
however, Jamf has a professional
services team who can come in like the
pros from Dover and do this work for you.
Be sure to refer to this session to
discuss that you want--
was in the--to discuss that you want
what was in session done
in your environment. Sorry.
- It’s all good.
Just a complicated way of saying, "Hey,
I want that for me." It’s all good.
So we’ll be able to help out.
- Yes.
So a short session here, but you got the
idea that basically a combination
of Jamf Pro, managing Jamf Connect on
a client device, and then listening to
Jamf Protect on a client device will
be able to clean up the computers for
you automatically or at least
will help for being able to ensure
the rest of your entire fleet of machines.
For Catey McKay, I’m Sean Rabbitt.
- And for Sean Rabbitt, Catey McKay.
Thanks for watching,
and enjoy the rest of your JNUC 2021.