Posts Tagged


Windows 10 version 2004: Key enterprise features

Microsoft’s next Windows 10 feature update, code-named 20H1, is coming very soon. We don’t know exactly when it will be released or what its official name will be, but its version number will be 2004.

Unlike some previous Windows 10 feature updates, version 2004 doesn’t introduce a bunch of major new features. But it does include several useful tweaks to the ways business users and admins interact with the OS, such as the option of signing in without a password, an improved interface for 2-in-1 PCs, and a Cortana reboot that puts productivity first.

Read on for the ways that version 2004 helps make daily work in Windows 10 better.

Cortana means business

Cortana has undergone a soft reboot in version 2004. Microsoft has shifted the focus of its digital assistant away from home users to office workers. In fact, Microsoft has killed many of Cortana’s features and functions that were meant for the home user, such as the ability to control music apps and home tech devices.

Now the emphasis is on using Cortana to assist you for work, mostly with Office 365. You can speak to Cortana or type into its query box for personal productivity tasks such as finding a document, sending an email, or scheduling a meeting. You can also request that it add an item to a to-do list, set a reminder, or update you on your schedule.

Source link

Apple in the enterprise: What is Shared iPad for Business?

With a recent software update, Apple’s iPad OS gets support for an excellent feature borrowed from Apple School Manager called Shared iPad for Business. This lets enterprises share iPads between employees much more effectively.

What is Shared iPad for Business?

Apple first introduced the capacity to share iPads within Apple School Manager. The idea behind this option is that by combining Managed Apple IDs and the cloud it became possible to share fleets of iPads among multiple students.

A student would use their Managed Apple ID to sign-in to the machines, which would then be populated by all that student’s relevant data, apps and resources, including their own personal Mail account, app data, iCloud Photo Library and more. Data is all stored in iCloud and downloaded when required.

Apple’s decision to extend this support into enterprise deployments with Shared iPad for Business makes it possible to find new ways to use Apple’s tablets across industries, and provides a personalized experience for multiple end users.

It should be of particular use in retail, distribution and logistics, where employees frequently make use of mobile devices – which can now more easily be shared across teams. It also makes it easier to deploy apps across teams.

How does Shared iPad for Business work?

Employees simply sign in with a company-provided Managed Apple ID and password. The iPad then becomes their own while they are using it.

The employee has their own Mail accounts, their own files, photos, and app data. Since the data is stored in iCloud, employees can sign-in to any Shared iPad that belongs to your organization.

Data is cached on the device so employees can choose from a list of recent users to quickly get back to their documents, apps, and content exactly as they left them.

In schools, Apple makes it possible to login to the Managed Apple ID using a four-digit code. You’ll find in-depth setup and deployment information here.

What is a Managed Apple ID?

A Managed Apple ID is different from a user’s unique Apple ID. This protects individual user data and puts the company in control of that account and the data inside it.

You use Managed Apple IDs to access Apple services, including iCloud, Notes, iWork, and so on. They are managed and owned by the enterprise, which means the organization has control, which can be particularly useful when dealing with employee churn. There’s an Apple support document that provides details.

What about access to apps?

Keychain support is part of the system. What this means is that passwords for enterprise-approved apps and online services that you may use are linked to the Keychain that is itself linked to your account.

As a result, you’ll be able to use Apple’s own password management system to access those apps and services across the devices you share using that Apple ID. It also means other people won’t be able to access them using your Keychain, unless they have access to that ID.

How does this integrate with my MDM?

Jamf has already announced zero-day support for iOS 13.4, including for Shared iPad for Business. If you use other third-party mobile device management systems, then you should check with the vendor, as it is likely these are being or will soon be updated to support the feature.

Do you have to download the data each time?

When you use a Shared iPad for Business system, you’ll be presented with a list of recent users whose data may be cached locally on the device. In order to access that information, you will need to enter the credentials for your Managed ID.

What about temporary use?

The system supports temporary sessions. These allow users to sign-in without an account to use the device, and any data they leave on the device is erased when they sign-out.

What other enterprise features are in iOS 13.4?

There are some additional enhancements inside the new OS. They include iCloud Drive Folder Sharing, which also works with Managed Apple IDs and new collaboration tools introduced in Pages and Keynote, and enhanced pointer support in iPads. The latter does so much to boost their enterprise usage case.

The release also introduces proxy support for Push notifications, which means you can send communications across your device fleet using your MDM system. This will be of particular use within tightly regulated industries that use default-deny network access protections.

More info for remote workers

Feel free to explore my extensive selection of guides that should help the many Apple-using remote workers and enterprises that employ them:

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Copyright © 2020 IDG Communications, Inc.

Source link

12 security tips for the ‘work from home’ enterprise

If you or your employees are working from home while our governments lurch awkwardly through the current crisis, then there are several security considerations that must be explored.

Your enterprise outside the wall

Enterprises must consider the consequences of working from home in terms of systems access, access to internal IT infrastructure, bandwidth costs and data repatriation.

What this means, basically, is that when your worker accesses your data and/or databases remotely, then the risk to that data grows.

While at normal times the risk is only between the server, internal network and end user machine, external working adds public internet, local networks and consumer grade security systems to the mix of risk.

Here are some of the approaches to take to minimize this risk.

1. Provide employees with basic security knowledge

People working from home must be provided with basic security advice: to beware of phishing emails, to avoid use of public Wi-Fi, to ensure home Wi-Fi routers are sufficiently secured and to verify the security of the devices that they use to get work done.

It is likely that attempts to subvert security using phishing attacks will increase at this time.

Employees should be particularly reminded to avoid clicking links in emails from people they do not know, and installation of third-party apps should be confined to bona fide stores, even on personal devices.

Your people need to be in possession of basic security advice, and it is also important that your company has an emergency response team in place. People need to know who to contact in the event they detect a security anomaly.

2. Provide your people with access to VPN

One way to secure data as it moves between your core systems and externally based employees is to deploy a VPN. These provide an additional layer of security, which (in simple terms) provides the following:

  • Hide your IP address.
  • Encrypt data transfers in transit.
  • Mask your location.

Most larger organizations will already have a VPN service in place, and should check they have sufficient seats to provide this protection across their employee base. Smaller enterprises may need to appoint a VPN provider.

There are lots of VPN service providers, but not all of them can be trusted. ExpressVPN or NordVPN appear to be good choices, but it is in your own interest that you do your own due diligence before selecting a provider for your company.

[Also read: How to stay as private as possible on Apple’s iPad and iPhone.]

Once chosen, you should ensure that all remote employees are provided with access to the service, and that they use them for all business-related activity.

3. Provision security protection

Make sure up-to-date security protection is installed and active on any devices that will be used for work. That means virus checkers, firewalls, device encryption should all be in palace. I have two articles which should help with some of this:

4. Run a password audit

Your company needs to audit employee passcodes.

That doesn’t mean requesting people’s personal details, but does mean passcodes used to access any enterprise services are reset and redefined in line with stringent security policy.

Alphanumeric codes, use of two-factor authentication should become mandatory, and you should ask your people to apply the toughest possible protection across all their devices. You should also ensure all your business-critical passwords are securely stored in the event anything happens to key personnel. Enterprise-focused password manager, LastPass may help here.

5. Ensure software is updated

Encourage your teams to upgrade their software to the latest version supported under company security policy. (Some enterprises lag the release schedule for Apple software, though most don’t). Activate automatic updating on all your devices.

6. Encourage use of (secure, approved) cloud services

One way to protect your employee end points is to ensure your confidential information is not stored locally.

Content storage should be cloud-based where possible, and employees should be encouraged to use cloud-based apps (such as Office 365). It’s also important that any third-party cloud storage services used are verified for use by your security teams.

NB: This is particularly important if your business requires use of critical personal data.

7. Reset Wi-Fi routers

Not every employee will have reset the password for their Wi-Fi router.

If you have an IT support team then providing telephone guidance to secure home routers should become a priority. You do not want your information being subjected to man in the middle, data sniffing or any other form of attack.

You may also need to make arrangements to pay for any excess bandwidth used, as not every broadband connection is equal. Some providers (most recently, AT&T) are making positive sounds around extending available data packages in the current crisis. Employees should be told to avoid public Wi-Fi, though doing so is made a little more secure if used with a VPN.

8. Mandatory backups

It will be useful to ensure online backup services are used, if available.

Otherwise, employees should be encouraged to use external drives to back computers up too, or iCloud. If you use an MDM service then it is possible you’ll be able to initiate automated backups via your system’s management console.

(NB: I’m a little concerned about backup to local storage in employee homes as this simply becomes another potential security problem).

9. Avoid use of USB sticks

Don’t use USB sticks at all if you can avoid it. There have been too many examples of such devices being infested with malware. The Department of Homeland Security has a page about this.

10. Use an MDM solution

It may make sense to deploy an MDM system at this time.

This will make it much easier to provision and manage your fleet of devices while also separating corporate from personal data. It also ensures device and Mac security can be better controlled.

This is a topic in itself, but the experts at company’s such as Jamf, Addigy or even your Apple business advisor should be able to provide useful advice.

11. Develop contingency now

Triage your teams. Ensure that management responsibilities are siloed between teams and ensure you put contingency plans in place now in the event key personnel get sick. Tech support, password and security management, essential codes and fail-safe roles should all be assigned and duplicated.

12. Care and community

The reason many people are working from home is because there is a health pandemic. The grim truth is that your employees may get sick, or worse, during this crisis.

With this in mind, community chat, including group video chat using tools such as FaceTime or Zoom will become increasingly important to preserving mental health, particularly for anyone enduring quarantine.

Encourage your people to talk with each other, run group competitions to nurture online interaction, and identify local mental health and grief counsellors who may help if the crisis becomes more extreme.

I have heard of one group of people working remotely that are using a home exercise app and Group FaceTime to exercise together during the day, which they think helps boost team feeling even while working remotely.

The bottom line is that your people are likely to be under a great deal of personal stress, so it makes sense to raise each other up through this journey.

Also read:

Good luck everyone.

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.


Copyright © 2020 IDG Communications, Inc.

Source link

Enterprise resilience: Backup and management tips for iOS, Mac

Apple’s solutions are seeing increasing use across the enterprise, but do you have a business resilience strategy in place in case things go wrong?

If you’re one of the estimated 73% of SMBs that have not yet made such preparation, now might be a good time to start.

Your data is your business

It’s challenging enough when a consumer user suffers data loss as precious memories and valuable information go up in the digital smoke.

Natural disaster, technology and infrastructure problems or human-made problems such as burglary, cyberattacks or civil unrest can all impact the sanctity of your systems, whatever platform you use. It matters because in today’s connected world, your data is your business.

One way to approach business resilience improvement is to adopt a mind-set in which you think about what happens if every piece of hardware your business uses fails at once.

While this may seem extreme, fire, flood or successful cyberattacks all threaten damage to your systems, and while the iPhones in your fleet may be left untouched, your internally hosted servers and on-site Macs and other equipment could suffer.

How do you protect yourself?

One part of the response is to put together and follow a data backup policy, but even if you do so (and many do not), how robust is your protection? Do you have first line, second line, online and offline backups? Do you have a remote backup system in place? Do you use a password management system and if you do are all the relevant master passwords held securely off-site?

[Also read: Enterprise resilience: iOS, Mac tools for remote collaboration]

It’s also important to develop a backup and recovery policy both you and your employees can easily maintain, including use of cloud-based services.

It’s imperative that data stored in the normal course of business by your company be cohesively stored as you do not want to have to explore every employees private Dropbox, Box, OneDrive or iCloud Drive account as you attempt to forensically pull all your information back together after a disaster strikes.

It is also quite important to think about how your data flows.

While less of an inherent problem for Apple systems, what happens if malware gets into your deployment? To what extent are your primary data backups sequestered from your day-to-day business, and what security verification policy do you have in place in order to ensure the integrity of the information you store in your primary backups?

The reason this matters so is that in the event malware gets into your backup systems (perhaps hidden in something as seemingly innocuous as a PDF document) then once you put all your enterprise kit back together the problem could reoccur.

The three-part approach

Reading around this topic and in previous discussions with people in this field, I’ve learned that those businesses that do put good systems in place generally adopt a three-part strategy:

  • Local backups: To shared local servers or locally attached hard drives.
  • Online backups (offsite): For the very smallest SMEs, iCloud may be fine, but larger concerns will need shared online services, such as those from iDrive, Egnyte or BackBlaze.)
  • Redundant backups: If local backups fail or online systems become compromised, a redundant backup system will have all assets regularly stored to a system held securely offsite. A consumer user may store their information on a drive at a trusted friend’s house, perhaps using two drives and swapping them out every few weeks. An enterprise may use the same rotating dual backup strategy to keep offsite backups regularly updated in a safe place. If you are based in an earthquake zone you might even choose to keep these in a completely different state.

It is important to note that whatever backup system is used is robustly protected with highly secure password systems.

It is also important to ensure clear role responsibilities such that someone is responsible for ensuring backups are successful. 

The hierarchy of needs

While full backups are essential, in truth not every piece of data is as valuable as everything else. This is why organizations should prioritize their data in terms of its importance. Typically, the order goes:

  • Databases
  • Accounts/Finances
  • Business operations/HR.
  • CRM information.
  • Documents and email.
  • Everything else.

In most cases it makes sense to run daily backups of the most important information. Automated systems (and it’s best to automate the process as much as possible) can be set to run these.

The role of MDM

If you use a Mobile Device Management system to handle your fleet, you should find it a little easier to deploy and equip replacement systems in the event of disaster, so long as you maintain backups offsite for access by your device management provision system.

Combined with regular backup policy, such as arranging weekly or monthly device backups from iOS devices locally to Macs using the Finder, and subsequent Mac backups using Apple’s Time Machine system, it’s possible to ensure that data integrity is near complete.

(Independently stored information should be thoroughly security vetted before being introduced to core backup systems to avoid malware infection).

A good MDM system equipped with robust security and management tools should help with the process.

Prevention is the core defense

The first line defense is prevention and while you can’t prevent every imaginable crisis you can prevent some.

That means preemptive risk management and fostering situational and security awareness across your teams.  Your employees may be the first to notice any anomalies that may signal threat, and you need to work with them to provide a supportive culture in which they feel empowered to come forward with any concerns.

This is also why it’s important to develop a friction-free approach to your backup resilience strategy, ensuring whatever protections you do put in place are actually used. Consumer level backup services may form part of your preparedness strategy, but only if this is strategically managed, through enterprise storage systems or emerging solutions that can work with consumer options, such as Challo.

Finally, it is extremely important to put together a plan for how to reconstruct your systems after a crisis. In an ideal world, if crisis strikes your organization then your people should already know their roles and be aware of what steps they should immediately take as you prepare to rebuild your organization.

Even the most die-hard Mac user knows that putting things together after data loss can be a lengthy and frustrating task if you are unprepared. (Though iCloud Drive helps a great deal with this).

Please follow me on Twitter, or join me in the AppleHolic’s bar & grill and Apple Discussions groups on MeWe.

Copyright © 2020 IDG Communications, Inc.

Source link

Microsoft launches enterprise preview of all-cloud printing service

Microsoft this week opened a private preview of its all-cloud Universal Print service to customers running Windows 10 Enterprise or Windows 10 Education.

Those customers also require an available Azure Active Directory (AAD) tenant, to which the personal computers accessing the cloud printing preview must be joined.

Elsewhere, Microsoft described Universal Print as “a Microsoft 365 subscription-based service;” it was unclear whether that meant only customers licensing Microsoft 365 – the subscription bundling Windows 10, Office 365 and a host of management and security tools – would be eligible for the preview, the final when it debuts or both.

From other support documents, Microsoft implied that Universal Print will require a license, which hint that it will be an add-on expense.

“Universal Print moves key Windows Server print functionality to the Microsoft 365 cloud, so organizations no longer need on-premises print servers and do not need to install printer drivers on devices,” Kristin Carr, group program manager, print and networking services, wrote in a March 2 post to a company blog.

Like other vendors’ cloud print services, Universal Print allows printing without direct device-to-printer links – thus enabling printing from mobile devices such as smartphones and tablets – without printer servers to manage printer access and handle department billing, and centralizes printing so that swaths of users can share more sophisticated printers.

Ironically, Microsoft has kicked off its cloud printing service just as Google is winding down its several-year-old effort. Google’s “Cloud Print,” which debuted in 2010 and never left beta status, will cease operation at the end of this year.

“Beginning January 1, 2021, devices across all operating systems will not be able to print using Cloud Print,” Google said in an enterprise support document.

One of the barriers to cloud-based printing is that printer makers must support the functionality of each variation. That typically has meant a lag between the introduction of, say, Google’s Cloud Print and Apple’s AirPrint, and the appearance of supportive hardware. Microsoft’s Universal Print will fight the same headwind.

“You will get the best cloud experience with printers that natively support Universal Print,” said Carr. “We are working with our partner ecosystem to bring you the latest printers with native support.” She mentioned Canon as one such partner.

In lieu of native support, administrators must install a proxy, dubbed Universal Print connector. The connector install can be downloaded from the link on this support page.

To register for the Universal Print preview, company IT administrators should complete and submit this form.

universal print preview Microsoft

After registering printers in Azure Active Directory (AAD), company employees will be able to access the remote printers from Windows 10 devices. Until printer manufacturers provide native support for Microsoft’s Universal Print – or update existing models’ firmware – most printers will have to be registered using the Universal Print connector proxy app.

Copyright © 2020 IDG Communications, Inc.

Source link