Clevertouch | MDM | Security & Architecture Overview

This document describes the security aspects of Viso MDM system and reflects the different architecture, security and connectivity aspects.

Architecture Overview The Viso MDM System includes the following server software components:

A Linux (Ubuntu Server) Operating system 16.04 Long Term Support MongoDB database Tomcat7 Java Servlet Container RabbitMQ Message Broker Nginx reverse proxy Ubuntu server has a Certification as a guest on AWS, Microsoft Azure, IBM and HP Cloud, automatic security updates are provided by Canonical Software.

The installation and maintenance of the software components is done using ubuntu package management system, software security updates for the OS including the software components listed above is provided by Canonical Software and applied automatically.

In an on-premise configuration, the communication between MongoDB RabbitMQ Tomcat and NGINX is done internally inside the machine.

Each software component is running in a separate OS level user, with its own filesystem permissions.

Mobile devices connectivity The Mobile device MDM agent is communicating with the following components:

Server over HTTPS/ Websocket +SSL RabbitMQ over TCP/SSL (optional) Google GMS/GCM (TCP+SSL/HTTPS) on Android platforms. Apple APNS on iOS platforms

Web browser connectivity Viso MDM is using both HTTP and WebSocket Web protocols for communicating with the server, The web architecture is based on REST API’s and browser rendering, no UI rendering is done in the backend. The web server is placed behind Nginx Reverse proxy, SSL encryption is done by Nginx.

Attack Surface Analysis The Web application architecture is based on a MVC software infrastructure provided by Spring, a VMware company. Spring MVC provides methods for securing, user interface (UI) forms and fields in the backend, a single configuration setting of HTTP headers and cookies.

And a fine grained security Role based access control for the exposed WEB API’s and REST endpoints, an attacker targeting those API will have to overcome Nginx HTTP validation, Spring Security HTTP authorization, and Viso RBAC implementation.

Users and login Viso MDM User management include a user management implementation,

The users are forced to choose a password according to a configurable password strength policy, MFA methods are optional. A grace period of failed login attempts is possible.

Database and file storage Viso MDM uses mongoDB document oriented database to save information about devices, users and configuration. In an On-Premise configuration the database is only accessible for application running on the same machine with the database.

Software installation is using file storage on the server.

By default, the storage is not accessible externally and files can only be downloaded from the web API. An

Push notifications, Email or other kinds of messages The Viso MDM can use different types of push notification solutions. By default it will try to use the platform native push notification solution (GCM/FCM / APNS for Android/iOS)

The push notification is used as a method of alerting the device and no sensitive data is transferred on it by default. Those system are using HTTP or TCP+SSL for communication, and a 256bit user identifier.

Streaming and remote display The Remote Resktop feature uses WebRTC implementation, The underlying transport protocols is SecureRTP and DTLS , The implementation are built into modern web browsers and encrypt data using SSL over UDP.

The streaming servers may use additional software components in case of special network conditions