The rapid development of portable electronics, particularly smartphones and tablets, has created numerous new challenges for corporate information security. Indeed, while cybersecurity used to focus on creating a protected perimeter and maintaining its security, it has become very difficult to control the security perimeter now that nearly every employee uses their own mobile devices for work tasks. This is especially relevant for large enterprises where each employee has login credentials for email and other corporate resources. Often, when acquiring a new smartphone or tablet, an employee enters their credentials on it, frequently forgetting to log out of the old device. Even if such irresponsible employees make up only 5% of the workforce, without proper oversight from the administrator, the situation concerning access to email by mobile devices server quickly turns into complete chaos.
Moreover, mobile devices are often lost or stolen, and subsequently used to seek compromising information or access corporate resources and data that constitute trade secrets. Typically, the greatest harm to corporate cybersecurity arises when criminals gain access to an employee's email. This allows them to access the global address book and contacts, the calendar of meetings the unfortunate employee was supposed to attend, as well as their correspondence. Furthermore, individuals who gain access to corporate email can send phishing or malware-infected emails from a trusted email address. All of this together provides cybercriminals with virtually unlimited opportunities to carry out cyberattacks, as well as to exploit social engineering to achieve their goals.
To monitor mobile devices within the security perimeter, there is the ABQ technology, or Allow/Block/Quarantine. It allows the administrator to control the list of mobile devices permitted to synchronize data with the mail server, and when necessary, block compromised devices and quarantine suspicious mobile devices.
However, as any administrator of the free version of Zimbra Collaboration Suite Open-Source Edition knows, its interaction capabilities with mobile devices are quite limited. Strictly speaking, users of the free version of Zimbra can only send and receive emails via the POP3 or IMAP protocol, without having the built-in ability to synchronize calendar data, address books, and notes with the server. The ABQ technology is also not implemented in the free version of Zimbra Collaboration Suite, which effectively eliminates all attempts to create a closed information perimeter within the enterprise. In conditions where the administrator does not know what devices are connecting to their server, information leaks can occur, and the likelihood of cyberattacks based on the previously described scenario sharply increases.
To address this issue in Zimbra Collaboration Suite Open-Source Edition, the modular extension Zextras Mobile will help. This extension allows for the addition of full ActiveSync protocol support to the free version of Zimbra, thereby opening up numerous opportunities for interaction between mobile devices and your mail server. In addition to various other features, Zextras Mobile fully supports ABQ.
Let us warn you right away that since incorrectly configured ABQ can result in some users being unable to synchronize data on their mobile devices with the server, one must approach the question of its configuration with utmost care and caution. The ABQ configuration is performed from the Zextras command line. It is in the command line that the operation mode of ABQ in Zimbra is configured, as well as the management of device lists.
It is implemented as follows: After a user logs into corporate email on a mobile device, they send authorization data and identification data of their device to the server, which encounters an ABQ barrier that reviews the identification data and compares it to those in the lists of allowed, quarantined, and blocked devices. If the device is not on any of the lists, ABQ processes it according to the mode it is operating in.
ABQ in Zimbra provides three operational modes:
Permissive: In this operational mode, after user authentication, synchronization occurs automatically upon the first request from the mobile device. In this mode, it is possible to block individual devices, but all others can freely synchronize data with the server.
Interactive: In this operational mode, immediately after user authentication, the security system requests the device's identification data and matches it against the list of allowed devices. If the device is on the allowed list, synchronization continues automatically. If the device is not in the 'white list', it will be automatically quarantined so that the administrator can later decide whether to allow synchronization with the server or block it. The user will receive a corresponding notification. The administrator is informed regularly, once during a customizable period. Each new notification will only contain new devices that have entered quarantine.
Strict: In this operational mode, after user authentication, a check for the device's identification data in the allowed list is immediately conducted. If it is there, synchronization continues automatically. If the device is not in the allowed list, it is immediately placed in the blocked list, and the user receives a corresponding notification by email.
Additionally, the Zimbra administrator can completely disable ABQ on their mail server if desired. server.
The ABQ mode configuration is done using the following commands:
zxsuite config global set attribute abqMode value Permissive
zxsuite config global set attribute abqMode value Interactive
zxsuite config global set attribute abqMode value Strict
zxsuite config global set attribute abqMode value Disabled
You can find out the current ABQ mode using the command zxsuite config global get attribute abqMode.
In case you are using Interactive or Strict ABQ modes, you will often need to work with lists of allowed and blocked devices, as well as quarantined devices. Let's assume that two devices have connected to our server: one iPhone and one Android with their corresponding credentials. Later, it will turn out that the iPhone was recently purchased by the company's CEO, who decided to work with mail on it, while the Android belongs to an ordinary manager who is not allowed to use corporate email on their smartphone for security reasons.
In the case of the Interactive mode, both devices will end up in quarantine, from where the administrator will need to move the iPhone to the list of allowed devices and the Android to the blocked list. To do this, they will use the commands zxsuite mobile abq allow iPhone and zxsuite mobile abq block Android. After that, the CEO will be able to fully work with email from their devices, while the manager will still have to access it exclusively from their work laptop.
It is worth noting that when using the Interactive mode, even if the manager correctly enters their login and password on their Android device, they will still not gain access to their account, and will enter a virtual mailbox that will inform them that their device has been quarantined and they cannot use email from it.
In the case of the Strict mode, all new devices will be blocked, and once it is determined to whom they belong, the administrator will only need to add the CEO's iPhone to the list of allowed devices using the command zxsuite mobile ABQ set iPhone Allowed, while leaving the manager's phone in the blocked list.
The permissive mode of operation is poorly compatible with any security policies within the organization; however, if there is a need to block any of the permitted mobile devices, for example, if a manager suddenly leaves in a scandal, this can be done using the command zxsuite mobile ABQ set Android Blocked.
If employees are provided with corporate devices for email use, when the ownership of the device changes, it can be completely removed from the ABQ lists in order to later make a decision on whether to allow it to synchronize with the server or not. This is done using the command zxsuite mobile ABQ delete Android.
As you can see, with the Zextras Mobile extension in Zimbra, a very flexible control system for mobile devices can be implemented, suitable for organizations with a fairly strict policy regarding the use of corporate resources outside the office, as well as for those companies that are quite liberal in this regard.
Source: habr.com
