This article discusses how to create Device Posture Profiles and Device Checks to make sure that only devices (for SDP users) that meet the security requirements are allowed to connect to the network.
Create Device Checks to define the minimum requirements that a device must meet. For example, the requirements for a specific Anti-Malware vendor and product with the minimum supported version. Then define Device Profiles (that can contain multiple checks), to specify which devices will be allowed to connect to the network.
You can use Device Profiles in the Client Connectivity Policy and in the Internet and WAN firewall.
Sometimes you need to accommodate Clients in your organization that currently don't support Device Posture, and allow these Clients the access the network. When you configure a Device Check, the Criteria section let's you choose the behavior for Clients that don't support Device Posture.
When an unsupported Client matches the settings for a rule except for the profile, these are the behavior options:
-
Skip the Device Check, and allow unsupported Clients to connect to the network
-
Block unsupported Clients because they can't meet the requirements of the Device Check
We recommend that you minimize the scope and impact of Device Checks that allow unsupported Clients in your organization. The fewer unsupported Clients that are allowed, the stronger the Client Connectivity Policy is.
Each Device Check can include these settings:
-
One Device Test Type (for example, one Anti-Malware or one endpoint Firewall vendor)
-
One product for that vendor
-
Versions for that product: Any version, specific version, or minimum version (greater than)
-
Option to skip the check for unsupported Client versions
-
For Disk Encryption - Define one or more drive paths that are encrypted (the entire root path is encrypted, for example C:\)
-
Only software-based encryption is supported (hardware-based encryption is not supported)
-
For devices with multiple partitions, you can specify which partition is encrypted
-
When you define multiple drive paths for a device, the check validates that all paths are encrypted
-
-
-
Device Certificate - see below
In the Criteria section, you can also choose to enable Real time protection, and a connected device is continuously verified that it matches the Device Check.
 |
Working with Device Certificate Checks
You can create Device Checks for certificates that are installed on the end-user device that are defined for your account. Use the Device Authentication screen (Access > Client Access > Device Authentication), to upload signing certificates for your account. The check validates that there is a certificate installed on the device that matches one of the signing certificates defined for your account.
Using Device Checks in WAN and Internet Firewalls
Device Checks can also be used in WAN and Internet firewall policies to create rules that include conditional access based on the actual device of the end-user. For more about using Device Checks in a firewall policy, see Adding Device Conditions to Firewall Rules.
Each Device Profile can include multiple checks using AND logic. This means that a user that matches the Device Profile must comply with all the specified Device Checks to be able to connect with the Client.
To configure a Device Profile:
-
From the navigation menu, select Access > Device Posture.
-
Click the Device Profiles tab.
-
Click New.
The New Device Profile panel opens.
-
Configure the settings for the Device Profile, and add the required Device Checks (that you created in the previous section).
-
Click Apply and then click Save.
When you create a Device Profile with multiple checks there is an AND relationship between them. This means that a device must meet the requirements of all the Device Checks to apply the rule action to the device.
The following example shows the Sample Device Profile which includes these checks:
Comments
2 comments
Updated to include support for endpoint Firewall Device Checks
Updated to include support for:
Please sign in to leave a comment.