Security recommendations for Mobile Device Manager Plus MSP

Mobile Device Manager Plus enables organizations to simplify the management of devices and enhance corporate data security. In order to ensure compliance and secure the corporate data accessible from the web console, Mobile Device Manager Plus provides the following security recommendations. Please note this is not an exhaustive list and IT admins can configure additional security settings as well.

Server settings

On-premise Mobile Device Manager Plus users can configure the following settings to secure the installed server:

• Update the server to the latest build for improved performance and security.
• Enable HTTPS login for secure access to the server and data.
• Disable default admin credentials by either creating a new administrator account and deleting the default admin credentials or modifying the username and password.
• Configure stringent password policies and enable two-factor authentication (2FA) for all admins and technicians accessing the web console.
• Associate appropriate roles to admins and technicians accessing the web console based on their designation and access levels.
• Periodically revisit the user administration page, and delete inactive user and admin accounts.
• Periodically revisit customer-specific user accounts to remove inactive entries.
• Monitor active sessions on the Mobile Device Manager Plus console and close stale sessions.
• Configure export settings based on your organization's compliance policies to prevent any exposure or extraction of sensitive data.
• Configure a Secure Gateway server to mitigate any direct attacks by preventing direct connection to the server from the internet.
• Configure third-party SSL certificates for authentication.
• Disable legacy versions of TLS that may be vulnerable and affect the security of data transfers.
• Periodically review the list of users who have access to the Mobile Device Manager Plus database.
• Enable password protection for scheduled database backup.

Mobile Device Manager Plus Cloud users can use Zoho Accounts to:

• Configure stringent password policies and enable 2FA for all admins and technicians accessing the web console.
• Associate appropriate roles to admins and technicians accessing the web console.
• Monitor active sessions on the Mobile Device Manager Plus console, and close stale sessions.
• Configure export settings based on your organization's compliance policies to prevent any exposure or extraction of sensitive data.

The following settings can be configured for both Mobile Device Manager Plus on-premises and cloud versions.

Enrollment settings

• Enroll corporate-owned devices using the following enrollment methods based on the supported platforms to ensure devices always remain under management even after being factory reset:
  • Apple Business Manager for iOS, macOS, and tvOS devices
  • Samsung Knox Mobile Enrollment for Samsung devices
  • Zero Touch Enrollment for non-Samsung devices
• Restrict the option to perform a factory reset and device wipe on corporate devices to prevent users from removing devices from management.
• Enable enterprise factory reset protection on Android devices to prevent unauthorized use of devices after factory reset.
• Restrict the option that allows user to remove the ME MDM app on corporate devices that have not been enrolled using the above mentioned enrollment methods to prevent them from being removed from management.
• Enable the option to detect and remove jailbroken and rooted devices to ensure only compliant devices access corporate data.

Inventory settings

• Schedule regular device scans to ensure the device details remain up to date.

Device settings

• Configure Device Privacy Settings to ensure only the details required by Mobile Device Manager Plus for management and data permitted by the local and global compliance laws are stored on the server.
• Configure the Terms of Use policies to be displayed to the device users and obtain their consent before collecting and storing device information on Mobile Device Manager Plus' server to ensure user privacy.