Welcome to this session on Harmony Mobile security policy configuration. By the end of this session, you'll be able to describe the composition of the Harmony Mobile security policy and you'll be able to perform necessary configuration steps that define the security policy as required. Up to this point, we've mostly discussed on boarding and deploying Harmony Mobile to devices by integrating with you EMs or by a manual process. Now, in order to take full advantage of Harmony Mobile's capabilities, you need to establish a well-defined security policy that fits your security and business needs. Let's drill down into the policy section and start exploring. By default, you'll have a global policy built into your Harmony Mobile. This policy is configured with checkpoints recommended best practices. Each device associated with the security group and a sink with the dashboard receives this policy by default. Unless otherwise configured, you can create your own custom policy with settings that are different than the global settings. Custom settings will override their corresponding settings in the global policy, but more on custom policies later on. As we can see, the security policy is comprised of the protection components we discussed in our introduction session. That is protection on a device level, application level, file level, and network level. Before we go over these categories, Let's look at the network protection setting, which is a global setting. When enabled, this setting, also known as on-device network protection or ONP in short, prevents access to malicious websites using any browsing app. This is done by blocking access to the site based on dynamic security intelligence provided by Threat Cloud. ONP network protection is enforced using the device VPN profile. Now that we've covered this general setting, let's drill down into the specific protection categories, starting with device. In this category, we define the conditions and risk level for general iOS and Android specific policies. As we can see, you can set a risk level to the device based on a security event. For instance, if the Harmony Mobile app that is installed is not compliant or if there is no lock screen set on the device, you can decide what severity level these events represent. If, for instance, the device has no lock screen set and you've defined a high risk level for that type of event, the dashboard will display this device as high risk for this behavior. The associated UEN may then act to block or perform any other action as such a case as predefined in the UEN itself. Further settings of choice include iOS related settings, Android related settings, etc. Moving on to the application category. In this category, we define the classifications and corresponding risk level for risky apps. Risky apps are not always a critical security threat, therefore might not always be a high risk to the organization. For instance, some organizations consider location tracking apps in as low risk, while others may consider such behavior as high risk. Beyond the specific types of risky behavior, you can also define the risk level of entire application categories. For instance, applications belonging to the category casino can be considered by an organization as high risk. You can also create exceptions to the rule by allowing the installation of apps based on their package name or developer certificate. In case an app would be blocked by any previous definition based on its associated risk. Defining it here as an exception will override the previous settings. Let's move on to the final category in which we define the conditions and risk level for files the user attempts to download to the device. In this section, we can determine the posture of application download. We can define a restrictive posture allowing the download of apps only from trusted domains. Moderate posture blocking the download of apps only from suspicious domains, and permissive posture allowing the download of all apps. As an admin, you can choose to have all the downloaded files scanned by checking this checkbox. The scan checks the file reputation against Threat Cloud before it is downloaded to the device. Additionally, you can define which network locations the device can or cannot access to download files or applications. You can add the blocked locations or domains in this section and the allowed locations or domains in this section. An interesting setting which is only relevant to Android devices is the Android storage scanning setting. If enabled, Harmony Mobile scans the device for any previously downloaded malicious files. Finally, you can add exceptions to the rule, allowing certain file types to be permitted on the device without triggering any risk-related security event. You can define this by either providing the file's hash or by uploading it. Let's move on to the final category of network. This category compliments the ONP setting we previously discussed. In this section, we can define the criteria for blocking connections to fishing and malicious sites. In this section, we can define which corporate IP addresses and or FQDN host names a user device at high risk cannot access. In these sections, we can define additional criteria according to which a device is either blocked or allowed to access a network resource, such as website categories and specific URLs. After defining these settings, you can also define protections for a device that is connected to a Wi-Fi network, as well as provide protected DNS to secured and unsecured DNS services over Harmony Mobile on device network protection. And that covers the basics of the global security policy. Note that throughout the configuration of the security policy, you'll see the number of changes you've performed. To commit your changes, click the "Save" button that will push the updated policy to the associated devices. Beyond the global policy profile, you can create your own custom policy profile and configure it based on your business and security needs. As you can see, it inherits its baseline from the Global Policy profile. A custom policy profile is especially useful when you need different policies for different groups of devices, for example, when you need to enable stricter security controls for your VIPs, etc. In the rule-based section, you can see all available security policies. The rules are processed in order from top to bottom, also known as first match. Once a match for the device is met, that policy is applied to the device. For example, if you create two policies and the device would match both policies, the topmost matched policy will be applied to this device and the rest of the rules will be ignored for this device. It is best practice to place the most specific policies higher in the list with the global policy being at the bottom of the list. You can also change the order of rules by dragging and dropping them. Once you've added a custom policy profile, you can go ahead and add a rule-based policy associated with the relevant security groups and attach it to the relevant custom policy profile and that about covers the security policy section of Harmony Mobile. For a full overview of all available security policy settings, please refer to the documentation. In our next session, we'll focus on Dashboard and forensic side of Harmony Mobile. See you in the next session.