2

My company makes devices that run Windows CE and must connect to our website through a customer's internet connection. We sell these devices to all sorts of customers with a multitude of network configurations and security needs.

These devices worry the IT departments of the companies we sell them to, and rightfully so. They worry about administering proxy settings on hundreds of devices, about the possibility of them downloading viruses or other security risks into their network, that it runs Windows, about the devices downloading software updates, and so on....

The best analogy I can think of is a business that had a bunch of Tivos connected to the internet. There is a business need for the devices but IT doesn't really want them on the network.

What can we do to alleviate the IT departments' concerns and make configuration a minimal effort. If we could funnel them through something like a VPN to a single server that connects to the company's proxy server, would that do it?

I only know a little bit about networking, but it's still my job to solve this, so any help is deeply appreciated.

9 Answers 9

2
+75

If I was the admin in charge of the networks running those devices, I'd be pleased if you provided a separate "update" service I could run that was the sole host that got to talk to your website (making it far easier to control and maintain) - and the devices would then be (preferably remotely by dhcp options) configured to talk to this update service host I have control over.

If the devices download software in any meaningful amounts, it would be neat as well if this update service would then cache this so any other device requesting the same download would just fetch it from the update service. Just like any locally installed anti-virus mirror works, or windows update services (WUS).

2

Microsft System Management Server 2003 has a Device Feature Pack add-on that provides Windows CE device management features to the platform.

http://technet.microsoft.com/en-us/sms/bb676769.aspx

The Device Management Feature Pack provides the following capabilities:

  • Hardware inventory
  • Software inventory
  • File collection
  • Software distribution
  • Settings management
  • Password policy management

Deploying this or the equivalent product for the latest version of SMS should provide you all the management capabilities you need for Windows CE devices.

2

As an admin, I'd be happiest if you could:

  • Lock the device down to the absolute bare minimum it needs to do its job (OS, hardware, ports, services)
  • Provide me a list of exactly what ports it uses to communicate
  • Research enterprise tools (WSUS, AV) and make sure I know that I can integrate your device with my overall strategy
  • Lock the user out of changing settings (or installing software) as much as possible (if it's a single-purpose device)

Without more detail about what the device needs to do, it's hard to say, past that. Just think about attack surface and the stupidest possible things users may do to violate my network. E.g. do the CE devices have ports (USB, firewire) - do they NEED them? - can you lock them down if not?

1

I would segment the network so as to afford the wireless devices access to the internet (which is what most people are looking for), and deny any access to the internal network.

Sometimes it is okay to say no.

1

First I'd say that if the company you are selling to is somehow complaining that windows in the problem, you're never going to win. These are the folks that honestly think the kid next door knows more about security than the billion dollar software company. As far as the administration worries go, you'll have to explain concepts like group policy and WMI that will allow them to administer thousands of devices with 1 query or setting. In addition (without know anything specific about the device you are selling) you could explain that the device can be set to only run the executable required by the application running on it. With regards to virus worries, I would explain that a virus could only be executed if the user actually installed and ran the virus (my understanding is that there are 4 and 3 of them require user intervention to run the forth is a DOS attack). Hopefully you are able to guarantee that your own servers are not going to be infection points, and you use EV certs to eliminate spoofing issues. Personally I'd be far more worried if you were selling me a bunch of Linux based devices as they'd be an administrative nightmare and just about anything could be installed on them. You don't necessarily require any extra software to administer these devices but a client that has an active directory already has an administrative advantage. For those that don't I’d pre-develop some powershell or VBscripts that perform common administrative functions and give them to any customers that want or need them.

0
1

As far as the configuration aspect goes there are tools that are available to manage thousands of Windows CE devices.

There is at least one company I know of, Odyssey Software (www.odysseysoftware.com), that has a product called Athena that links in with Microsoft System Management Server and can remotely manage these devices, including the ability to do a remote desktop (a la VNC) to them.

The problem with Athena is that it is a framework and not an out of the box product that you can use to manage your fleet of devices. It requires significant development to create a comprehensive remote monitoring/configuration application out of it.

There are companies out there that have integrated Athena into a product though and offer it for sale. Odyssey can probably direct you with that. Your Microsoft rep should also be able to get you more info on remote configuration of Windows CE.

That is, provided that you're interested in having the companies remotely manage the devices' configurations. There isn't much you could do to manage the devices yourself remotely if they are behind a corporate firewall (hopefully, if the firewall is any good).

0
1

Do the same thing that Microsoft did when they came out with WSUS.

Make a server component that can live on a host inside the customer's corporate network. This server will be a central administration host for the CE devices. The server would be responsible for connecting with your site and the CE devices would talk to this central server.

1

Given that these devices are at customer premises and need to "phone home" to your website, I'd:

  • Segment the network so these devices live in a separate DMZ, with no access to the customer's internal network. Provided their function - which was not elaborated upon - does not require access to the customer's network, that is. If they are "like TiVos", that would be true: They have a function, they need Internet, but they don't need to know or care about the rest of the customer's network.

  • Give the customer a defined number of ports and IPs to configure for these devices to go outbound, and allow no access inbound. Likely, they'll need http or https to your web server, and nothing else. The customer can configure this on the firewall protecting the DMZ these devices "live" in.

  • Configure the devices to auto-detect proxy settings. Assist customers that mandate the use of web proxies with setting up the PAC file and "wpad" hostname for auto-detection, assuming the devices use IE to connect back to your web server. There are a number of walk-throughs available on how to set this up. This way, proxy settings need not be configured on "100s of devices", all that is required is the wpad location hosting the PAC file, so that the devices may discover a proxy.

  • I'm assuming the devices will use DHCP inside the customer's network? How is basic network configuration handled for these?

  • Software updates - take the burden off your customers. Configure these devices so that you can push out updates to them. The SMS answer in this thread looks like a good solution.

  • And as already pointed out in the thread, harden the devices - turn off all Windows CE services that are surplus to requirements. Come up with a Windows CE configuration that gives you all the features you need for your application, and nothing more.

0

Controlling the services that can be connected to your hosts are key. You don't want to have any port connectable unless you explicitly need it to function(RDP, vnc, http, etc...). If you can secure the device from remote exploits in common software (IIS, MSSQL, etc...) you can have your customers run any vulnerability scans they need on the device to ensure its not going to help propagate malware.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .