Jamf Protect offers visibility, protection for macOS admins
Jamf Protect, the new endpoint security software announced at JNUC 2019, provides organizations with a native macOS tool that takes a kernel-less approach to macOS security.
MINNEAPOLIS -- Compliance and behavioral analysis features in endpoint security tool Jamf Protect may lessen IT concerns about adopting macOS devices in the enterprise.
Jamf Protect offers a kernel-less -- or kextless -- approach to endpoint security, which was announced here at Jamf Nation User Conference (JNUC) 2019, Jamf's annual user conference. The platform offers day-one support of new macOS security features, insight into compliance across an organization's fleet of macOS devices and behavior-based malware detection.
As the use of macOS in the enterprise increases, the landscape of security threats evolves, said David McIntyre, CISO and CTO of Build America Mutual, a financial services company in New York.
"There were so many more threats for Mac than I thought, so we had to add something to fight them off," McIntyre said.
A lack of security management is one of the biggest hindrances to macOS adoption in the enterprise, said Patrick Wardle, co-founder at Digita Security and current principle security researcher at Jamf. Most enterprise organizations that consider deploying macOS devices have existing Windows machines that they manage, and as such they have a Windows-focused desktop management infrastructure.
"In an ideal world, the single pane of glass for Windows and Mac endpoint management would work, but feature parity is largely missing for the macOS components of these tools," Wardle said.
What can Jamf Protect do?
Jamf Protect offers kextless management; instead of kernel extensions, it builds on the EndpointSecurity framework that Apple provides. Kext files extend Mac OS X kernels and can bloat a desktop with additional code. With the release of macOS 10.15 Catalina, Apple deprecated kernel extensions to encourage a kextless approach.
"It'll be huge for us if we can get rid of apps that use kext files," said Tom O'Mahoney, a systems support analyst at Home Advisor in Golden, Co. "Hopefully that's the future of all desktop management."
It'll be huge for us if we can get rid of apps that use kext files -- hopefully that's the future of all desktop management.
Tom O'MahoneySystems support analyst, Home Advisor
Some kernel extensions only work with certain versions of Mac OS X and can prevent users from booting desktops after OS updates. Admins must troubleshoot this issue by searching through all of the OS' kext files and determining which non-Apple kext file is causing the issue, as Apple automatically trusts kext files that have its developer ID.
"The kextless approach prevents a lot of issues that our current endpoint manager has with macOS updates," said Brian Bocklett, IT engineer at Intercontinental Exchange, a financial services company in Atlanta, Ga.
Jamf Protect will also provide visibility into an organization's entire macOS fleet. Admins can view the status of macOS devices' security configurations and settings in the Insights tab of Jamf Protect and compare this data to endpoint security standards published by the Center for Internet Security (CIS).
Jamf Protect's Insights tab
Michael Stover, a desktop engineer at Home Advisor, which has roughly a 90-10 split on Windows and macOS devices, said that macOS visibility is a common compliance issue.
"The CIS benchmarks are probably the biggest selling point for us," he said. "It would be game-changing to see all that configuration data in one place and compare it to the benchmarks."
The behavioral analysis style of macOS threat detection also drew some interest from JNUC 2019 attendees. This approach to malware detection identifies actions that files or software try to execute and searches for anomalies. If Jamf Protect finds instances of a phantom click, a common malware tactic, it can alert IT professionals to the suspicious behavior.
Jamf Protect forgoes attempts to recognize specific instances of malware; instead it recognizes the actions of potentially malicious software. Jamf Protect also detects software with an unfamiliar developer ID attempting to access data, install additional software or take actions that could invite malware onto a desktop.
"You don't need to have every bank robber's photo to know that someone running into a bank with a ski mask and a weapon is trying to rob that bank," McIntyre said.
Still, some aspects of Jamf Protect gave macOS admins pause, including the behavior analysis style of threat detection. In a Q&A after the Jamf Protect session ended, several attendees asked if the tool provides a more proactive approach for threat prevention and if Jamf Protect had any way to prevent false positives before they happen.
Spotify, for example, includes the suspicious phantom clicks as part of its UI, so users running Spotify could generate false positives. IT professionals can add exceptions to the behavioral analysis with Spotify and other similar cases, but it's difficult to anticipate every exception they'll need to add.
Additionally, some organizations require security standards far stricter than those of the CIS, and Jamf Protect doesn't allow organizations to add their own benchmarks or customize the CIS benchmarks.
Jamf Protect is generally available as a paid subscription service for commerical U.S. customers, according to Jamf.
