Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any mechanism in mobile device management solutions that would allow a web server (for an internal, authenticated system, e.g. SharePoint) to know that a request is coming from a mobile device? e.g. something added to the header, or a special way of authenticating.

I'm a bit fuzzy on how these kinds of solutions work in practice, but obviously somewhere a server knows that a device is a mobile device that is registered with the MDM system, so that it can reject devices that aren't approved.

There's probably not one answer that applies to all MDM, but an example in a particular MDM is good, something that works similarly across many would be awesome.

share|improve this question

closed as off topic by AJ Henderson, Jeff Ferland Apr 25 '13 at 21:15

Questions on Information Security Stack Exchange are expected to relate to Information security within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

I'm fully aware of UserAgent, and also fully aware that it's fairly easy to change in some browsers (and that it could be done by some users without malicious intent, e.g. users wanting to see the desktop version of a site that insists on sending a stripped down mobile version). This comes from a desire to restrict access to some content from mobile devices. – lgaud Apr 26 '13 at 12:56

I can't imagine why it would since this is not the domain of MDM, but as commercial suppliers keep trying to build one product to do everything rather than developing platforms which integrate, then it's quite possible I might be wrong.

Any MDM platform should allow you to configure VPN on the devices it controls.

Any browser advertises exactly what version and OS it runs on in every request.

knows that a device is a mobile device that is registered with the MDM system

That's something diferent - you want an MDM which can be integrated with your authentication system. I'm not aware of any product which does this.

share|improve this answer

A normal Web browser will send, as part of its requests to Web servers, a standard header called User-Agent, which usually states the browser vendor, version, and type of machine and operating system on which it is currently running. You can use that to react on some device types. However, this is only for a cooperating client: a malicious user can alter at will the user-agent his browser sends.

A more thorough solution, but more expensive, is to install some device-specific secret value in each "approved" device. For instance, use a Certification Authority to issue a certificate for each device; when connecting, the server will require the client to show its certificate. This is a standard procedure in SSL. It would still be up to the server to check that the authenticated device identity is one of the "approved" identities (in a Microsoft context, Web server is IIS and can map certificates to accounts in Active Directory, which is a possibly way to implement that).

You cannot prevent a malicious device owner from extracting the certificate (with its private key) from his device, and installing it into another, non-approved device; but, at least, when you detect that such a villainy has been perpetrated, you can first block that identity server side, then revoke the offending certificate and thus recover from the consequences of that heinous act.

share|improve this answer

If its a web server, you can install Google analytics that will not only tell you what device is connecting, but # of visits, browser, OS, country, new vs returning visits and much much more.

I am not sure if that's a kind of solution you were looking for but I decided to share this information just in case if you think its valuable. Other members will hopefully be able to provide you with other solutions.

Cheers, Damon

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.