Endpoint Management (EPM) refers to a set of tools used by IT to setup, maintain, and support computers. CNS OIT can provide better support because we can see information about your computer that we use along with remote support tools to resolve problems and fulfill requests. EPM also improves security by employing policies designed to protect access to University computers, data, and resources and identifying the presence of specific security vulnerabilities.
The Endpoint Management (EPM) Centralization and Standardization Program was created to improve the consistency, efficiency, and security of UT devices by establishing centralized EPM tools. IT staff and administrators across UT collaborate to provide a robust and reliable EPM platform.
The use of central EPM was written into policy at the direction of the Information Security Office, the Executive Vice President and Provost, and the President of the University of Texas at Austin after auditors found that networked devices— and especially computers— are one of the largest security risks we have.
Security policies for device configuration and management require UT business be performed using computers enrolled in the central EPM platform and administered by trained IT staff. Additionally, IT staff must be able to prove all devices meet minimum security standards to auditors.
| Panel | |
|---|---|
|
...
|
...
|
...
What will be different after my computer is enrolled?
admin access
logging in with EIDs
OS and applications updates (security)
screen saver lock
CNS IT will have an admin account
Remote access
...
|
...
Restricted Permissions
While this page is in development, only the following people have access to view this page:
Melissa Medina-Razzaque
Matt Davidson
Mark McFarland
Margie Athol
This page will have information about the EPM Phase 3 project including definitions for key terms and FAQs.
| Table of Contents | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Definitions & Terms
Below is an alphabetized list of frequently used terms and how they’re defined along with an explanation of what that looks like in our environment or implications.
...
Term
...
Definition
...
What does that mean?
...
Owner, device owner
...
The individual who owns the device or who is responsible for making decisions about the device.
...
For research labs, the PI is assumed to be owner for each device. The owner can delegate responsibilities (such as approving changes) at their discretion.
...
Address, addressing a device
...
Done by CNS OIT in collaboration with the owner.
Take actions so the device is capable of performing needed functions and is compliant with security policies. This includes collecting inventory information, making configuration changes to the device, and/or making configuration changes around the device.
...
Inventory identification will happen for every computer. Configuration changes to a computer may include enrollment in central management, adjusting administrative permissions, setting up data backups, installing OS and application updates, among other settings changes. Configuration changes around the computer may include removing it from the network, changing what network it’s connected to, or adding a hardware firewall.
...
Enroll, enroll in management, enrollment in central management
...
Done by CNS OIT in collaboration with the owner.
Install software that connects a computer to the centralized Endpoint Management (EPM) systems, then use the EPM systems to set up policies for regular installation of updates and enable security configurations.
...
See the FAQ “What will be different after my computer is enrolled?” for more details.
...
Endpoint
...
Any device capable of connecting to the internet and accessing, storing, or sharing information.
...
Computers, tablets, smartphones, security cameras, and printers are all considered endpoints.
In the context of this project, “endpoint” will most commonly be referring to a computer.
...
Endpoint Management (EPM)
...
A set of tools used by IT to employ policies designed to protect access to University computers, data, and resources by securing computers and identifying the presence of specific security vulnerabilities.
...
Currently, we have EPM tools for computers (macOS, Windows, and Linux) and iPads.
See the FAQ “What will be different after my computer is enrolled?” for more details.
...
Inventory identification
...
Gather details about a computer that are used to identify a device, who is responsible for it, and aid in support.
...
CNS OIT will gather details about the computer’s hardware from the device itself. We will talk to the owner and/or users of the device to find out information about how the device is used and by whom. See the FAQ section “Inventory Identification” for more details.
...
UT-owned
...
Purchased using UT funds, including grants. Owned by the University of Texas at Austin.
...
For research labs that came to UT from another University: all devices originally purchased at a prior institution and were brought to UT are UT-owned and required to be transferred from the prior institution’s inventory to UT’s inventory.
...
Personal, personally-owned
...
Purchased using personal funds that did not originate from a UT account. Belongs to the individual.
...
Used for University business
...
Any device that is used to store, process, access, or share data that is owned by the University or produced during and/or for the purpose of performing University duties.
...
Using a computer in these ways would make that computer used for University business:
Grading student work— even if done entirely through a web browser (e.g. using Grade Scope or Canvas).
Analyzing data, writing a paper, or creating a poster for UT-funded and/or grant-funded research.
Any UT work or UT resources being accessed as a student does not count (e.g. submitting your own coursework via Canvas).
FAQs
Endpoint Management (EPM) & Enrollment in Central EPM
...
Check back often for updates This content is still under development and new content is being added regularly. The date this page was last updated can be seen under the page title. |
Management is required for all UT-owned computers
macOS
Apple computers and tablets are managed using Jamf.
Windows
Windows computers and servers are managed using MECM.
Linux
Red Hat Enterprise Linux, CentOS Stream, Ubuntu, and Debian are managed using Orcharhino.
Below are a few features managed by EPM that we’d like to highlight as they work a little differently compared to a computer that isn’t managed. These are things you might notice after a UT computer is enrolled in EPM. Details about how some of these features work for your OS can be found by clicking the “More about…” buttons above.
Administrator accounts and administrative access
Logging in to the computer using an administrator account will be disabled, but an administrator account will be created for the device owner as needed. This is in accordance with IRUSP Stand 5.
CNS OIT will have an administrator account that enables us to properly administer the computer.
Screen saver lock
As defined in IRUSP Standard 15.2.5: “Unattended computing devices must be secured from unauthorized access using a combination of physical and logical security controls… [including] screen saver passwords and automatic session time-outs that are set to activate after 15-minutes of inactivity.”
Remote access
Unless required, remote access will be restricted to only allow remote access by CNS OIT. CNS OIT only uses remote access when it’s required to provide support.
If remote access has been configured, this page has instructions for how to use it: Remote Access and Remote Login
Logging in with your EID
Computers are connected to the Austin domain which gives users the ability to login to a computer using their EID. This is done in accordance with IRUSP Standards 4.1.1 and 4.1.3.
Operating system and application security updates
As defined in Minimum Security Standard 4.5.2 for Systems: “Operating system and application services security patches are installed expediently (e.g., 30-days) and in a manner consistent with change management procedures. Products that no longer receive security updates from the vendor (e.g., unsupported) are not authorized.”
CrashPlan for backing up data
CrashPlan is installed and configured to backup your data.
For instructions on configuring and using CrashPlan, see our page: /wiki/spaces/cnsit/pages/71993134
Exceptions to Management
An exception requires a technical justification approved by CNS OIT, the Dean, and the ISO. Valid for a maximum of one year, they’re intended as an intermediate step between a computer being unmanaged and managed. Additional security measures must also be taken to ensure the security and compliance of the computer.
Once an exception expires, it must be enrolled in management or refiled after approval by CNS OIT, the Dean, and the ISO.
A computer with an exception to management is the responsibility of the device owner, but CNS OIT will assist with certain aspects of the exception process and alternate security measures. As each case is unique, CNS OIT will discuss the division of responsibility with the device owner.
Here is an example of a computer in a research lab that qualifies for an exception from management and what compliance looks like:
Situation
The computer is an instrument controller provided by the vendor. Enrolling the computer in management is a violation of the service agreement with the vendor and would cause issues with the software used to control the instrument.
Security measures taken to meet compliance
A firewall configured by CNS OIT is installed in front of the computer. The computer is then only able to connect to a select number of devices in the lab, UT Box, CrashPlan, and an IP address range supplied by the vendor used for remote support including updates to the instrument and software.
What these measures accomplish
The computer is less vulnerable to attacks from external sources.
If the computer were to be compromised, it’s ability to infect other computers on the network or compromise UT data is limited.
These are protections that EPM provides through a combination of firewall rules, system configurations, and anti-virus software.
The computer is still able to:
Control the instrument
Receive support from the vendor.
Automatically back up data, making it easy to access from another computer for analysis and decreasing the chance of data loss.
FAQs about Management
| Expand | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||||||
|
What if my computer isn’t compatible with EPM?
CNS OIT will work with the device owner to understand the situation and identify options. If your computer isn’t compatible due to a technical business justification, an exception from management can be requested.
More details about EPM for each OS including compatibility requirements can be found by clicking the “More about…” buttons above.
What if my computer doesn’t store confidential data, does it still need to be managed?
All UT-owned computers must be enrolled in central EPM, regardless of how it’s used and what data is stored on it.
Can I manage my computer myself? Why does CNS OIT have to manage it?
Though we have many technical and skilled people in the college, it’s a matter of policy.
IRUSP standard 19.3 for management of UT-owned devices requires the use of central EPM and requires that it be administered by professionally-trained IT staff.
Security policy also includes the ability to prove compliance in real time to auditors. In the event of a cyberattack or system compromise, we must be able to respond quickly. EPM makes this possible.
Do you have access to my data?
Some of it. CNS OIT has the access and technical ability to access data that is stored in these ways:
On the hard drive of a managed computer: Select members of CNS OIT staff can use our
...
administrator account to access files saved within any user profile.
CrashPlan (Code42, UTBackup): Select members of CNS OIT staff have access to the administrator console.
UT Box: Only if CNS OIT is the owner of a shared folder, or has access to a departmental Box share.
File servers: Only if CNS OIT manages it.
CNS OIT does not have access to data stored in these locations, however the administrators of these services do:
UTMail
Microsoft 365: Outlook (email and calendar), OneDrive, SharePoint, Teams
UT Box (all folders and files)
All other UT-owned devices and services
Your data is your data, and the privacy and security of your data is a top priority. We do not access a person’s data unless requested to do so by the data owner or another authority.
Will you be monitoring or looking at my data?
No. CNS OIT does not look at nor monitor the data anyone has on their computer. The only time we intentionally touch data on a computer is if we are assisting in data recovery or if we are legally required to do so such as during a FOIA request. In these cases, CNS OIT does not open, look at, nor review any files beyond verifying the data is not corrupted.
...
Inventory Identification
...
| minLevel | 1 |
|---|---|
| maxLevel | 7 |
Why are you taking inventory details about my personal computer?
Why do you need to know how I use my computer?
These are 3 main reasons:
We configure management to minimize disruptions and avoid negative impacts to productivity while adhering to security requirements. The default management configurations are designed based on the average habits and needs of our users, but we evaluate every situation individually.
Troubleshooting is streamlined and a more targeted approach can be taken. We look for patterns based on how a computer is used, and deviations from those patterns help us identify the underlying problem.
UT is required by state law to identify what classification and types of data are stored on or accessed by a device. Knowing how a device is used helps answer this question.
What information are you gathering?
...
CNS OIT also ensures data storage and transmission is secure and accessible only by those authorized to do so.
The privacy and security of data is a top priority. We do not access anyone’s data unless requested to do so by the data owner or another authority.
There is zero tolerance for the abuse of privileged access and results in termination.
| Panel | ||||||||
|---|---|---|---|---|---|---|---|---|
| ||||||||
Questions about Endpoint Management in CNS? Create a ticket by submitting a form: https://help.cns.utexas.edu/ or send us an email: help@cns.utexa.edu |