Jamf Kat: Hello and welcome to the latest episode of the Jamf After Dark podcast, a podcast to introduce you to the people at Jamf, learn about what we're up to when it comes to managing and securing Apple devices, along with what's generally happening in the IT landscape. I'm your co-host, Kat Garbus, joined by co-host Josh Thornton.
Josh Thornton: Hey, good morning, good afternoon, cat. It's always nice being here with you. How you doing?
Jamf Kat: doing alright. Just you know having some coffee, trying to just really become in tune with my surroundings and just be sure that I've got everything under control. I've been doing a bunch of updates for my personal Mac and my personal phone and yeah it's just you know that that that health check. for my own devices. It's like spring cleaning, but for technology. I've been doing a bit of that this week. How about you?
Josh Thornton: I haven't been doing any spring cleaning for technology, just normal spring cleaning. And, you know, of course we've gotten some poor weather and I woke up this morning and I've got water in my basement. So, you know, I got to take care of that too, but it was more important to be here with y'all. So that's what I am doing.
Jamf Kat: Yeah. I'm so sorry to hear you've got water in your basement and sometimes things unexpectedly get out of control. I hope you can also just find a way to get things back on track. But enough about us and our spring cleaning and drama. Josh, who's with us today?
Josh Thornton: It's a great question. It's actually I'm super excited. I mean, I always am, but I'm particularly excited because we actually have one of our customers joining us, which is awesome. And we've got Billy Roberts, who works at Travis County down in Texas. Billy, could you introduce yourself for our listeners?
Billy Roberts: Sure. My name is Billy Roberts. I work for Travis County ITS, Travis County's local county government in Austin, Texas. I am a senior systems engineer on our endpoint management team, which means that kind of in charge of all the endpoints and all the management software. And we support laptops, desktops, mobile devices, MTR, pretty much anything that's on a desk. ⁓ We support.
Jamf Kat: That's awesome. Welcome to the show. Austin, so many good food spots in Austin. If you drive by Rudy's, think of me. I love Rudy's barbecue.
Billy Roberts: Thank you. There's so much better barbecue than Rudy's in Austin though.
Jamf Kat: I know, I know. There's Franklin's, like Franklin's is good. I've been a few of them, but Rudy's, I don't know. It's like a Honda with barbecue. Like it's stable. You know, it's going to taste good. Like it's just, they're everywhere, which is also, so there's convenience. I really like Rudy's. So next time, you know, maybe even after the recording of this podcast, you'll be kind of driving by like, ⁓ there's a Rudy's. I should go grab a bite and send me a photo.
Billy Roberts: Yeah. Ha
Jamf Kat: and just taught me since we don't have that where I'm from in Chicago. Thanks so much for being here today, Billy. We were very excited to have you join. Recently, you've also been doing videos at Jamf 2, just talking about your experience. And I spoke to Josh and I was like, we have to have Billy on the podcast to unpack some of this because those videos are amazing. But I was sitting here like we need to have a full on discussion because There's a few things that sparked my personal interest. One, it's government. you know, Apple devices and government is not, not a thing. They do have them. But the fact that you have Apple devices alongside your Windows devices, you have a hybrid environment, you're under a lot of scrutiny for compliance, constantly thwarting attacks, and there's There's just a lot to unpack there. So I thought I would, if we can get Billy on the show, let's get him on the show to talk about this. So thank you for being here. And I guess I'll start kicking off the questions. I started walking through it, but talk to us about the Apple tech you're using. Obviously we know Apple isn't the only environment you're supporting. So I want to confirm this. is a hybrid environment, which would then kind of walk me through why not use a UEM and why Jamf?
Billy Roberts: Okay, so for the Apple tech that we have currently, we have 17 MacBooks. ⁓ We don't have a ton of MacBooks and Mac minis right now. It's just that's the way things are. It's really hard to get them into enterprise. ⁓ We do have 1700 iPhones that are user-based. ⁓ We have 149 user-based iPads, so it's a single user signing on. ⁓ 46 kiosk iPads. that we have throughout the county, ⁓ that's actually gonna grow along with our Mac minis, putting them in kiosk mode. And then we have 136 shared iPhones and iPads. we put them in, some of them are using Jamf Setup and Reset, which we absolutely love. ⁓ Some of them are just normal shared devices. They didn't need Outlook or any of the Microsoft software on there. So they're just normal shared device. Usually it's... maybe one or two apps on there that they share. So, and then as far as our environment, we're mostly Windows. We're probably at like 6,900 Windows devices. ⁓ So we're mostly a Windows shop. ⁓ As far as mobile, we are completely Apple. think we have four Android left and they're all converting over to iPhone. And that was a lot. Like that was a lot to convince people to... get rid of Android. That's what they have personally. That's what they've used at the county for so many years. We just don't have the control over Android that we do with Apple. And that sounds funny because people are like, well, Apple's, you know, they're really restrictive. If you try to manage Android devices, they don't let you do anything. There's very few restrictions of some of the things that we do ⁓ within the county, everything, all of our mobile stuff's all based on CIGIS standards. ⁓ So it's criminal justice information systems standards. So it's on par with DOD standards and FedRAMP. So it's really high. And there's things where we'd have to get third party apps to do the security part of Android, which Apple already has built in. And so really it was like a no brainer for us just to say, okay, we're fully Apple going forward. We're not going to get anything else for mobile.
Josh Thornton: I was gonna say, I think it's one of the unique challenges and I've worked with other, you know, county and state government customers that you just have so many diverse use cases that, you know, where some IT teams, yeah, they have different departments that they're supporting, but in a lot of ways you've got, it's almost like different organizations that you're supporting. It goes beyond departments and I think that is such a challenge. Now, You mentioned you've got a ton of Windows devices, a handful of Macs, a ton of iOS. What has you using Jamf versus more of that unified endpoint management? Because we know, you know, Apple for mobile kind of sets the stage of what is possible from a device management standpoint through their MDM specification.
Billy Roberts: So our biggest reason for moving over, so I'll give you a little bit of backstory. 2019 we got Jamf. We were actually told by two vendors, two major vendors that that's where we needed to go. We were on a different product at the time and they were like, this is where you need to be. Like Jamf is like best of breed. We got it, we put some test devices in and then we were offered a a ⁓ free device management software as part of some licensing. And so we moved over. We're really never happy with that because we always felt like that system was so far behind what Apple was doing. So Apple would say, here's all the new stuff coming for endpoint management. And we would wait months before that actually made its way. And I kept saying like, you know, we made a mistake getting rid of jamf like we need to go back and they were like, yeah, but it's, you know, it's going to cost us money. And, you know, we have this other thing and it works. Okay. ⁓ And then we had an issue with some iPads that were supposed to be on all the time. Like they were, you know, during business hours, they needed to be used. ⁓ There was like 300 of them. And one day the majority of them just rebooted. and was doing updates, even though we had set the updates to, you know, be later in the day, it just never followed a true schedule. And this was prior to true DDM. And they were like, you know, our other product, can't seem to fix this problem. What do we do? And they came to me and I was like, well, I was like, there's only one thing we can do. And I'm like, I kept preaching it for years and years and years now. So I was like, you know, let's go back to Jamf. And you know, from there, I kept pushing that was in 21, 2021. And I kept pushing. I'm like, okay, where are these 300 devices in here? Let's put everything in. So they were like, okay, well, what about Macs? Do you want to move Macs over? And I was like, yes. So I created a migration plan. I didn't contact Jamf and say, how do we migrate them? We literally invented something from scratch. Didn't lose any data. at all on any of the Macs, everything moved over. ⁓ We got them all done. I think we had 20 at the time. We got them all moved over. Then I was like, okay, well, what about mobile? And they were like, well, we'll revisit it. And so finally in 2023, I was like, you know, what are we gonna do? ⁓ They were like, well, you know, maybe we can move some specialty devices in there, know, kiosks and other things that we're having problems with. I was like, okay, well, we can do that, but I wanna move everything. And so finally, you know, I pushed and pushed and pushed and with the help of ⁓ our, our cells rep at Jamf, Jason, we came up with a list of why it made sense. And I would tell you the biggest thing is the biggest things are when Apple releases something Jamf's on top of it. And normally there's a Jamf Pro release before we even know what Apple's doing. Like you guys are on top of it. The other thing was just the speed like when we needed to take something out of kiosk mode it just we can do that the other product that we had Who knows when it'll come out of kiosk mode? Like that's just the reality and so Those were the big proponents to get us back in and then of course we did our migration last year and got everything in so So now we're full jump for for Apple products
Jamf Kat: So we were in a relationship, we broke up, we're back together. And I just want to unpack some of the things you said and if you're able to share some more detail. You touched on some of the features working with Jason. Jason's director is amazing, by the way. So I'm very glad you feel supported by him and you all collaborated to make a list. I think that's a really good first step when evaluating of what's important to us.
Billy Roberts: Yes.
Jamf Kat: What are some of the gaps that we're seeing? You mentioned a few things of some of the things that stood out to you, like the Apple releases. I feel like that's bit of an unsung hero. Some folks don't realize how important that can be with connections, features, things breaking. The one that really, and then you said the migration was easy, which most people would. push on you and be like, hey, migrations aren't usually easy. The fact you didn't have to go around to every device, collect devices, ask the end user to pretend to be IT for a little bit to go through steps. The fact we're able to do that without a bunch of unenrolling, re-enrolling, losing data and not having a big downtime like that's really unheard of and impressive. And I think it speaks to the fact that a lot of people might think Jamf is harder than it needs to be, but it's really not. If you're able to even figure that out without calling us, like don't get me wrong, our services are amazing. We can help people who might need that help, but the fact that we're like, I would say we'll just figure it out, like to me that's impressive. The big one that I think people don't realize that I wanna touch on with you a little bit more, not only the speed to do things, but making changes. Cause it sounds like, hey, if we wanna take a device and repurpose it, within kiosk mode or take it out of kiosk mode or maybe you need to make a change deployed. I love that not only you mentioned you can get things done quick, but I want to unpack that a little bit. And I want to hear from you because in my experience with competing solutions that are out there free or not, the speed to do things may not matter with a little thing. Like if you're like, hey, we want to push out a new wallpaper. We changed our branding. That's not a big deal. But if you need to push out a security update or a patch and you're waiting for a device to check in, that can be a problem. Can you talk to us in your experience of some of these gaps and speed to do things and the device check in and I'll speak, like I wanted to unravel that thread just a little bit more with you if you can.
Billy Roberts: Okay, I actually have a really good example ⁓ of the speed part of it. We had a project where we were doing ⁓ iPads in our local jail for our public defender's office to be able to speak with people that were arrested. So it's their first contact with their public defender. ⁓ That project was brought to me. We had ideas on it. I was like, I can just set up iPads. We'll put them in kiosk mode. We'll throw teams on it. Just we'll get a, you know, we'll create a teams account for it. I'll have it all sign in. I went and found ⁓ cases from this company they have magnets on the back for really big magnets. Cause we wanted to stick them on the wall. We didn't want to hand them to people. ⁓ And so when we were initially going to test them in office, ⁓ I'd set one up in our other device management software. And so they could kind of see like, you know, what it looked like. And they were like, Hey, it's asking for access to the mic. And we have to go into settings and settings doesn't exist. Like it's in kiosk mode. And I was like, give me a second. And I literally went into Jamf, excluded that device from the kiosk. and it popped up, it just blipped and they were like, that was super fast, how did you do that? And I was like, it's in Jamf. And they were like, is this other product that fast? And I was like, no. I was like, it could be. ⁓ I said, we could test it and see what happens after we're done. They were like, yeah, let's test it and just see. So they ended up making the changes. I put it back in kiosk mode. It literally, the screen flashes and you're done. And so I said, okay, let's do a test. I'll take it out again, this other one, and we'll take the one out that's in our other device management. And I handed them to them and said, okay, let me know when the other one comes out. Cause I was like, the Jamf one's already done. And they came back after about eight hours and like, finally came out of kiosk mode. So that was, know, when you do that and you're trying to push, you know, for all your devices to be in Jamf, That's like the greatest advertisement for moving to Jamf. Like it's just instant. Like I didn't have anything to worry about. It wasn't fighting with me. Literally just excluded it, you know, from a config profile and it flashed and then they were able to do what they needed to do. And they were like, this is helpful because, you know, if we're out in the field, we could just say, you could just take it out. Somebody could make a change. You could just put it back in and nobody has to really touch the device other than whoever's making the change. on the device itself. And I was like, yeah, this is so easy. I like, there's no reason to have to wait. Like, and you're right, security updates. Like there's no reason, even with DDM, there's no reason to have to wait, you know, hours for that to go out and trigger. I want it to trigger right now. Like we're hardcore about it. You have to be updated within seven days or your device goes non-compliant. Like we are really hardcore about keeping all of those mobile devices updated. I mean, that's what makes sense. It's that speed of being able to push things out to the devices and it actually loading without error and without having to go fight with it or go look at logs, it just works.
Jamf Kat: Yeah, I was going to say the nice thing is we'll give the policy confirmations as well if something took or didn't take. So you kind of know why, like was this offline or what happened here. But the speed too, like even seven days, like what if you had like an emergency where you need to push a security patch today, right? Like, I mean, I've, worked for a Jamf managed service provider before I became a Jamf employee. And sometimes not always, but like, You don't want to be the throat to choke, right? You don't want to be the person who's on the chopping block. If you need to push an emergency patch, update, whatever it may be, and then be like, we have to wait till the device checks in before it happens. Like if it's an emergency situation where an emergency security patch needs to get pushed out, where I think most listeners have had something like that happen, you don't want to have to explain to your boss's boss to be like, well,
Billy Roberts: Yeah.
Jamf Kat: We're waiting for the device to check in. It won't take effect till about eight hours minimum, maybe more. And then they start questioning you, and it's like, why is it taking that long? I want this on there now. And that's some of the things that we don't have problems with. So I think those are really solid examples.
Billy Roberts: Yeah, I will say like, so when we get security alerts about things, I joke that that's my TPS report. Like, cause I get it from more than one person and they'll go, well, what about, you know, what about, you know, max and iPhones and iPads, you know, there's a new version of Google Chrome and we need everybody on it. And I'm like, it's already updated. They were like, what do mean it's already updated? And I was like, they released it last night and I scheduled Jamf to go through and update every app at midnight and so I was like it's already updated like it's not a problem and then I was like you don't have to ask me if it's apple related it's already updated I don't even have to go look like it's just gonna be updated I don't have to fight with that I don't have to pull reports it's just updated
Josh Thornton: That's powerful. And I think I am just so excited to hear how security conscious y'all are. right now is an interesting time when we think about security software and we've seen different frontier LLM models that are identifying vulnerabilities at a faster pace than ever. And we also know there's adversaries who are going to be using those tools to do the same thing. And so it is so important that we stay up to speed with our OSs, our apps, our compliance policies that we deploy. Now, I know you're obviously using Jamf Pro from a management standpoint. Earlier, you also mentioned set up in Jamf Reset. What Jamf tools are you all using regularly?
Billy Roberts: So when we did our renewal two years ago, we went full suite. So we are Jamf Pro, Jamf Protect, Jamf Connect, ⁓ Jamf Trust. ⁓ So of course we have Jamf Security Center. I probably spend more time in Security Center than I do in Jamf Pro to be honest. And that's just looking at things, seeing what's going on. ⁓ A lot of that I've converted to having an extension attribute in Jamf Pro. So I know what the risk score is for the device if it's low, medium, high. We're putting that into Jamf Pro so we can look at that instead and use that as kind of a marker on what's going on with our devices. ⁓ but we love Jamf Trust and Jamf Security Center. Like that was, I feel like that was a big win for me to try to find something for mobile security. Cause you know, we have security, we have multiple security software on our windows machines. And so there, you know, our security team has always been like, well, let's just use one of those. They have mobile and I'm like, let's look at Jamf. You know, you guys are wanting something specific. Let's look at Jamf. Like it just made more sense to go that direction. We already had Jamf Pro. I want something that integrates and that all works together.
Josh Thornton: Yeah. And I think the integration piece is huge. think there are other solutions that you might run on Windows and Mac and mobile, know, iOS and Android, and they're trying to do too much. And usually most of those tools, they do offer some functionality on a mobile device. It's not quite as robust. It might not have as much detail. It might not prevent as many issues or reduce some of the risks that you're looking for. And so. I agree. think the, you know, jam for mobile overall, which is really all of our mobile platform capabilities is really awesome. And I love that you're like bringing in the risk scoring because, you know, risk scoring is looking at both network threats and on device, you know, app risk and all of this and culminating to know is this device trustworthy or not? And should we allow it? You know, if I have conditional access policies, can it connect to our resources? You know, do I feel good enough about it? And I think that's just... Really great that y'all are taking advantage of that.
Billy Roberts: Yeah, we absolutely love it. We originally just got Jamf Trust and Jamf Security Center just for the app scoring. That's how this started. And then, you I asked the security team, I was like, are y'all gonna take this over? They were like, no, we don't really wanna manage this. They were like, can you manage it? And I was like, sure, doesn't. it's anything like Jamf Pro, I don't have to do much. Like, you know, it's just gonna work. And so I really went in and configured it. really well so that it does way more than anyone expected. And even though they went through the demos multiple times, we literally demoed everything five times. Like, cause we were, we were looking for something that had app scoring. Like that's what we wanted to do. And as part of ⁓ a bigger project that we have internally, and I was just like, it can do more than that. And it kind of surprised security some of the things it can do to protect the devices.
Josh Thornton: love the emphasis on mobile security. know, and Kat knows this is like a ⁓ that I have, I guess is what I call it, that so many organizations don't prioritize ⁓ with their security strategy. And you talk just phishing alone, not only is it ⁓ prevalent, you know, it's no longer just coming through an email, it's coming through text messages and social media. ⁓ you compound that issue with the fact that the ways I might detect a phishing email on a computer are gonna be different on mobile. On my computer, maybe I hover my cursor over a URL hyperlink to see where is this taking me? Well, if I do that on a mobile device, in a lot of cases, it's just opening up a little quick look preview of that phishing email and actually loading it directly. so, There's a lot to be said about securing mobility and for y'all, know compliance is so important. mentioned some of the standards you need to achieve. How are you using Jamf to both enforce and also prove that you have controls in place?
Billy Roberts: So I think the biggest thing for us is, you know, we have compliance that we have set up. So we have restrictions in place so that when the device isn't compliant, you know, they lose access to things, especially email. That's a big thing. ⁓ You lose access to your mobile email. If you're going to call and be like, why, what's the problem? And we're like, well, you haven't updated your device. Go in there to settings and update your device. It needs to be on the latest. ⁓ The other thing is just with JFS security center going in there and just seeing where the device is at. So I'll go in there and say, what's all my high devices and why? ⁓ It gives me a really good picture of why. A lot of times it's just gonna be updates. There's been a couple of times it was an app and we ended up, you know, being able to find out what was going on. ⁓ There are apps sometimes that show up as side loading. A lot of people don't realize that there are apps that come from the app store that say they're side loaded. It's just the way that the code was written and we have to go find those things and make sure that they're on the latest. ⁓ We even had Google Chrome show up as side loaded on five or six devices and we ended up the way we have JF Pro set up for mobile now is we give the user the ability to remove the apps. I'm like, remove it, get it off your device, go back into self-service and install it again. And let's see where it's at. And it usually cleans things up. But without that, we wouldn't know like Jam Pro wouldn't know on its own. You know, Jam Pro is really for management and for, you know, to make sure that devices are updated and that for, you know, have compliance, but the security center part of it being without it. you really don't know what's going on with your devices. Not really. You're not gonna know what's going on with apps. You're not gonna know that somebody in one of your departments is spending all of their time on social media, which that came as a shock to people. I'm like, yep, I could see where you've been. I could see what websites you've gone to. It's all, we track all that. Security Center gives us all that information and we don't use it to come down on people or be big brother. But when somebody is like, ⁓ my phone, the battery is not holding a charge and it's like six months old and we go look and they've been on a video website all day. ⁓ Because we don't allow, we're restrictive on apps too, they have to go through an approval process. So when they've been on YouTube for hours in a day and I'm like, yeah, your battery's not gonna last, stay off YouTube. That's... You know, if that's not your job, then don't do that or do it on your laptop. Your mobile's really not there for that.
Josh Thornton: Yeah, think, you know, folks don't realize like, obviously the impact that that has hardware wise, your battery drains fast. There's an impact cost wise, even if you have cellular data that you're connected to and you're paying as an organization for your cellular data and usage there, that's huge. And of course, just the overall productivity impact. But I agree sometimes, you you need a break from work for a few minutes just to catch a video or two to let your brain rest. By and large, there's a difference. Yeah, or hugging the Wi-Fi, yeah.
Jamf Kat: Or they're hogging the Wi-Fi. Right? Like you're trying to do work and someone's streaming YouTube videos and they're hogging that precious ⁓ Wi-Fi for others who are actually trying to do work things. So there's the security piece and there's, to your point, Josh, that productivity piece too. I was thinking too, Billy, while you were talking about security. and how it's hitting mobile first. And there's been studies that 85 % of organizations out there are not properly securing their mobile. But then you're like, something you said just really resonated and connect the dots for me. It's like, they're probably going to check their mobile first, most likely. But then that can be like the gateway, and not a good way, for a security vulnerability that I think a lot of people don't realize. Like most people just slap on MDM on their mobile devices call it a day. And then in doing such, they're unintentionally creating a back door for a security problem to get through to their desktops or their network. So I'm really grateful you shared that example because I think that really does connect the dots for some folks that might want to be reevaluating their mobile posture right now because we put so much effort most organizations into the four walls of the organizations, who's connected to the Wi-Fi, all those things on a laptop desktop. But then they're not really considering, that's the same email address and the same applications on a mobile device. And you're not taking those same precautions. And that can be that backdoor of getting in or causing and wrecking havoc. So I just want to say, appreciate you sharing that with us.
Billy Roberts: Yeah, no problem. With mobile security, what I've learned over the last few years is that no one believes that phones can be hacked. I'm kind of in that, for Apple I'm in that, for Android not so much. ⁓ I do have experience getting into phones, ⁓ Android phones. ⁓ They were a lot easier in the past. They weren't very secure, but. really when it comes to security and people are like, well, we can secure it, you know, getting our iPhone hacked is, you know, like close to impossible, but it's not about that. It's not about securing it where somebody can't hack the device. It's where you're not getting emails coming in, phishing emails, because they may not take over the device, but they may end up getting credentials sent to... you know, someone who is going to use them to go in and wipe all your devices, which has happened now. ⁓ So I think our biggest thing is that's our protection from that for mobile is to make sure that the apps are safe and to make sure that we're taking care of everything else that could happen. We're not worried about someone taking over an iPhone or an iPad. We're more worried about what they're sending. to those devices and what's getting clicked on and where our credentials are going.
Jamf Kat: Yeah, I mean, I like to play bad guy in at least one episode. ⁓ like if I try to steal Josh's credentials and, you know, I steal them, like I could, sure, wipe the device, but I think you're going to be more concerned if he clicks on something, I steal the credentials, whatever. If I get access to sensitive corporate data, government data, the client data, and I think that's the part a lot of people don't consider in that domino effect. of, well, they clicked on the phishing link. ⁓ well, at least they're not going to take control of the device. It's not even that. Now I've got Josh's username and passcode. I can copy cookies. I can do whatever. And I can now start being like, well, what do they got hiding in here that I can get access to? And I think it's the data that people may not be considering and factoring in and upping up that security piece.
Billy Roberts: Yeah, we are very security forward when it comes to our data. I mean, at any point in time, we could have sensitive data on anything within the county. That has happened. One of the reasons that we decided for mobile that we needed to adhere to CEJA standards was that there was a bailiff in the courts that had my name, like, We have the exact same name. Our middle name is the only thing different, but we don't go by middle names. You know, it's not part of, you know, our user ID. So I've, I had emails sent to me that were meant for him. And of course I'm CJIS certified, HIPAA certified. ⁓ I go through all kinds of training. So it wasn't that big of a deal, but I was like, well, when we look at it grand scheme of things we have at the time. we had a specific name and then we had, you know, somebody with a two, a three or four all the way up to nine. And it's the same name. ⁓ One of those person worked in courts, one worked for the sheriff's department. I'm like, at any time that could be an accident. So that was our big push to be Siegius, but even that is not enough. Like we needed something. you know, on the device itself that gave us some extra protection because I have gone and ran errands before. I don't take my laptop from gonna go pick up a prescription or go pick up lunch and come back during my lunch hour. I take my phone with me and that's a lot of times my first line, you know? And so to not have that being defended by anything feels like too much of a risk at this point. ⁓ so that was my big push for, for Jamf Trust. I'm like, it's not, know, yeah, we can get it for app scoring, but what about all these other great things they can do? And they're like, ⁓ well, you know, our data is protected. And I'm like, but I want to protect more. Like I, I got really into it and I was like, you know, not just cause it was a Jamf product and you know, I, you know, I love setting up Jamf products. ⁓ it was more of, I was thinking, you know, longterm, what does it look like as things get progressively ⁓ more complex for mobile? Like we need something there that's saying, no, no, this isn't gonna happen. ⁓ You know, we're not gonna give you access to this because it's too much of a risk. that's, know, Jamf Trust does that for us. That's, you know, I think it, I like that more than I do the app scanning part of it. and security is kind of the opposite. They love the app scanning part of it. And I'm like, I love the rest of it. Like I love the data it gives me. I love the protection that it gives us. That's what gives me the warm fuzzies is when I know that we're protected.
Josh Thornton: Gives me the warm fuzzies too. I think that's a good place to be. Kat, any other questions for you or Billy? Anything that you wanted to share that you haven't had a chance to yet?
Billy Roberts: You Sure, I have something. So ⁓ part of what we do and the reason that we originally got Jamf Trust ⁓ was the app scanning. And so we had started a technology assessment program. ⁓ So we assess everything. you're trying to buy a piece of software or hardware, or if you want a mobile app, it goes through an assessment process. I'm actually on that team as part of... ⁓ two other people that are part of operations, which my team falls under and we have somebody from our land WAN and somebody from our application identity management team. So we look at everything. And so with mobile apps, that's why we went Jamf Trust is cause we can scan and we got a score, you know, low, medium or high. Then we could make decisions based on that. You know, do we really want to do this? if it comes back medium or high, why is that? And Is it something we're willing to take a risk on ⁓ for mobile devices? So we started at that point, getting a lot more security conscious on mobile ⁓ and it worked really well. And then one day, there was an app that we put on a device and it didn't scan. And of course you just email support and they'll scan it and they put it into Jamf Security Center, except we got back a 12 page report and we're like, this is new. Like why is there this big report? ⁓ It got presented at ⁓ our meeting for technology assessments. And I'm not kidding when I say it was like someone had, we were all sitting around in a cave and somebody invented fire. Like that made a gigantic difference. We didn't know anything had changed yet. I had a meeting coming up to discuss some changes with our ⁓ customer success manager. and we didn't know yet that that had changed and that there was another company now secure that was doing the scanning for Jamf. And when I tell you that's made a gigantic change in how we do things, we get these reports and it tells us everything. I've seen the full, full report. We don't even get the full report. I've seen a full report before and it's 300 plus pages. ⁓ It's a lot of data. So to get that down, I think the shortest one we've had is eight and the longest one we've had is like 14 pages. It tells us everything. ⁓ That for our assessments program, even for mobile apps, we get it in, we get a request in. First thing we do is kind of look at it and go, this is an enterprise related, we probably shouldn't go forward. Let's have them find something that's more enterprise related. ⁓ and then a task is opened and we mail Jamf support and was like, hey, scan this app. ⁓ We get back this gigantic report of all the data and we put it into the task. And then when the team goes and talks about it, it goes through, you know, our security assurance. ⁓ I take a look at it from a standpoint of management. And then, you know, we have ⁓ other departments that'll go through it for compliance ⁓ and other security things. And then it goes to legal, ⁓ which I'm in those meetings too. And we have two attorneys assigned to check all of those. ⁓ And before we were having to do a lot more research. When you just have low media or high, you don't know everything. So we were having to load apps onto devices to look at terms and conditions. ⁓ We don't do that now. Like the report tells us everything. ⁓ So we've shrunk down like a 45 day process to pretty short. Like sometimes it's around 30 days because we do have a lot of assessments because we assess everything at this point. ⁓ But for the most part, we're getting that shrunk down pretty quick. Like we wanna be at a turnaround of like a couple of weeks for these. And the reason we do that is that apps aren't a free for all at Travis County at all. You have to request it, it has to be approved. There are things. laws that the state has in place that we have to follow. So there are times where people are like, well, we still want the app, we'll take the risk. It goes into our risk registry, it does happen. ⁓ And for the most part, we don't reject, I think we've had close to 50 requests in the last three years. And we've only rejected probably like, maybe we're from two to four, somewhere in that range. ⁓ And some of that, most of that is just like, that's not an enterprise app. You can't have that. ⁓ You know, we need to find something that's enterprise based, but to be able to go through something like that and then say, okay, well, we verified this app is safe. So we can load it on the devices and it's not a worry. It's not something we're having to think about all the time. It's, you know, we have the data in front of us that says, hey, this app is safe. you know, and you can put it on your devices and you're not going to have to worry and you're not going to run a foul of state law for, you know, contracts and accepting terms and conditions, which I didn't even know was a thing until we got into this. Like we really didn't. We didn't know that the state had all these rules on accepting terms and conditions. ⁓ you know, I've learned a lot from our legal team on that things I just didn't know. And I think overall it makes us more secure. So again, You know, it's not just for us, it's not just about managing the device the right way and the way to keep us safe. It's really the security aspect overall. And that's what Jamf gives us. Like it's not just we're securing the devices. We're also making sure the apps are secure and that, you know, the legal terms are acceptable. So Jamf provides us a lot, makes our lives a lot easier, a lot easier.
Josh Thornton: That's a mic drop right there. ⁓ You know, you can't ⁓ end any any better than that. Well, Billy, thank you so much for your time and for sharing your story. And honestly, just the amazing work y'all are doing. I think it serves as a model, hopefully for a lot of organizations out there, government and private and even education institutions. So appreciate you being here today.
Billy Roberts: Ha ha ha ha. Yeah, I appreciate it. As soon as I was asked, I was like, yes, I'm doing the podcast. I'm like, is this going to be so much fun? Like, I want to do this so bad.
Josh Thornton: Well, we are glad that you were able to join us today. And if you got some more cool stories, maybe we'll do a comeback session.
Jamf Kat: Thank you so much.
Billy Roberts: Thank you.
Josh Thornton: As always, y'all, appreciate you tuning in and listening. Jamf After Dark is a podcast from Jamf in copyright 2026. All rights are reserved. Technical details and product offerings, they can change at any time. So always check Jamf.com for the latest info on our products and services.
Jamf Kat: You can reach out to us if you have questions or comments or suggested show topics or even fan mail. Simply send a friendly email to info at jamf.com with the subject line, attention to the podcast. We're also a sponsor of the MacAdmins Foundation and several jams are available on the MacAdmins Slack channel. And of course, if you need support, visit Jamf account to start a conversation or open a ticket to get your technical questions answered.
Josh Thornton: And again, special thanks to our guests this week. Billy, you were awesome. And also for our audio and video engineers, Merlin and Martin, who help us look and sound great. Until next time, for Cat Garbus, I'm Josh Thornton.
Jamf Kat: And for Josh Thornton, I'm Kat Garbus. We'll catch you after dark again. Thank you for listening. Good night, good morning, good afternoon, and don't forget to secure your mobile devices.
Josh Thornton: Hey, good morning, good afternoon, cat. It's always nice being here with you. How you doing?
Jamf Kat: doing alright. Just you know having some coffee, trying to just really become in tune with my surroundings and just be sure that I've got everything under control. I've been doing a bunch of updates for my personal Mac and my personal phone and yeah it's just you know that that that health check. for my own devices. It's like spring cleaning, but for technology. I've been doing a bit of that this week. How about you?
Josh Thornton: I haven't been doing any spring cleaning for technology, just normal spring cleaning. And, you know, of course we've gotten some poor weather and I woke up this morning and I've got water in my basement. So, you know, I got to take care of that too, but it was more important to be here with y'all. So that's what I am doing.
Jamf Kat: Yeah. I'm so sorry to hear you've got water in your basement and sometimes things unexpectedly get out of control. I hope you can also just find a way to get things back on track. But enough about us and our spring cleaning and drama. Josh, who's with us today?
Josh Thornton: It's a great question. It's actually I'm super excited. I mean, I always am, but I'm particularly excited because we actually have one of our customers joining us, which is awesome. And we've got Billy Roberts, who works at Travis County down in Texas. Billy, could you introduce yourself for our listeners?
Billy Roberts: Sure. My name is Billy Roberts. I work for Travis County ITS, Travis County's local county government in Austin, Texas. I am a senior systems engineer on our endpoint management team, which means that kind of in charge of all the endpoints and all the management software. And we support laptops, desktops, mobile devices, MTR, pretty much anything that's on a desk. ⁓ We support.
Jamf Kat: That's awesome. Welcome to the show. Austin, so many good food spots in Austin. If you drive by Rudy's, think of me. I love Rudy's barbecue.
Billy Roberts: Thank you. There's so much better barbecue than Rudy's in Austin though.
Jamf Kat: I know, I know. There's Franklin's, like Franklin's is good. I've been a few of them, but Rudy's, I don't know. It's like a Honda with barbecue. Like it's stable. You know, it's going to taste good. Like it's just, they're everywhere, which is also, so there's convenience. I really like Rudy's. So next time, you know, maybe even after the recording of this podcast, you'll be kind of driving by like, ⁓ there's a Rudy's. I should go grab a bite and send me a photo.
Billy Roberts: Yeah. Ha
Jamf Kat: and just taught me since we don't have that where I'm from in Chicago. Thanks so much for being here today, Billy. We were very excited to have you join. Recently, you've also been doing videos at Jamf 2, just talking about your experience. And I spoke to Josh and I was like, we have to have Billy on the podcast to unpack some of this because those videos are amazing. But I was sitting here like we need to have a full on discussion because There's a few things that sparked my personal interest. One, it's government. you know, Apple devices and government is not, not a thing. They do have them. But the fact that you have Apple devices alongside your Windows devices, you have a hybrid environment, you're under a lot of scrutiny for compliance, constantly thwarting attacks, and there's There's just a lot to unpack there. So I thought I would, if we can get Billy on the show, let's get him on the show to talk about this. So thank you for being here. And I guess I'll start kicking off the questions. I started walking through it, but talk to us about the Apple tech you're using. Obviously we know Apple isn't the only environment you're supporting. So I want to confirm this. is a hybrid environment, which would then kind of walk me through why not use a UEM and why Jamf?
Billy Roberts: Okay, so for the Apple tech that we have currently, we have 17 MacBooks. ⁓ We don't have a ton of MacBooks and Mac minis right now. It's just that's the way things are. It's really hard to get them into enterprise. ⁓ We do have 1700 iPhones that are user-based. ⁓ We have 149 user-based iPads, so it's a single user signing on. ⁓ 46 kiosk iPads. that we have throughout the county, ⁓ that's actually gonna grow along with our Mac minis, putting them in kiosk mode. And then we have 136 shared iPhones and iPads. we put them in, some of them are using Jamf Setup and Reset, which we absolutely love. ⁓ Some of them are just normal shared devices. They didn't need Outlook or any of the Microsoft software on there. So they're just normal shared device. Usually it's... maybe one or two apps on there that they share. So, and then as far as our environment, we're mostly Windows. We're probably at like 6,900 Windows devices. ⁓ So we're mostly a Windows shop. ⁓ As far as mobile, we are completely Apple. think we have four Android left and they're all converting over to iPhone. And that was a lot. Like that was a lot to convince people to... get rid of Android. That's what they have personally. That's what they've used at the county for so many years. We just don't have the control over Android that we do with Apple. And that sounds funny because people are like, well, Apple's, you know, they're really restrictive. If you try to manage Android devices, they don't let you do anything. There's very few restrictions of some of the things that we do ⁓ within the county, everything, all of our mobile stuff's all based on CIGIS standards. ⁓ So it's criminal justice information systems standards. So it's on par with DOD standards and FedRAMP. So it's really high. And there's things where we'd have to get third party apps to do the security part of Android, which Apple already has built in. And so really it was like a no brainer for us just to say, okay, we're fully Apple going forward. We're not going to get anything else for mobile.
Josh Thornton: I was gonna say, I think it's one of the unique challenges and I've worked with other, you know, county and state government customers that you just have so many diverse use cases that, you know, where some IT teams, yeah, they have different departments that they're supporting, but in a lot of ways you've got, it's almost like different organizations that you're supporting. It goes beyond departments and I think that is such a challenge. Now, You mentioned you've got a ton of Windows devices, a handful of Macs, a ton of iOS. What has you using Jamf versus more of that unified endpoint management? Because we know, you know, Apple for mobile kind of sets the stage of what is possible from a device management standpoint through their MDM specification.
Billy Roberts: So our biggest reason for moving over, so I'll give you a little bit of backstory. 2019 we got Jamf. We were actually told by two vendors, two major vendors that that's where we needed to go. We were on a different product at the time and they were like, this is where you need to be. Like Jamf is like best of breed. We got it, we put some test devices in and then we were offered a a ⁓ free device management software as part of some licensing. And so we moved over. We're really never happy with that because we always felt like that system was so far behind what Apple was doing. So Apple would say, here's all the new stuff coming for endpoint management. And we would wait months before that actually made its way. And I kept saying like, you know, we made a mistake getting rid of jamf like we need to go back and they were like, yeah, but it's, you know, it's going to cost us money. And, you know, we have this other thing and it works. Okay. ⁓ And then we had an issue with some iPads that were supposed to be on all the time. Like they were, you know, during business hours, they needed to be used. ⁓ There was like 300 of them. And one day the majority of them just rebooted. and was doing updates, even though we had set the updates to, you know, be later in the day, it just never followed a true schedule. And this was prior to true DDM. And they were like, you know, our other product, can't seem to fix this problem. What do we do? And they came to me and I was like, well, I was like, there's only one thing we can do. And I'm like, I kept preaching it for years and years and years now. So I was like, you know, let's go back to Jamf. And you know, from there, I kept pushing that was in 21, 2021. And I kept pushing. I'm like, okay, where are these 300 devices in here? Let's put everything in. So they were like, okay, well, what about Macs? Do you want to move Macs over? And I was like, yes. So I created a migration plan. I didn't contact Jamf and say, how do we migrate them? We literally invented something from scratch. Didn't lose any data. at all on any of the Macs, everything moved over. ⁓ We got them all done. I think we had 20 at the time. We got them all moved over. Then I was like, okay, well, what about mobile? And they were like, well, we'll revisit it. And so finally in 2023, I was like, you know, what are we gonna do? ⁓ They were like, well, you know, maybe we can move some specialty devices in there, know, kiosks and other things that we're having problems with. I was like, okay, well, we can do that, but I wanna move everything. And so finally, you know, I pushed and pushed and pushed and with the help of ⁓ our, our cells rep at Jamf, Jason, we came up with a list of why it made sense. And I would tell you the biggest thing is the biggest things are when Apple releases something Jamf's on top of it. And normally there's a Jamf Pro release before we even know what Apple's doing. Like you guys are on top of it. The other thing was just the speed like when we needed to take something out of kiosk mode it just we can do that the other product that we had Who knows when it'll come out of kiosk mode? Like that's just the reality and so Those were the big proponents to get us back in and then of course we did our migration last year and got everything in so So now we're full jump for for Apple products
Jamf Kat: So we were in a relationship, we broke up, we're back together. And I just want to unpack some of the things you said and if you're able to share some more detail. You touched on some of the features working with Jason. Jason's director is amazing, by the way. So I'm very glad you feel supported by him and you all collaborated to make a list. I think that's a really good first step when evaluating of what's important to us.
Billy Roberts: Yes.
Jamf Kat: What are some of the gaps that we're seeing? You mentioned a few things of some of the things that stood out to you, like the Apple releases. I feel like that's bit of an unsung hero. Some folks don't realize how important that can be with connections, features, things breaking. The one that really, and then you said the migration was easy, which most people would. push on you and be like, hey, migrations aren't usually easy. The fact you didn't have to go around to every device, collect devices, ask the end user to pretend to be IT for a little bit to go through steps. The fact we're able to do that without a bunch of unenrolling, re-enrolling, losing data and not having a big downtime like that's really unheard of and impressive. And I think it speaks to the fact that a lot of people might think Jamf is harder than it needs to be, but it's really not. If you're able to even figure that out without calling us, like don't get me wrong, our services are amazing. We can help people who might need that help, but the fact that we're like, I would say we'll just figure it out, like to me that's impressive. The big one that I think people don't realize that I wanna touch on with you a little bit more, not only the speed to do things, but making changes. Cause it sounds like, hey, if we wanna take a device and repurpose it, within kiosk mode or take it out of kiosk mode or maybe you need to make a change deployed. I love that not only you mentioned you can get things done quick, but I want to unpack that a little bit. And I want to hear from you because in my experience with competing solutions that are out there free or not, the speed to do things may not matter with a little thing. Like if you're like, hey, we want to push out a new wallpaper. We changed our branding. That's not a big deal. But if you need to push out a security update or a patch and you're waiting for a device to check in, that can be a problem. Can you talk to us in your experience of some of these gaps and speed to do things and the device check in and I'll speak, like I wanted to unravel that thread just a little bit more with you if you can.
Billy Roberts: Okay, I actually have a really good example ⁓ of the speed part of it. We had a project where we were doing ⁓ iPads in our local jail for our public defender's office to be able to speak with people that were arrested. So it's their first contact with their public defender. ⁓ That project was brought to me. We had ideas on it. I was like, I can just set up iPads. We'll put them in kiosk mode. We'll throw teams on it. Just we'll get a, you know, we'll create a teams account for it. I'll have it all sign in. I went and found ⁓ cases from this company they have magnets on the back for really big magnets. Cause we wanted to stick them on the wall. We didn't want to hand them to people. ⁓ And so when we were initially going to test them in office, ⁓ I'd set one up in our other device management software. And so they could kind of see like, you know, what it looked like. And they were like, Hey, it's asking for access to the mic. And we have to go into settings and settings doesn't exist. Like it's in kiosk mode. And I was like, give me a second. And I literally went into Jamf, excluded that device from the kiosk. and it popped up, it just blipped and they were like, that was super fast, how did you do that? And I was like, it's in Jamf. And they were like, is this other product that fast? And I was like, no. I was like, it could be. ⁓ I said, we could test it and see what happens after we're done. They were like, yeah, let's test it and just see. So they ended up making the changes. I put it back in kiosk mode. It literally, the screen flashes and you're done. And so I said, okay, let's do a test. I'll take it out again, this other one, and we'll take the one out that's in our other device management. And I handed them to them and said, okay, let me know when the other one comes out. Cause I was like, the Jamf one's already done. And they came back after about eight hours and like, finally came out of kiosk mode. So that was, know, when you do that and you're trying to push, you know, for all your devices to be in Jamf, That's like the greatest advertisement for moving to Jamf. Like it's just instant. Like I didn't have anything to worry about. It wasn't fighting with me. Literally just excluded it, you know, from a config profile and it flashed and then they were able to do what they needed to do. And they were like, this is helpful because, you know, if we're out in the field, we could just say, you could just take it out. Somebody could make a change. You could just put it back in and nobody has to really touch the device other than whoever's making the change. on the device itself. And I was like, yeah, this is so easy. I like, there's no reason to have to wait. Like, and you're right, security updates. Like there's no reason, even with DDM, there's no reason to have to wait, you know, hours for that to go out and trigger. I want it to trigger right now. Like we're hardcore about it. You have to be updated within seven days or your device goes non-compliant. Like we are really hardcore about keeping all of those mobile devices updated. I mean, that's what makes sense. It's that speed of being able to push things out to the devices and it actually loading without error and without having to go fight with it or go look at logs, it just works.
Jamf Kat: Yeah, I was going to say the nice thing is we'll give the policy confirmations as well if something took or didn't take. So you kind of know why, like was this offline or what happened here. But the speed too, like even seven days, like what if you had like an emergency where you need to push a security patch today, right? Like, I mean, I've, worked for a Jamf managed service provider before I became a Jamf employee. And sometimes not always, but like, You don't want to be the throat to choke, right? You don't want to be the person who's on the chopping block. If you need to push an emergency patch, update, whatever it may be, and then be like, we have to wait till the device checks in before it happens. Like if it's an emergency situation where an emergency security patch needs to get pushed out, where I think most listeners have had something like that happen, you don't want to have to explain to your boss's boss to be like, well,
Billy Roberts: Yeah.
Jamf Kat: We're waiting for the device to check in. It won't take effect till about eight hours minimum, maybe more. And then they start questioning you, and it's like, why is it taking that long? I want this on there now. And that's some of the things that we don't have problems with. So I think those are really solid examples.
Billy Roberts: Yeah, I will say like, so when we get security alerts about things, I joke that that's my TPS report. Like, cause I get it from more than one person and they'll go, well, what about, you know, what about, you know, max and iPhones and iPads, you know, there's a new version of Google Chrome and we need everybody on it. And I'm like, it's already updated. They were like, what do mean it's already updated? And I was like, they released it last night and I scheduled Jamf to go through and update every app at midnight and so I was like it's already updated like it's not a problem and then I was like you don't have to ask me if it's apple related it's already updated I don't even have to go look like it's just gonna be updated I don't have to fight with that I don't have to pull reports it's just updated
Josh Thornton: That's powerful. And I think I am just so excited to hear how security conscious y'all are. right now is an interesting time when we think about security software and we've seen different frontier LLM models that are identifying vulnerabilities at a faster pace than ever. And we also know there's adversaries who are going to be using those tools to do the same thing. And so it is so important that we stay up to speed with our OSs, our apps, our compliance policies that we deploy. Now, I know you're obviously using Jamf Pro from a management standpoint. Earlier, you also mentioned set up in Jamf Reset. What Jamf tools are you all using regularly?
Billy Roberts: So when we did our renewal two years ago, we went full suite. So we are Jamf Pro, Jamf Protect, Jamf Connect, ⁓ Jamf Trust. ⁓ So of course we have Jamf Security Center. I probably spend more time in Security Center than I do in Jamf Pro to be honest. And that's just looking at things, seeing what's going on. ⁓ A lot of that I've converted to having an extension attribute in Jamf Pro. So I know what the risk score is for the device if it's low, medium, high. We're putting that into Jamf Pro so we can look at that instead and use that as kind of a marker on what's going on with our devices. ⁓ but we love Jamf Trust and Jamf Security Center. Like that was, I feel like that was a big win for me to try to find something for mobile security. Cause you know, we have security, we have multiple security software on our windows machines. And so there, you know, our security team has always been like, well, let's just use one of those. They have mobile and I'm like, let's look at Jamf. You know, you guys are wanting something specific. Let's look at Jamf. Like it just made more sense to go that direction. We already had Jamf Pro. I want something that integrates and that all works together.
Josh Thornton: Yeah. And I think the integration piece is huge. think there are other solutions that you might run on Windows and Mac and mobile, know, iOS and Android, and they're trying to do too much. And usually most of those tools, they do offer some functionality on a mobile device. It's not quite as robust. It might not have as much detail. It might not prevent as many issues or reduce some of the risks that you're looking for. And so. I agree. think the, you know, jam for mobile overall, which is really all of our mobile platform capabilities is really awesome. And I love that you're like bringing in the risk scoring because, you know, risk scoring is looking at both network threats and on device, you know, app risk and all of this and culminating to know is this device trustworthy or not? And should we allow it? You know, if I have conditional access policies, can it connect to our resources? You know, do I feel good enough about it? And I think that's just... Really great that y'all are taking advantage of that.
Billy Roberts: Yeah, we absolutely love it. We originally just got Jamf Trust and Jamf Security Center just for the app scoring. That's how this started. And then, you I asked the security team, I was like, are y'all gonna take this over? They were like, no, we don't really wanna manage this. They were like, can you manage it? And I was like, sure, doesn't. it's anything like Jamf Pro, I don't have to do much. Like, you know, it's just gonna work. And so I really went in and configured it. really well so that it does way more than anyone expected. And even though they went through the demos multiple times, we literally demoed everything five times. Like, cause we were, we were looking for something that had app scoring. Like that's what we wanted to do. And as part of ⁓ a bigger project that we have internally, and I was just like, it can do more than that. And it kind of surprised security some of the things it can do to protect the devices.
Josh Thornton: love the emphasis on mobile security. know, and Kat knows this is like a ⁓ that I have, I guess is what I call it, that so many organizations don't prioritize ⁓ with their security strategy. And you talk just phishing alone, not only is it ⁓ prevalent, you know, it's no longer just coming through an email, it's coming through text messages and social media. ⁓ you compound that issue with the fact that the ways I might detect a phishing email on a computer are gonna be different on mobile. On my computer, maybe I hover my cursor over a URL hyperlink to see where is this taking me? Well, if I do that on a mobile device, in a lot of cases, it's just opening up a little quick look preview of that phishing email and actually loading it directly. so, There's a lot to be said about securing mobility and for y'all, know compliance is so important. mentioned some of the standards you need to achieve. How are you using Jamf to both enforce and also prove that you have controls in place?
Billy Roberts: So I think the biggest thing for us is, you know, we have compliance that we have set up. So we have restrictions in place so that when the device isn't compliant, you know, they lose access to things, especially email. That's a big thing. ⁓ You lose access to your mobile email. If you're going to call and be like, why, what's the problem? And we're like, well, you haven't updated your device. Go in there to settings and update your device. It needs to be on the latest. ⁓ The other thing is just with JFS security center going in there and just seeing where the device is at. So I'll go in there and say, what's all my high devices and why? ⁓ It gives me a really good picture of why. A lot of times it's just gonna be updates. There's been a couple of times it was an app and we ended up, you know, being able to find out what was going on. ⁓ There are apps sometimes that show up as side loading. A lot of people don't realize that there are apps that come from the app store that say they're side loaded. It's just the way that the code was written and we have to go find those things and make sure that they're on the latest. ⁓ We even had Google Chrome show up as side loaded on five or six devices and we ended up the way we have JF Pro set up for mobile now is we give the user the ability to remove the apps. I'm like, remove it, get it off your device, go back into self-service and install it again. And let's see where it's at. And it usually cleans things up. But without that, we wouldn't know like Jam Pro wouldn't know on its own. You know, Jam Pro is really for management and for, you know, to make sure that devices are updated and that for, you know, have compliance, but the security center part of it being without it. you really don't know what's going on with your devices. Not really. You're not gonna know what's going on with apps. You're not gonna know that somebody in one of your departments is spending all of their time on social media, which that came as a shock to people. I'm like, yep, I could see where you've been. I could see what websites you've gone to. It's all, we track all that. Security Center gives us all that information and we don't use it to come down on people or be big brother. But when somebody is like, ⁓ my phone, the battery is not holding a charge and it's like six months old and we go look and they've been on a video website all day. ⁓ Because we don't allow, we're restrictive on apps too, they have to go through an approval process. So when they've been on YouTube for hours in a day and I'm like, yeah, your battery's not gonna last, stay off YouTube. That's... You know, if that's not your job, then don't do that or do it on your laptop. Your mobile's really not there for that.
Josh Thornton: Yeah, think, you know, folks don't realize like, obviously the impact that that has hardware wise, your battery drains fast. There's an impact cost wise, even if you have cellular data that you're connected to and you're paying as an organization for your cellular data and usage there, that's huge. And of course, just the overall productivity impact. But I agree sometimes, you you need a break from work for a few minutes just to catch a video or two to let your brain rest. By and large, there's a difference. Yeah, or hugging the Wi-Fi, yeah.
Jamf Kat: Or they're hogging the Wi-Fi. Right? Like you're trying to do work and someone's streaming YouTube videos and they're hogging that precious ⁓ Wi-Fi for others who are actually trying to do work things. So there's the security piece and there's, to your point, Josh, that productivity piece too. I was thinking too, Billy, while you were talking about security. and how it's hitting mobile first. And there's been studies that 85 % of organizations out there are not properly securing their mobile. But then you're like, something you said just really resonated and connect the dots for me. It's like, they're probably going to check their mobile first, most likely. But then that can be like the gateway, and not a good way, for a security vulnerability that I think a lot of people don't realize. Like most people just slap on MDM on their mobile devices call it a day. And then in doing such, they're unintentionally creating a back door for a security problem to get through to their desktops or their network. So I'm really grateful you shared that example because I think that really does connect the dots for some folks that might want to be reevaluating their mobile posture right now because we put so much effort most organizations into the four walls of the organizations, who's connected to the Wi-Fi, all those things on a laptop desktop. But then they're not really considering, that's the same email address and the same applications on a mobile device. And you're not taking those same precautions. And that can be that backdoor of getting in or causing and wrecking havoc. So I just want to say, appreciate you sharing that with us.
Billy Roberts: Yeah, no problem. With mobile security, what I've learned over the last few years is that no one believes that phones can be hacked. I'm kind of in that, for Apple I'm in that, for Android not so much. ⁓ I do have experience getting into phones, ⁓ Android phones. ⁓ They were a lot easier in the past. They weren't very secure, but. really when it comes to security and people are like, well, we can secure it, you know, getting our iPhone hacked is, you know, like close to impossible, but it's not about that. It's not about securing it where somebody can't hack the device. It's where you're not getting emails coming in, phishing emails, because they may not take over the device, but they may end up getting credentials sent to... you know, someone who is going to use them to go in and wipe all your devices, which has happened now. ⁓ So I think our biggest thing is that's our protection from that for mobile is to make sure that the apps are safe and to make sure that we're taking care of everything else that could happen. We're not worried about someone taking over an iPhone or an iPad. We're more worried about what they're sending. to those devices and what's getting clicked on and where our credentials are going.
Jamf Kat: Yeah, I mean, I like to play bad guy in at least one episode. ⁓ like if I try to steal Josh's credentials and, you know, I steal them, like I could, sure, wipe the device, but I think you're going to be more concerned if he clicks on something, I steal the credentials, whatever. If I get access to sensitive corporate data, government data, the client data, and I think that's the part a lot of people don't consider in that domino effect. of, well, they clicked on the phishing link. ⁓ well, at least they're not going to take control of the device. It's not even that. Now I've got Josh's username and passcode. I can copy cookies. I can do whatever. And I can now start being like, well, what do they got hiding in here that I can get access to? And I think it's the data that people may not be considering and factoring in and upping up that security piece.
Billy Roberts: Yeah, we are very security forward when it comes to our data. I mean, at any point in time, we could have sensitive data on anything within the county. That has happened. One of the reasons that we decided for mobile that we needed to adhere to CEJA standards was that there was a bailiff in the courts that had my name, like, We have the exact same name. Our middle name is the only thing different, but we don't go by middle names. You know, it's not part of, you know, our user ID. So I've, I had emails sent to me that were meant for him. And of course I'm CJIS certified, HIPAA certified. ⁓ I go through all kinds of training. So it wasn't that big of a deal, but I was like, well, when we look at it grand scheme of things we have at the time. we had a specific name and then we had, you know, somebody with a two, a three or four all the way up to nine. And it's the same name. ⁓ One of those person worked in courts, one worked for the sheriff's department. I'm like, at any time that could be an accident. So that was our big push to be Siegius, but even that is not enough. Like we needed something. you know, on the device itself that gave us some extra protection because I have gone and ran errands before. I don't take my laptop from gonna go pick up a prescription or go pick up lunch and come back during my lunch hour. I take my phone with me and that's a lot of times my first line, you know? And so to not have that being defended by anything feels like too much of a risk at this point. ⁓ so that was my big push for, for Jamf Trust. I'm like, it's not, know, yeah, we can get it for app scoring, but what about all these other great things they can do? And they're like, ⁓ well, you know, our data is protected. And I'm like, but I want to protect more. Like I, I got really into it and I was like, you know, not just cause it was a Jamf product and you know, I, you know, I love setting up Jamf products. ⁓ it was more of, I was thinking, you know, longterm, what does it look like as things get progressively ⁓ more complex for mobile? Like we need something there that's saying, no, no, this isn't gonna happen. ⁓ You know, we're not gonna give you access to this because it's too much of a risk. that's, know, Jamf Trust does that for us. That's, you know, I think it, I like that more than I do the app scanning part of it. and security is kind of the opposite. They love the app scanning part of it. And I'm like, I love the rest of it. Like I love the data it gives me. I love the protection that it gives us. That's what gives me the warm fuzzies is when I know that we're protected.
Josh Thornton: Gives me the warm fuzzies too. I think that's a good place to be. Kat, any other questions for you or Billy? Anything that you wanted to share that you haven't had a chance to yet?
Billy Roberts: You Sure, I have something. So ⁓ part of what we do and the reason that we originally got Jamf Trust ⁓ was the app scanning. And so we had started a technology assessment program. ⁓ So we assess everything. you're trying to buy a piece of software or hardware, or if you want a mobile app, it goes through an assessment process. I'm actually on that team as part of... ⁓ two other people that are part of operations, which my team falls under and we have somebody from our land WAN and somebody from our application identity management team. So we look at everything. And so with mobile apps, that's why we went Jamf Trust is cause we can scan and we got a score, you know, low, medium or high. Then we could make decisions based on that. You know, do we really want to do this? if it comes back medium or high, why is that? And Is it something we're willing to take a risk on ⁓ for mobile devices? So we started at that point, getting a lot more security conscious on mobile ⁓ and it worked really well. And then one day, there was an app that we put on a device and it didn't scan. And of course you just email support and they'll scan it and they put it into Jamf Security Center, except we got back a 12 page report and we're like, this is new. Like why is there this big report? ⁓ It got presented at ⁓ our meeting for technology assessments. And I'm not kidding when I say it was like someone had, we were all sitting around in a cave and somebody invented fire. Like that made a gigantic difference. We didn't know anything had changed yet. I had a meeting coming up to discuss some changes with our ⁓ customer success manager. and we didn't know yet that that had changed and that there was another company now secure that was doing the scanning for Jamf. And when I tell you that's made a gigantic change in how we do things, we get these reports and it tells us everything. I've seen the full, full report. We don't even get the full report. I've seen a full report before and it's 300 plus pages. ⁓ It's a lot of data. So to get that down, I think the shortest one we've had is eight and the longest one we've had is like 14 pages. It tells us everything. ⁓ That for our assessments program, even for mobile apps, we get it in, we get a request in. First thing we do is kind of look at it and go, this is an enterprise related, we probably shouldn't go forward. Let's have them find something that's more enterprise related. ⁓ and then a task is opened and we mail Jamf support and was like, hey, scan this app. ⁓ We get back this gigantic report of all the data and we put it into the task. And then when the team goes and talks about it, it goes through, you know, our security assurance. ⁓ I take a look at it from a standpoint of management. And then, you know, we have ⁓ other departments that'll go through it for compliance ⁓ and other security things. And then it goes to legal, ⁓ which I'm in those meetings too. And we have two attorneys assigned to check all of those. ⁓ And before we were having to do a lot more research. When you just have low media or high, you don't know everything. So we were having to load apps onto devices to look at terms and conditions. ⁓ We don't do that now. Like the report tells us everything. ⁓ So we've shrunk down like a 45 day process to pretty short. Like sometimes it's around 30 days because we do have a lot of assessments because we assess everything at this point. ⁓ But for the most part, we're getting that shrunk down pretty quick. Like we wanna be at a turnaround of like a couple of weeks for these. And the reason we do that is that apps aren't a free for all at Travis County at all. You have to request it, it has to be approved. There are things. laws that the state has in place that we have to follow. So there are times where people are like, well, we still want the app, we'll take the risk. It goes into our risk registry, it does happen. ⁓ And for the most part, we don't reject, I think we've had close to 50 requests in the last three years. And we've only rejected probably like, maybe we're from two to four, somewhere in that range. ⁓ And some of that, most of that is just like, that's not an enterprise app. You can't have that. ⁓ You know, we need to find something that's enterprise based, but to be able to go through something like that and then say, okay, well, we verified this app is safe. So we can load it on the devices and it's not a worry. It's not something we're having to think about all the time. It's, you know, we have the data in front of us that says, hey, this app is safe. you know, and you can put it on your devices and you're not going to have to worry and you're not going to run a foul of state law for, you know, contracts and accepting terms and conditions, which I didn't even know was a thing until we got into this. Like we really didn't. We didn't know that the state had all these rules on accepting terms and conditions. ⁓ you know, I've learned a lot from our legal team on that things I just didn't know. And I think overall it makes us more secure. So again, You know, it's not just for us, it's not just about managing the device the right way and the way to keep us safe. It's really the security aspect overall. And that's what Jamf gives us. Like it's not just we're securing the devices. We're also making sure the apps are secure and that, you know, the legal terms are acceptable. So Jamf provides us a lot, makes our lives a lot easier, a lot easier.
Josh Thornton: That's a mic drop right there. ⁓ You know, you can't ⁓ end any any better than that. Well, Billy, thank you so much for your time and for sharing your story. And honestly, just the amazing work y'all are doing. I think it serves as a model, hopefully for a lot of organizations out there, government and private and even education institutions. So appreciate you being here today.
Billy Roberts: Ha ha ha ha. Yeah, I appreciate it. As soon as I was asked, I was like, yes, I'm doing the podcast. I'm like, is this going to be so much fun? Like, I want to do this so bad.
Josh Thornton: Well, we are glad that you were able to join us today. And if you got some more cool stories, maybe we'll do a comeback session.
Jamf Kat: Thank you so much.
Billy Roberts: Thank you.
Josh Thornton: As always, y'all, appreciate you tuning in and listening. Jamf After Dark is a podcast from Jamf in copyright 2026. All rights are reserved. Technical details and product offerings, they can change at any time. So always check Jamf.com for the latest info on our products and services.
Jamf Kat: You can reach out to us if you have questions or comments or suggested show topics or even fan mail. Simply send a friendly email to info at jamf.com with the subject line, attention to the podcast. We're also a sponsor of the MacAdmins Foundation and several jams are available on the MacAdmins Slack channel. And of course, if you need support, visit Jamf account to start a conversation or open a ticket to get your technical questions answered.
Josh Thornton: And again, special thanks to our guests this week. Billy, you were awesome. And also for our audio and video engineers, Merlin and Martin, who help us look and sound great. Until next time, for Cat Garbus, I'm Josh Thornton.
Jamf Kat: And for Josh Thornton, I'm Kat Garbus. We'll catch you after dark again. Thank you for listening. Good night, good morning, good afternoon, and don't forget to secure your mobile devices.
