Mobile Device Management (MDM): Enterprise Security (2026...

#!/usr/bin/env python3
"""
MDM Device Management System
Production-ready MDM implementation with error handling.
"""

from typing import List, Dict, Optional
from dataclasses import dataclass
from enum import Enum
import logging

logger = logging.getLogger(__name__)

class DeviceStatus(Enum):
    ENROLLED = "enrolled"
    PENDING = "pending"
    NON_COMPLIANT = "non_compliant"
    LOCKED = "locked"

@dataclass
class Device:
    device_id: str
    user_id: str
    platform: str
    status: DeviceStatus
    enrolled_at: str
    last_seen: str
    compliance_status: bool

class MDMManager:
    """MDM device management system."""
    
    def __init__(self):
        self.devices: Dict[str, Device] = {}
    
    def enroll_device(self, device_id: str, user_id: str, platform: str) -> bool:
        """Enroll device in MDM."""
        try:
            device = Device(
                device_id=device_id,
                user_id=user_id,
                platform=platform,
                status=DeviceStatus.ENROLLED,
                enrolled_at=datetime.now().isoformat(),
                last_seen=datetime.now().isoformat(),
                compliance_status=True
            )
            self.devices[device_id] = device
            logger.info(f"Device {device_id} enrolled successfully")
            return True
        except Exception as e:
            logger.error(f"Enrollment failed: {e}")
            return False
    
    def check_compliance(self, device_id: str) -> bool:
        """Check device compliance."""
        device = self.devices.get(device_id)
        if not device:
            return False
        return device.compliance_status
    
    def apply_policy(self, device_id: str, policy: Dict) -> bool:
        """Apply policy to device."""
        device = self.devices.get(device_id)
        if not device:
            return False
        
        # Apply policy settings
        # In production, would push policy to device via MDM protocol
        logger.info(f"Policy applied to device {device_id}")
        return True
    
    def remote_wipe(self, device_id: str) -> bool:
        """Initiate remote wipe."""
        device = self.devices.get(device_id)
        if not device:
            return False
        
        # In production, would send wipe command via MDM protocol
        logger.warning(f"Remote wipe initiated for device {device_id}")
        return True

#!/usr/bin/env python3
"""
MDM Policy Management System
Production-ready policy configuration and enforcement
"""

from typing import List, Dict, Optional
from dataclasses import dataclass, field, asdict
from enum import Enum
from datetime import datetime
import json
import logging

logger = logging.getLogger(__name__)

class PolicyType(Enum):
    """Policy types."""
    PASSWORD = "password"
    ENCRYPTION = "encryption"
    APP_RESTRICTION = "app_restriction"
    NETWORK = "network"
    DEVICE = "device"

@dataclass
class Policy:
    """MDM policy definition."""
    policy_id: str
    name: str
    policy_type: PolicyType
    configuration: Dict
    enabled: bool = True
    created_at: datetime = field(default_factory=datetime.now)
    updated_at: datetime = field(default_factory=datetime.now)
    
    def to_dict(self) -> Dict:
        """Convert to dictionary."""
        return {
            **asdict(self),
            'policy_type': self.policy_type.value,
            'created_at': self.created_at.isoformat(),
            'updated_at': self.updated_at.isoformat()
        }

class PolicyManager:
    """MDM policy management system."""
    
    def __init__(self):
        self.policies: Dict[str, Policy] = {}
        self.device_policies: Dict[str, List[str]] = {}  # device_id -> [policy_ids]
    
    def create_policy(self, policy: Policy) -> bool:
        """Create new policy."""
        try:
            self.policies[policy.policy_id] = policy
            logger.info(f"Policy created: {policy.policy_id}")
            return True
        except Exception as e:
            logger.error(f"Failed to create policy: {e}")
            return False
    
    def assign_policy(self, device_id: str, policy_id: str) -> bool:
        """Assign policy to device."""
        if policy_id not in self.policies:
            logger.error(f"Policy {policy_id} not found")
            return False
        
        if device_id not in self.device_policies:
            self.device_policies[device_id] = []
        
        if policy_id not in self.device_policies[device_id]:
            self.device_policies[device_id].append(policy_id)
            logger.info(f"Policy {policy_id} assigned to device {device_id}")
        
        return True
    
    def get_device_policies(self, device_id: str) -> List[Policy]:
        """Get all policies for device."""
        policy_ids = self.device_policies.get(device_id, [])
        return [self.policies[pid] for pid in policy_ids if pid in self.policies]
    
    def validate_compliance(self, device_id: str, device_state: Dict) -> Dict:
        """Validate device compliance with policies."""
        policies = self.get_device_policies(device_id)
        violations = []
        
        for policy in policies:
            if not policy.enabled:
                continue
            
            # Check policy compliance
            if policy.policy_type == PolicyType.PASSWORD:
                if not self._check_password_policy(device_state, policy):
                    violations.append({
                        'policy_id': policy.policy_id,
                        'policy_name': policy.name,
                        'violation': 'Password policy not met'
                    })
            
            elif policy.policy_type == PolicyType.ENCRYPTION:
                if not self._check_encryption_policy(device_state, policy):
                    violations.append({
                        'policy_id': policy.policy_id,
                        'policy_name': policy.name,
                        'violation': 'Encryption not enabled'
                    })
        
        return {
            'device_id': device_id,
            'compliant': len(violations) == 0,
            'violations': violations
        }
    
    def _check_password_policy(self, device_state: Dict, policy: Policy) -> bool:
        """Check password policy compliance."""
        config = policy.configuration
        password_enabled = device_state.get('password_enabled', False)
        min_length = config.get('min_length', 4)
        password_length = device_state.get('password_length', 0)
        
        return password_enabled and password_length >= min_length
    
    def _check_encryption_policy(self, device_state: Dict, policy: Policy) -> bool:
        """Check encryption policy compliance."""
        return device_state.get('encryption_enabled', False)

# Example usage
if __name__ == "__main__":
    policy_manager = PolicyManager()
    
    # Create password policy
    password_policy = Policy(
        policy_id="POL-001",
        name="Strong Password Policy",
        policy_type=PolicyType.PASSWORD,
        configuration={
            'min_length': 8,
            'require_complexity': True,
            'max_age_days': 90
        }
    )
    policy_manager.create_policy(password_policy)
    
    # Assign to device
    policy_manager.assign_policy("DEV-001", "POL-001")
    
    # Check compliance
    device_state = {
        'password_enabled': True,
        'password_length': 10,
        'encryption_enabled': True
    }
    compliance = policy_manager.validate_compliance("DEV-001", device_state)
    print(f"Device compliant: {compliance['compliant']}")

#!/usr/bin/env python3
"""
Unit tests for MDM System
"""

import pytest
from datetime import datetime
from mdm_system import MDMManager, PolicyManager, Policy, PolicyType, DeviceStatus

class TestMDMManager:
    """Tests for MDMManager."""
    
    @pytest.fixture
    def manager(self):
        return MDMManager()
    
    def test_enroll_device(self, manager):
        """Test device enrollment."""
        result = manager.enroll_device("DEV-001", "USER-001", "iOS")
        assert result is True
        assert "DEV-001" in manager.devices
    
    def test_check_compliance(self, manager):
        """Test compliance checking."""
        manager.enroll_device("DEV-001", "USER-001", "iOS")
        compliant = manager.check_compliance("DEV-001")
        assert isinstance(compliant, bool)

class TestPolicyManager:
    """Tests for PolicyManager."""
    
    @pytest.fixture
    def policy_manager(self):
        return PolicyManager()
    
    def test_create_policy(self, policy_manager):
        """Test policy creation."""
        policy = Policy(
            policy_id="POL-001",
            name="Test Policy",
            policy_type=PolicyType.PASSWORD,
            configuration={'min_length': 8}
        )
        result = policy_manager.create_policy(policy)
        assert result is True
    
    def test_assign_policy(self, policy_manager):
        """Test policy assignment."""
        policy = Policy(
            policy_id="POL-001",
            name="Test Policy",
            policy_type=PolicyType.PASSWORD,
            configuration={}
        )
        policy_manager.create_policy(policy)
        result = policy_manager.assign_policy("DEV-001", "POL-001")
        assert result is True

if __name__ == "__main__":
    pytest.main([__file__, "-v"])

#!/usr/bin/env python3
"""
MDM System Cleanup
Production-ready cleanup and resource management
"""

import logging
from datetime import datetime, timedelta

logger = logging.getLogger(__name__)

class MDMCleanup:
    """Handles cleanup operations for MDM system."""
    
    def __init__(self, manager):
        """Initialize cleanup handler."""
        self.manager = manager
    
    def cleanup_inactive_devices(self, days: int = 90):
        """Remove devices inactive for specified days."""
        cutoff_date = datetime.now() - timedelta(days=days)
        removed_count = 0
        
        for device_id, device in list(self.manager.devices.items()):
            last_seen = datetime.fromisoformat(device.last_seen)
            if last_seen < cutoff_date:
                del self.manager.devices[device_id]
                removed_count += 1
        
        logger.info(f"Cleaned up {removed_count} inactive devices")
        return removed_count
    
    def cleanup(self):
        """Perform complete cleanup."""
        logger.info("Starting MDM cleanup")
        self.cleanup_inactive_devices()
        logger.info("MDM cleanup complete")