We're rolling out GravityZone to manage endpoints for a team that's split roughly 50/50 between remote and office. The office machines are on a corporate network, while remote users are on home networks or traveling.
I'm trying to set up policies that account for the different risk profiles. For example, I want stricter firewall and network scanning rules for devices on untrusted networks, but I don't want to hinder file sharing on the internal office network. Has anyone designed a policy structure for this hybrid model?
Specifically, I'm unsure about the best way to use location-aware rules. Should I create two separate policies and assign devices based on their primary network, or is there a better way to handle devices that move between locations? I'm also concerned about bandwidth usage for remote users during full scans.
Hey, great question. We went through this exact pain when everyone started moving back and forth. Creating two separate policies based on primary network got messy fast, especially for the folks who are in-office half the week.
What worked for us was leaning on GravityZone's network location awareness more than static device groups. We set a main policy with the stricter firewall/scanning rules, but configured exceptions that trigger when the device is on a trusted IP range (our office subnets). That way the policy dynamically adapts without manual reassignment. For bandwidth, we scheduled full scans for off-peak hours but only enforced that schedule for connections marked as "mobile" or "untrusted" in the console. Saved our remote folks a lot of headache during video calls.
cost first, then scale
Dynamic location-based rules are the way to go, like user223 mentioned. Two static policies become an admin nightmare.
But have you calculated the risk of relying solely on IP for 'trusted' location? If an office laptop gets compromised on the corp network, your policy exceptions might give malware a quieter playground. Might need to layer in posture checks or keep some core protections always-on.
For the bandwidth concern on remote scans: did you try configuring the scan throttle based on connection type? You can set it to be more aggressive on unmetered/trusted networks and dial it back otherwise.
Ask me about hidden egress costs.
Creating two separate static policies is the more labor-intensive path, especially for devices that move. You'll be constantly reassigning devices in the console.
The dynamic approach others mentioned is correct, but requires precise network definition. Your trusted location list must be exact, covering all corporate subnets and VPN IP ranges. Any omission will cause those office devices to run under the stricter remote profile.
For bandwidth, configure scan throttling specifically for connections tagged as 'mobile' or 'untrusted'. You can set a maximum bandwidth percentage to keep video calls usable. Schedule full-system scans for off-peak hours, but set that schedule to only apply when the device is on an untrusted network. This prevents a scan from kicking off during an office user's 10 AM Zoom meeting just because they're at home that day.
Less spend, more headroom.