Nov 13 2008
Deploying Adobe AIR in a locked down enterprise environment
Disease:
Your (customers) IT organization is resistant in rolling out the Adobe AIR runtime throughout the organization because “it is not secure”. Your rich internet application on the desktop is at risk because the desktop administrators in the IT department have heard that AIR applications have access to the local file system, and more, and thus don’t want users to install those applications.
Prescription:
It is recommended to point these administrators to the Adobe AIR Administrator’s Guide which covers enterprise deployment and configuration of Adobe AIR.
We have found that not all desktop administrators are aware of the ability to ‘lock down’ the Adobe AIR runtime when deployed within their organization. They tend to think that once Adobe AIR has been deployed on the desktop, that all users can just install any application which has the potential to harm local resources. The guide covers most of these concerns (and if not, let us know!) and should help administrators to better identify and limit the risks involved, for example by only allowing trusted applications to run within their firewalls.
The guide outlines how on Windows, IT administrators can apply configuration settings using registry keys to prevent installation of all AIR applications, how they can only prevent installation of untrusted AIR applications and how to disable automatic updates of the AIR runtime updates. The Adobe AIR runtime can also be silently installed, AIR based applications can be silently installed and End User License Agreements can be centrally suppressed by IT administrators (who accept the agreement on the users behalf.
Tips to stay healthy:
Adobe’s devnet has a dedicated section discussing Adobe AIR for IT administrators. It features articles on centrally distributing Adobe AIR in the enterprise and the Adobe AIR Security Whitepaper alongside the previously mentioned Adobe AIR Administrators Guide.


