# Sector-Specific Incident Playbooks: High-Stakes Automation with Hexnode UEM

In regulated industries, a “security incident” isn’t just a technical glitch—it is a legal and operational crisis. Manual intervention is often too slow to prevent a data leak or a physical theft. This document outlines how to transform Hexnode UEM into an automated rapid-response engine using **Dynamic Groups**, **Geofences**, and **Real-Time Remediation**.

By moving from reactive monitoring to proactive policy enforcement, organizations can ensure that devices defend themselves the moment a boundary is crossed or a hardware state is altered.

**Playbook 1: Healthcare – The “Zero-Privacy Leak” Ward**
---------------------------------------------------------

### Scenario: Camera Policy Breach in Restricted Clinical Zones

**The Threat**: A tablet used for patient records enters a restricted surgical ward or psychiatric unit. If the camera remains active, it risks the accidental capture of **Protected Health Information (PHI)** or patient faces, leading to severe HIPAA/GDPR violations and legal liability.

### **The Hexnode Setup**

1. **Define the Perimeter**: Navigate to **Admin > Geofencing**. Create a **Polygon Fence** around the specific ward coordinates for high precision.
2. ****Automate Membership****: 
    - Go to **Manage > Device Groups > New Dynamic Group**.
    - Under Choose Condition filters, set the criteria **Device info + Location tracking + Is + Enabled**.
    - Save the group.
3. **Enforce the “Stealth” Policy**: 
    1. Create a policy under **Policies > [Platform] > Restrictions**.
    2. **Disable Camera**: Uncheck “Allow Camera”.
    3. **Disable External Storage**: Uncheck “USB/SD Card access” to prevent data offloading.
    4. **Associate**: Link this policy to the Dynamic Group.
4. **Remediation**: If the device enters the zone, the camera hardware is electronically disabled within seconds. If the user attempts to bypass the agent, Hexnode marks the device **Non-Compliant** and sends an alert to the HIPAA compliance officer via **Admin > Alert Profiles**.

**Playbook 2: Logistics – High-Value Asset “Corridor Guard”**
-------------------------------------------------------------

### Scenario: Unapproved SIM Change on Banking Terminals

**The Threat**: A logistics terminal attached to high-value cargo (e.g., pharmaceuticals or electronics) exits its assigned “Safe Corridor.” This deviation suggests a potential hijacking, unauthorized stop, or theft of the vehicle. An immediate reporting of the incident is required to prevent further escalation.

### **The Hexnode Setup:**

**Define a Geofence around sensitive clinical zones.**

1. **The Safe Corridor**: In **Admin > Geofencing**, create a fence representing the route.
2. **Tracking Escalation**: 
    - Under **Policies > General Settings > Location Tracking**, set the Location Update Interval to the highest frequency (e.g., 15 minutes).
     Note: 
    For real-time updates during a breach, use the **Scan Device Location** action.
3. **The “Red Alert” Workflow**: 
    1. Create a **Dynamic Group** where the criteria is Location + Is Outside + [Shipping Corridor].
    2. **The Action**: Apply an **[automation](https://www.hexnode.com/mobile-device-management/help/initiate-automation/)** that locks the device to a single screen displaying: “*Unauthorized Route Detected. Vehicle Tracking Active. Contact Dispatch Immediately.*“
4. **Fail-Safe**: Configure a Remote Action by executing an automation or the dashboard to **Enterprise Wipe** sensitive delivery manifests if the device remains outside the corridor for more than 30 minutes.

**Playbook 3: Finance – SIM-Swap Fraud Prevention**
---------------------------------------------------

### Scenario: Unapproved SIM Change on Banking Terminals

**The Threat**: A mobile point-of-sale (mPOS) terminal or an executive’s device undergoes an unauthorized SIM swap. This is often a precursor to **SIM Swap Fraud**, where attackers intercept Multi-Factor Authentication (MFA) codes to bypass banking security layers.

### **The Hexnode Setup**

1. **Event Capture**: Use **Automate > New Automation** (Hexnode’s automated task engine).
2. **The Trigger**: Select “**On SIM Insertion**” as the automation event.
3. **The Instant Action**: 
    - Select **Enable Lost Mode** (for iOS and Android).
    - This action immediately locks the UI with a custom message: “*Hardware Tamper Detected. Device Locked. Please contact the Bank Security Operations Center*.”
4. **Network Isolation**: 
    - Configure an **Alert Profile** in **Admin > Alert Profile** to notify the SOC via email/SMS when a “SIM Changed” event occurs.
    - Execute an automation to automatically revoke VPN and Wi-Fi Profiles associated with the device by the removal of the corresponding network policies, thereby preventing the unauthorized SIM from accessing the corporate intranet.