BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.1.1 Restrictions on Mobile Devices and Access Levels

NIST platform security: roots of trust, firmware and secure enclaves SP 800-124 Rev. 1
All changes in this version
first version loaded 4 Applications part of 4.1

Title

Restrictions on Mobile Devices and Access Levels

Control

An organization’s mobile device security policy often limits the types of mobile devices that may be used for enterprise access; this is done for a variety of reasons, including security concerns and technology limitations. For example, an organization might permit only organization-owned mobile devices to be used. Some organizations have tiered levels of access, such as allowing organization-issued mobile devices to access many resources, BYOD mobile devices running the organization’s mobile device management client software to access a limited set of resources, and all other BYOD mobile devices to access only a few web-based resources, such as email. This allows an organization to limit the risk it incurs by permitting the most-controlled devices to have the most access and the least-controlled devices to have only minimal access. Some organizations also maintain lists of approved mobile devices (by operating system version, by brand/model of phone, etc.)

Each organization should make its own risk-based decisions about what levels of access should be permitted from which types of mobile devices. Factors that organizations should consider when setting mobile device security policy for this include the following:

 Sensitivity of work. Some work involves access to sensitive information or resources, while other work does not. Organizations may have more restrictive requirements for work involving sensitive information, such as permitting only organization-issued devices to be used. Organizations should also be concerned about the issues involved in remotely scrubbing sensitive information from BYOD mobile devices (see Section 4.5 for more information on data scrubbing).

 The level of confidence in security policy compliance. Meeting many of an organization’s security requirements can typically be ensured only if the organization controls the configuration of the mobile devices. For devices not running the organization’s mobile device management client software, some requirements can possibly be verified by automated security health checks conducted by the mobile device management server when mobile devices attempt to connect, but other requirements cannot be verified. Organizations may decide to require mobile devices to run the specified mobile device management software.

 Cost. Costs associated with mobile devices will vary based on policy decisions. The primary direct cost from a security perspective is issuing mobile devices and client software. There are also indirect costs in maintaining the security of mobile devices and in providing security-related technical support for users.

 Work location. Risks will generally be lower for devices used only in the enterprise environment than for devices used in a variety of locations.

 Technical limitations. Certain types of mobile devices or operating systems may be needed, such as for running a particular application. Also, an organization’s mobile device management client software may only support certain types of mobile devices (e.g., particular operating system versions).  Compliance with mandates and other policies. Organizations may need to comply with mobile device-related requirements from mandates and other sources, such as a Federal department issuing policy requirements to its member agencies. An example of a possible requirement is restrictions on using mobile devices in foreign countries that have strong known threats against Federal agency systems; in such cases, it may be appropriate to issue “loaner” mobile devices or to prohibit mobile device use altogether.

Organizations may choose to specify additional security requirements that are tied to factors such as the sensitivity of work. Many organizations require more stringent security controls for work situations that are particularly high-risk, such as permitting the work only from organization-issued and secured mobile devices, and requiring the use of multi-factor authentication for access to the mobile device and to enterprise resources. Another possible security control is to migrate high-risk resources to servers that assume responsibility for protecting them; for example, a mobile device could connect to a server that holds sensitive data that the user needs to access, instead of the sensitive data being stored locally on the mobile device. In high-risk situations, organizations may also choose to reduce risk by prohibiting mobile devices from accessing particular types of information, such as sensitive personally identifiable information (PII). 8

There are frequent changes in mobile device capabilities, the security controls available to organizations, the types of threats made to different types of devices, and so on. Therefore, organizations should periodically reassess their policies for mobile devices and consider changing which types of mobile devices are permitted, what levels of access they may be granted, and which security controls are required. Organizations should also be aware of the emergence of new types of mobile device solutions and of major changes to existing mobile device management technologies, and ensure that the organization’s policies are updated accordingly as needed.