BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.2 Development

NIST platform security: roots of trust, firmware and secure enclaves SP 800-124 Rev. 1
All changes in this version
first version loaded 4 Applications part of 4

Title

Development

Control

Once the organization has established a mobile device security policy, identified mobile device needs, and completed other preparatory activities, the next steps are to determine which types of mobile device management technologies should be used and to design a solution to deploy. There are many considerations for designing a solution, most of which are generally applicable to any IT technology;

8 For more information on protecting PII, see NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) [SP800-122]. some of these are covered in Section 3 of this document and others in NIST SP 800-53 [SP800-53]. This section focuses on the technical security considerations that are most important for designing mobile device management solutions. Major considerations include the following:

 Architecture. Designing the architecture includes the selection of mobile device management server and client software, the placement of the mobile device management server and other centralized elements, and the architecture of any virtual private network (VPN) solutions.

 Authentication. Authentication involves selecting device and/or user authentication methods, including determining procedures for issuing and resetting authenticators and for provisioning users and/or client devices with authenticators (see “Device provisioning” below). Authentication includes access to or integration with existing enterprise authentication systems.

 Cryptography. Decisions related to cryptography include selecting the algorithms for encryption and integrity protection of mobile device communications, and setting the key strength for algorithms that support multiple key lengths. 9 Federal agencies must use FIPS-approved algorithms contained in validated cryptographic modules when using cryptography to protect information. 10

 Configuration requirements. This involves setting minimum security standards for mobile devices, such as mandatory host hardening measures and patch levels, and specifying additional security controls that must be employed on the mobile device, such as a VPN client.

 Device provisioning. It is important to determine how both new and existing devices will be provisioned with client software, authenticators, configuration settings, etc.

 Application vetting and certification requirements. This sets security, performance, and other requirements that applications must meet and determines how proof of compliance with requirements must be demonstrated.

The security aspects of the mobile device solution design should be documented in the system security plan. The organization should also consider how incidents involving the mobile device solutions should be handled and document those plans as well. 11