BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

4.5 Disposal

NIST platform security: roots of trust, firmware and secure enclaves SP 800-124 Rev. 1
All changes in this version
first version loaded 4 Applications part of 4

Title

Disposal

Control

Before a mobile device component permanently leaves an organization (such as when a leased server’s lease expires or when an obsolete mobile device is being recycled) or is reassigned to another user, the organization should remove any sensitive data from the mobile device. The task of scrubbing all sensitive data from storage devices such as hard drives and memory cards is often surprisingly difficult because of all the places where such data resides and the increasing reliance on flash memory instead of magnetic disks. See NIST SP 800-88, Guidelines for Media Sanitization [SP800-88], for additional information and recommendations on removing data from mobile devices.

security of the mobile devices, such as if they are “stuck” on a known vulnerable OS version that cannot be updated. Organizations should carefully consider the risks of using devices with outdated OS versions. Appendix A—Supporting NIST SP 800-53 Security Controls and Publications

The major controls in the NIST Special Publication 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations control catalog that affect enterprise mobile device security are:

AC-3 , Access Enforcement Related controls: AC-2, AC-4, AC-5, AC-6, AC-16, AC-17, AC-18, AC-19, AC-20, AC-21, AC-22, AU-9, CM-5, CM-6, CM-11, MA-3, MA-4, MA-5, PE-3 AC-4 , Information Flow Enforcement Related controls: AC-3, AC-17, AC-19, AC-21, CM-6, CM-7, SA-8, SC-2, SC-5, SC-7, SC-18 AC-17 , Remote Access Related controls: AC-2, AC-3, AC-18, AC-19, AC-20, CA-3, CA-7, CM-8, IA-2, IA-3, IA-8, MA-4, PE- 17, PL-4, SC-10, SI-4 References: NIST Special Publications 800-46, 800-77, 800-113, 800-114, 800-121 AC-18 , Wireless Access Related controls: AC-2, AC-3, AC-17, AC-19, CA-3, CA-7, CM-8, IA-2, IA-3, IA-8, PL-4, SI-4 References: NIST Special Publications 800-48, 800-94, 800-97 AC-19 , Access Control for Mobile Devices Related controls: AC-3, AC-7, AC-18, AC-20, CA-9, CM-2, IA-2, IA-3, MP-2, MP-4, MP-5, PL-4, SC-7, SC-43, SI-3, SI-4 References: NIST Special Publications 800-114, 800-124 AC-20 , Use of External Information Systems Related controls: AC-3, AC-17, AC-19, CA-3, PL-4, SA-9 References: FIPS Publication 199 AT-2 , Security Awareness Training Related controls: AT-3, AT-4, PL-4 References: NIST Special Publication 800-50 AU-2 , Audit Events Related controls: AC-6, AC-17, AU-3, AU-12, MA-4, MP-2, MP-4, SI-4 References: NIST Special Publication 800-92; http://csrc.nist.gov/pcig/cig.html ; http://idmanagement.gov CA-7 , Continuous Monitoring Related controls: CA-2, CA-5, CA-6, CM-3, CM-4, PM-6, PM-9, RA-5, SA-11, SA-12, SI-2, SI-4 References: NIST Special Publications 800-37, 800-39, 800-53A, 800-115, 800-137; US-CERT Technical Cyber Security Alerts; DOD Information Assurance Vulnerability Alerts CM-6 , Configuration Settings Related controls: AC-19, CM-2, CM-3, CM-7, SI-4 References: OMB Memoranda 07-11, 07-18, 08-22; NIST Special Publications 800-70, 800-128; http://nvd.nist.gov ; http://checklists.nist.gov/ , http://www.nsa.gov IA-2 , Identification and Authentication (Organizational Users) Related controls: AC-2, AC-3, AC-14, AC-17, AC-18, IA-4, IA-5, IA-8 References: HSPD 12; OMB Memorandum 04-04, 06-16, 11-11; FIPS Publication 201; NIST Special Publications 800-63, 800-73, 800-76, 800-78; FICAM Roadmap and Implementation Guidance; http://idmanagement.gov/ IA-3 , Device Identification and Authentication Related controls: AC-17, AC-18, AC-19, CA-3, IA-4, IA-5 IA-5 , Authenticator Management Related controls: AC-2, AC-3, AC-6, CM-6, IA-2, IA-4, IA-8, PL-4, PS-5, PS-6, SC-12, SC-13, SC-17, SC-28 References: OMB Memorandum 04-04, 11-11; FIPS Publication 201; NIST Special Publications 800-73, 800-63, 800-76, 800-78 ; FICAM Roadmap and Implementation Guidance; http://idmanagement.gov/ MP-6 , Media Sanitization Related controls: MA-2, MA-4, RA-3, SC-4 References: FIPS Publication 199; NIST Special Publications 800-60, 800-88; http://www.nsa.gov/ia/guidance/media_destruction_guidance/index.shtml SC-4 , Information in Shared Resources Related controls: AC-3, AC-4, MP-6 SC-7 , Boundary Protection Related controls: AC-4, AC-17, CA-3, CM-7, CP-8, IR-4, RA-3, SC-5, SC-13 References: FIPS Publication 199; NIST Special Publications 800-41, 800-77 SC-8 , Transmission Confidentiality and Integrity Related controls: AC-17, PE-4 References: FIPS Publications 140-2, 197; NIST Special Publications 800-52, 800-77, 800-81, 800-113; CNSS Policy 15; NSTISSI No. 7003 SC-28 , Protection of Information at Rest Related controls: AC-3, AC-6, CA-7, CM-3, CM-5, CM-6, PE-3, SC-8, SC-13, SI-3, SI-7 References: NIST Special Publications 800-56, 800-57, 800-111 SI-2 , Flaw Remediation Related controls: CA-2, CA-7, CM-3, CM-5, CM-8, MA-2, IR-4, RA-5, SA-10, SA-11, SI-11 References: NIST Special Publication 800-40, 800-128 SI-4 , Information System Monitoring Related controls: AC-3, AC-4, AC-8, AC-17, AU-2, AU-6, AU-7, AU-9, AU-12, CA-7, IR-4, PE-3, RA- 5, SC-7, SC-26, SC-35, SI-3, SI-7 References: NIST Special Publications 800-61, 800-83, 800-92, 800-94, 800-137 SI-7 , Software, Firmware, and Information Integrity Related controls: SA-12, SC-8, SC-13, SI-3 References: NIST Special Publications 800-147, 800-155

Information on these controls and guidelines on possible implementations can be found in the following publications:
• SP 800-37 Rev. 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach
• Draft SP 800-40 Rev. 3, Guide to Enterprise Patch Management Technologies
• SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy
• SP 800-46 Rev. 1, Guide to Enterprise Telework and Remote Access Security
• SP 800-52, Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations
• SP 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations
• SP 800-53A Rev. 1, Guide for Assessing the Security Controls in Federal Information Systems and Organizations
• SP 800-57, Recommendation for Key Management
• SP 800-61 Rev. 2, Computer Security Incident Handling Guide
• SP 800-63 Rev. 1, E-Authentication Guideline
• SP 800-70 Rev. 2, National Checklist Program for IT Products: Guidelines for Checklist Users and Developers
• SP 800-73-3, Interfaces for Personal Identity Verification
• Draft SP 800-76-2, Biometric Data Specification for Personal Identity Verification
• SP 800-77, Guide to IPsec VPNs
• SP 800-78-3, Cryptographic Algorithms and Key Sizes for Personal Identification Verification (PIV)
• SP 800-81 Rev. 1, Secure Domain Name System (DNS) Deployment Guide
• Draft SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling
• SP 800-92, Guide to Computer Security Log Management
• Draft SP 800-94 Rev. 1, Guide to Intrusion Detection and Prevention Systems (IDPS)
• SP 800-111, Guide to Storage Encryption Technologies for End User Devices
• SP 800-113, Guide to SSL VPNs
• SP 800-114, User's Guide to Securing External Devices for Telework and Remote Access
• SP 800-121 Rev. 1, Guide to Bluetooth Security
• SP 800-128, Guide for Security-Focused Configuration Management of Information Systems
• FIPS 140-2, Security Re quirements for Cryptographic Modules
• FIPS 197, Advanced Encryption Standard
• FIPS 199, Standards for Security Categorization of Federal Information and Information Systems
• FIPS 201-1, Personal Identity Verification (PIV) of Federal Employees and Contractors Appendix B—Acronyms and Abbreviations

Selected acronyms and abbreviations used in this publication are defined below.

BYOD Bring Your Own Device CMVP Cryptographic Module Validation Program DLP Data Loss Prevention FIPS Federal Information Processing Standard FISMA Federal Information Security Management Act GAO Government Accountability Office GPS Global Positioning System IT Information Technology ITL Information Technology Laboratory MDM Mobile Device Management NIST National Institute of Standards and Technology OMB Office of Management and Budget PII Personally Identifiable Information PIN Personal Identification Number QR Quick Response SP Special Publication TPM Trusted Platform Module VPN Virtual Private Networking Wi-Fi Wireless Fidelity WPAN Wireless Personal Area Network Appendix C—Resources

The lists below provide examples of resources that may be helpful in better understanding mobile device security.

[FIPS140-2] FIPS 140-2, Security Requirements for Cryptographic Modules , May 2001. http://csrc.nist.gov/publications/PubsFIPS.html#140-2

[FIPS199] FIPS 199, Standards for Security Categorization of Federal Information and Information Systems , 2004. http://csrc.nist.gov/publications/PubsFIPS.html#199

[GAO-12-757] GAO-12-757, Information Security: Better Implementation of Controls for Mobile Devices Should Be Encouraged , September 2012. http://www.gao.gov/assets/650/648519.pdf

[SP800-21] NIST SP 800-21-1, Guideline for Implementing Cryptography in the Federal Government, Second Edition , 2005. http://csrc.nist.gov/publications/PubsSPs.html#800-21

[SP800-53] NIST SP 800-53 Revision 4, Security and Privacy Controls for Federal Information Systems and Organizations , 2013. http://csrc.nist.gov/publications/PubsSPs.html#800-53

[SP800-61] NIST SP 800-61 Revision 2, Computer Security Incident Handling Guide , 2008. http://csrc.nist.gov/publications/PubsSPs.html#800-61

[SP800-88] NIST SP 800-88 Revision 1, Guidelines for Media Sanitization , 2012. http://csrc.nist.gov/publications/PubsSPs.html#800-88

[SP800-111] NIST SP 800-111, Guide to Storage Encryption Technologies for End User Devices , 2007. http://csrc.nist.gov/publications/PubsSPs.html#800-111

[SP800-114] NIST SP 800-114, User’s Guide to Securing External Devices for Telework and Remote Access , 2007. http://csrc.nist.gov/publications/PubsSPs.html#800-114

[SP800-115] NIST SP 800-115, Technical Guide to Information Security Testing and Assessment , 2008. http://csrc.nist.gov/publications/PubsSPs.html#800-115

[SP800-121] NIST SP 800-121 Revision 1, Guide to Bluetooth Security , 2012. http://csrc.nist.gov/publications/PubsSPs.html#800-121

[SP800-122] NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) , 2010. http://csrc.nist.gov/publications/PubsSPs.html#800-122

Mobile Device Security-Related Checklist Sites

Site URL DISA Security Technical Implementation Guides (STIGs) http://iase.disa.mil/stigs/index.html

DISA Wireless (Smartphone/Tablet) STIGs http://iase.disa.mil/stigs/net_perimeter/wireless/smartphone.html NIST National Checklist Program Repository http://web.nvd.nist.gov/view/ncp/repository