|
|
The National Cybersecurity Center of Excellence* (NCCoE) is addressing the challenge of mobile device security through collaborative efforts with industry and the information technology (IT) community, including vendors of cybersecurity solutions. Recently the NCCoE released Special Publication 1800-4 to provide explanations, examples, and guidance that organizations can use to better protect data on, or accessible by, mobile devices.
Extract from NIST Special Publication 1800-4
Challenge
Information technology (IT) environments have changed drastically because of the increasing popularity of smartphones, tablets, and other highly capable, rapidly maturing mobile devices. These devices have many functional similarities to traditional IT systems — including access to a wide range of enterprise applications and data, as well as additional functionality particular to mobile computing. This has greatly expanded the utility and value of mobile devices, enabling employees to do their jobs more effectively and efficiently. Unfortunately, security controls have not kept pace with the security risks that mobile devices can pose, not only in bring your own device (BYOD) scenarios but also in corporately owned and personally enabled (COPE) mobile device deployments, where mobile devices are adopted on an ad hoc basis. This gap in protection mechanisms means that data stored on or accessed from mobile devices is at increased risk of being breached.
For example, suppose that an organization has enabled mobile access to its email, calendaring, and contact management services regardless of the origin of the employeesʼ mobile devices (organization- owned and employee-owned, organization-provisioned and employee-provisioned, etc.). If sensitive data is stored on a poorly secured mobile device that is lost or stolen, an attacker may be able to readily gain unauthorized access to that data. Even worse, a mobile device with remote access to sensitive organizational data could be leveraged by an attacker to gain unauthorized access to not only that data but also any other data that the user can access from a mobile device.
Solution
The NIST cybersecurity practice guide Mobile Device Security: Cloud and Hybrid Builds demonstrates how commercially available technologies can meet your organization’s needs to secure sensitive enterprise data accessed by and/or stored on employees’ mobile devices.
The document proposes a reference design on how to architect enterprise-class protection for mobile devices accessing corporate resources. The example solutions presented can be used by any organization implementing an enterprise mobility management solution. This project contains two distinct builds: cloud and hybrid. The cloud build makes use of cloud-based services and solutions, while the hybrid build achieves the same functionality but hosts the data and services within an enterpriseʼs own infrastructure. The example solutions and architectures presented are based upon standards-based, commercially available products.
Complete Guide
NIST.SP.1800-4Read the complete guide documentation at Mobile Device Security: Cloud and Hybrid Builds
*The National Cybersecurity Center of Excellence (NCCoE), a part of the National Institute of Standards and Technology (NIST), is a collaborative hub where industry organizations, government agencies, and academic institutions work together to address businesses’ most pressing cybersecurity challenges. Through this collaboration, the NCCoE develops modular, easily adaptable example cybersecurity solutions demonstrating how to apply standards and best practices using commercially available technology.
Additional Reading
Source: ComplexDiscovery
