Mobile Device Management: Key Components, V1.0

More documents

Recommendations

Info

CLOUD SECURITY ALLIANCE Mobile Device Management: Key Components, V1.0, September 2012an automated workflow should be initiated that remotely wipes the device and revokes particular access rights.Then, a new device should be provisioned, with appropriate pre-load and configuration prior delivery to theuser). Process automation also includes technical tasks such as backup restore, as well as procedural taskswhere human attestation is required (i.e. management sign-off for the order).2.14 User Activity Logging / Workplace Monitoring Rating: Must HaveMore and more organizations are turning to workplace monitoring 3 and data loss prevention (DLP) technology.Workplace monitoring is usually governed by a variety of privacy laws, rules, and regulations. In some countries,the laws on telecommunications regulate the monitoring of email and other electronic communications. Inother countries, an employer’s rights to monitor employee communications may be governed by collectivebargaining agreements, employment contracts, or general privacy and data protection legislation. It isimportant to understand that privacy is treated as a fundamental human right and, as such, cannot be bargainedaway. This becomes more complex with environments with both corporate supplied and BYOD devices wherelaws and regulations are significantly different. Organizations are highly recommended to seek legal counsel tounderstand the privacy and data protection laws of the individual countries in which they operate.2.15 Security Settings Rating: Must HaveAccording to company policy, security settings provide advanced security on devices irrespective of ownership.They set, deploy, and update settings like passwords, wipe, and application/resource restrictions, usuallywithout any user intervention. Security can be broken into two basic components; user security and datasecurity. While user and data security are tightly coupled there are some distinct differences which must beaccounted for and sometimes handled quite differently. In both cases companies must take steps to protectthe user and the data from potential threats.2.16 Selective Wipe / Remote Wipe / Lock Rating: Must HaveSelective wipe securely wipes the corporate data from a personal device, without touching the personal data,music, and apps. It will also delete documents from the user’s Content Library. If a device is lost or stolen, aremote wipe must be performed by either the administrator or the end user. The remote wipe will, in effect,wipe all information from the device returning it to factory default configuration. Similarly a Lock can beperformed on a device by the administrator or end user to ensure that protection is in place should the devicebecome temporarily misplaced. If the wrong password is entered multiple times, an automatic wipe will betriggered.2.17 Identity Management / Authentication / Encryption Rating: Must HaveIdentity management, authentication, and encryption involved management of strong encryption of local data(device memory, external memory cards) and data in motion (such as email S/MIME encryption and3 The term “monitoring” is used broadly to refer to any reading, collection, or storage of electronic communications. Monitoring is,therefore, more than the interception of communications in transit. Copying of employee emails for backups or scanning messages todetect viruses are both considered to be monitoring.© Copyright 2012, Cloud Security Alliance. All rights reserved. 9
CLOUD SECURITY ALLIANCE Mobile Device Management: Key Components, V1.0, September 2012authentication). It requires certificate distribution capabilities and certificate-based authentication (includingdevice ID, OS version, phone number) to identify the device and user properly. Strong certificate-basedauthentication enables secure access to corporate email, web-based applications, VPN and Wi-Fi. It comesalong with overlaying identity management processes and mechanisms by which enterprise employees areissued accounts and credentials required to provide access to the device, the business applications and servicesbased on a context-aware policy that includes who they are, their role, their device, their network and theirinformation and application. It could also enables employees access to cloud applications and services onmobile devices via single sign-on credentials and identity brokering to authenticate to third-party SaaS.© Copyright 2012, Cloud Security Alliance. All rights reserved. 10
Page 1 and 2: Mobile Device Management:Key Compon
Page 3 and 4: CLOUD SECURITY ALLIANCE Mobile Devi
Page 9: CLOUD SECURITY ALLIANCE Mobile Devi

Mobile Device Management: Key Components, V1.0

Create successful ePaper yourself

Delete template?

Save as template?