3.5 Security techniques for computing resources
📘CompTIA Security+ (SY0-701)
Introduction
Mobile devices such as smartphones, tablets, and laptops are commonly used in organizations. These devices store sensitive company data and connect to corporate networks, which makes them potential security risks if not properly managed.
To protect mobile devices and the data they access, organizations use mobile security solutions. These solutions include:
- Mobile Device Management (MDM)
- Different ownership and usage models like BYOD, COPE, and CYOD
- Securing different connection types
Understanding how each of these works is essential for the Security+ exam.
🔸 1. Mobile Device Management (MDM)
Definition:
Mobile Device Management (MDM) is a centralized software solution that allows IT administrators to secure, monitor, and manage mobile devices used within an organization.
MDM ensures that mobile devices follow company security policies and helps protect sensitive information, even when devices are used outside the office.
Key Functions of MDM:
- Device Enrollment
- Devices (smartphones, tablets, laptops) are registered into the organization’s MDM system before being allowed to access corporate resources.
- Policy Enforcement
- MDM enforces security policies such as password strength, screen lock, encryption, and disabling certain features (e.g., camera, USB).
- Remote Management
- Admins can remotely lock, locate, or wipe lost/stolen devices to prevent data breaches.
- App Management
- MDM controls which applications can be installed or accessed on devices.
- It can deploy required business apps and block risky or unauthorized ones.
- Data Protection and Encryption
- Ensures that company data on mobile devices is encrypted and separated from personal data.
- Monitoring and Compliance
- Tracks device activity and ensures compliance with company and regulatory standards (like GDPR or HIPAA).
Common MDM Features:
- Remote wipe
- Device tracking
- App whitelisting/blacklisting
- Security policy updates
- Email and VPN configuration
- Certificate management
MDM Example in IT:
If an employee uses their phone to access company email, the MDM tool ensures the phone is encrypted, has a PIN lock, and allows remote wiping if it’s lost.
🔸 2. Mobile Device Ownership Models
Different organizations use different strategies to control who owns and manages mobile devices. The three most common models are BYOD, COPE, and CYOD.
🟢 BYOD (Bring Your Own Device)
Definition:
Employees use their personal devices (phones, tablets, laptops) to access company data and applications.
Advantages:
- Reduces company costs (no need to buy devices).
- Employees are comfortable using their own devices.
Security Challenges:
- Lack of full control over personal devices.
- Risk of data leakage if the device is lost or if the user leaves the company.
- Difficult to separate personal and corporate data.
Security Measures:
- Use MDM or Mobile Application Management (MAM) to control access to company apps and data.
- Enforce encryption and strong authentication.
- Implement containerization (isolating company data from personal data).
🟡 COPE (Corporate-Owned, Personally Enabled)
Definition:
Devices are owned by the organization but can also be used by employees for personal tasks.
Advantages:
- The company maintains full control of the device and its security.
- Employees still have limited personal use.
Security Benefits:
- IT can enforce strict MDM policies.
- Easier to wipe or reconfigure devices when employees leave.
- Reduces the risk of data loss.
Security Measures:
- Pre-configured MDM policies.
- Application whitelisting.
- Secure containers to separate personal and work data.
🔵 CYOD (Choose Your Own Device)
Definition:
Employees can choose from a list of company-approved devices, which are either purchased by the company or by the employee.
Advantages:
- Employees get a choice of device.
- IT can preapprove devices that meet security standards.
Security Benefits:
- Easier to manage since devices are compatible with company security tools.
- Balanced control between IT and the user.
Security Measures:
- Only approved devices can access corporate data.
- MDM policies are pre-installed.
- Security updates are regularly applied.
🔸 3. Connection Types
Mobile devices use different types of network connections. Each has unique security considerations.
1. Wi-Fi
- Common for mobile access to company resources.
- Secure Wi-Fi uses WPA3 encryption to protect communication.
- Best Practices:
- Disable auto-connect to public Wi-Fi.
- Use VPN when connecting remotely.
- Use RADIUS or Enterprise WPA3 for authentication.
2. Cellular Networks (4G/5G)
- Considered more secure than public Wi-Fi.
- Managed by mobile carriers, reducing the risk of rogue access points.
- Still should use VPN for sensitive communications.
3. Bluetooth
- Used for wireless accessories (keyboards, headphones).
- Security Risks: Vulnerable to eavesdropping and unauthorized connections.
- Best Practices:
- Disable Bluetooth when not in use.
- Use pairing authentication and device whitelisting.
4. Near Field Communication (NFC)
- Used for contactless transactions or device pairing.
- Security Risks: Data interception or unauthorized connections if NFC remains enabled.
- Best Practices:
- Turn off NFC when not needed.
- Use encryption for sensitive data transfers.
5. USB and Tethering
- Can be used for connecting to other devices or networks.
- Security Risks: Malware infections or data theft through USB connections.
- Best Practices:
- Disable unauthorized USB ports.
- Use data transfer restrictions via MDM.
🔸 4. Security Best Practices for Mobile Devices
| Practice | Purpose |
|---|---|
| Encryption | Protects data stored and transmitted on devices |
| Strong Authentication | Prevents unauthorized access |
| Remote Wipe | Deletes data if the device is lost or stolen |
| Regular Updates/Patching | Fixes vulnerabilities |
| App Control | Restricts installation of unsafe apps |
| Network Protection (VPN, WPA3) | Secures data in transit |
| Containerization | Separates personal and corporate data |
🧩 Summary
| Term | Meaning | Key Security Point |
|---|---|---|
| MDM | Centralized control of mobile devices | Enforce policies, encrypt data, manage remotely |
| BYOD | Employee-owned devices | Use MDM & containers for separation |
| COPE | Company-owned, personal use allowed | Full IT control, strong MDM policies |
| CYOD | Employee chooses from approved list | Pre-approved devices, easy management |
| Connection Types | Wi-Fi, cellular, Bluetooth, NFC, USB | Use encryption, VPN, and disable unused connections |
✅ Exam Tip Summary
- Know the difference between BYOD, COPE, and CYOD — especially ownership and control.
- Understand MDM functions: remote wipe, policy enforcement, encryption, app control.
- Remember that WPA3 and VPNs provide strong wireless protection.
- Be aware of risks from Bluetooth, NFC, and USB connections.
- Containerization is a key technique for separating personal and work data.
