CISSP 9.18 - Mobile Devices (Part 1 of 3)

This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series opens the mobile devices topic in Domain 3, covering the risks these devices bring and the on-device features that tame them. It walks through the controls and policies that turn a lost phone into a minor inconvenience instead of a crisis.

Frequently Asked Questions

Why are mobile devices such a security headache?

Because they combine huge capability with weak default protection. Many run stripped-down operating systems that never got the decades of security hardening a desktop received, and they hold contacts, messages, email, documents, and cameras that can capture sensitive scenes in a second. They also become smuggling tools, letting a malicious insider carry code in on a phone or memory card and stolen data right back out, plus conversations can be overheard or even tapped. Treat every mobile device as a tiny, mobile branch office that could leak.

What sets Android and iOS apart?

They represent two philosophies. Android is built on Linux and is highly open, letting users install from official and unknown sources and even replace the operating system itself, which invites malicious apps and insecure transfers, though updates and a hardened variant with mandatory access control and app sandboxing steadily improve it. Apple’s iOS takes the opposite road, running only on Apple hardware with apps through its official store, like a house you can renovate versus a well-guarded apartment where the landlord sets the rules.

How do you manage a whole fleet of mobile devices?

You register them with a central management system. Mobile device management lets you push or pull apps, enforce configuration, and keep devices patched, whether they connect over the carrier network or Wi-Fi and whether the company or the employee owns them. The newer, broader approach is unified endpoint management, which controls phones, laptops, wearables, and industrial devices from one platform, acting like an air traffic control tower where nothing flies unmanaged.

How does a mobile device prove who is holding it, and why does encryption matter?

Through real device authentication, not a lazy swipe or pattern, requiring a password, personal identification number, face or fingerprint scan, or proximity token, and for online services layering on multi-factor and context-aware authentication that weighs where and how you connect. Full-device encryption turns a lost device into a locked safe, shutting down the data port when the screen locks so no one siphons data through a cable, though a device stolen while unlocked or with a known backdoor can still spill its contents.

What do you do when a mobile device is lost or stolen?

You trigger a remote wipe to erase its data and settings from afar over cellular or any internet connection, but treat it as a strong precaution, not a guarantee. A clever thief can block the wipe signal by pulling the SIM card, killing Wi-Fi, or dropping the device into a signal-blocking bag, and a plain wipe often just deletes so recovery tools can undo it. The fix is to combine remote wipe with full-device encryption, so anything recovered is unreadable ciphertext.

Reference: This article is based on concepts discussed in CISSP 9.18 - Mobile Devices (Part 1 of 3).