Nov. 5, 2015
DRAFT Mobile Device Security: Cloud & Hybrid Builds
Mobile devices allow employees to access information resources wherever they are, whenever they need. The constant Internet access available through a mobile device’s cellular and Wi-Fi connections has the potential to make business practices more efficient and effective. As mobile technologies mature, employees increasingly want to use mobile devices to access corporate enterprise services, data, and other resources to perform work-related activities. Unfortunately, security controls have not kept pace with the security risks that mobile devices can pose.
Draft SP 1800-4a: Executive Summary (PDF)
Draft SP 1800-4a: Executive Summary (HTML5)
Draft SP 1800-4b:: Approach, Architecture, and Security Characteristics (PDF)
Draft SP 1800-4b: Approach, Architecture, and Security Characteristics (HTML5)
Draft SP 1800-4c: How-To Guides (PDF)
Draft SP 1800-4c: How To Guides (HTML5)
Draft SP 1800-4 Homepage
Draft SP 1800-4: Zip File includes all volumes & including supplemental files
Comment Form (HTML)
NIST Press Release
If sensitive data is stored on a poorly secured mobile device that is lost or stolen, an attacker may be able to gain unauthorized access to that data. Even worse, a mobile device with remote access to sensitive organizational data could be leveraged by an attacker to gain access to not only that data, but also any other data that the user is allowed to access from that mobile device. The challenge lies in ensuring the confidentiality, integrity, and availability of the information that a mobile device accesses, stores, and processes. Despite the security risks posed by today’s mobile devices, enterprises are under pressure to accept them due to several factors, such as anticipated cost savings and employees’ demand for more convenience.
The NIST Cybersecurity Practice Guide “Mobile Device Security: Cloud & Hybrid Builds” demonstrates how commercially available technologies can meet your organization’s needs to secure sensitive enterprise data accessed by and/or stored on employees’ mobile devices.
In our lab at the NCCoE, part of the National Institute of Standards and Technology (NIST), we built an environment based on typical mobile devices and an enterprise email, calendaring, and contact management solution.
We demonstrate how security can be supported throughout the mobile device lifecycle. This includes how to:
• configure a device to be trusted by the organization
• maintain adequate separation between the organization’s data and the employee’s personal data stored on or accessed from the mobile device
• handle the de-provisioning of a mobile device that should no longer have enterprise access (e.g., device lost or stolen, employee leaves the company.
If you have questions or would like to work on additional mobile device security projects, email the project team at email@example.com.
The comment period closes January 8, 2016.
You may submit comments through the NISTs NCCoE website.