2 cissp ® Official Study Guide Eighth Edition

 Application Control 
Application control
is a device-management solution that limits which applications can be 
installed onto a device. It can also be used to force specifi c applications to be installed or to 
enforce the settings of certain applications, in order to support a security baseline or main-
tain other forms of compliance. Using application control can often reduce exposure to 
malicious applications by limiting the user’s ability to install apps that come from unknown 
sources or that offer non-work-related features.

---

Assess and Mitigate Vulnerabilities in Mobile Systems 
369
Storage Segmentation
Storage segmentation
is used to artificially compartmentalize various types or values of 
data on a storage medium. On a mobile device, the device manufacturer and/or the service 
provider may use storage segmentation to isolate the device’s OS and preinstalled apps from 
user-installed apps and user data. Some mobile device-management systems further impose 
storage segmentation in order to separate company data and apps from user data and apps.
Asset Tracking
Asset tracking is the management process used to maintain oversight over an inventory, 
such as deployed mobile devices. An asset-tracking system can be passive or active. Passive 
systems rely on the asset itself to check in with the management service on a regular basis, 
or the device is detected as being present in the office each time the employee arrives at 
work. An active system uses a polling or pushing technology to send out queries to devices 
in order to elicit a response.
You can use asset tracking to verify that a device is still in the possession of the assigned 
authorized user. Some asset-tracking solutions can locate missing or stolen devices.
Some asset-tracking solutions expand beyond hardware inventory management and can 
oversee the installed apps, app usage, stored data, and data access on a device. You can use 
this type of monitoring to verify compliance with security guidelines or check for exposure 
of confidential information to unauthorized entities.