2 cissp ® Official Study Guide Eighth Edition

Mobile Devices
Mobile devices include smartphones and tablets. These devices have internal memory or 
removable memory cards that can hold a significant amount of data. Data can include 
email with attachments, contacts, and scheduling information. Additionally, many devices 
include applications that allow users to read and manipulate different types of documents.
Many organizations issue mobile devices to users or implement a choose your own 
device (CYOD) policy allowing employees to use certain devices in the organizational 
network. While some organizations still support a bring your own device (BYOD) policy 
allowing an employee to use any type of device, this has proven to be quite challenging, 

---

Securely Provisioning Resources 
717
and organizations have often moved to a CYOD policy instead. Administrators register 
employee devices with a mobile device management (MDM) system. The MDM system 
monitors and manages the devices and ensures that they are kept up-to-date. 
Some of the common controls organizations enable on user phones are encryption, 
screen lock, Global Positioning System (GPS), and remote wipe. Encryption protects the 
data if the phone is lost or stolen, the screen lock slows down someone that may have stolen 
a phone, and GPS provides information on the location of the phone if it is lost or stolen. 
A remote wipe signal can be sent to a lost device to delete some or all data on the device if 
it has been lost. Many devices respond with a confi rmation message when the remote wipe 
has succeeded. 
Remote wipe doesn’t provide guaranteed protection. Knowledgeable 
thieves who want data from a business smartphone often remove the 
subscriber identity module (SIM) card immediately. Additionally, they 
have used shielded rooms similar to Faraday cages when putting the SIM 
back into the phone to get the data. These techniques block the remote 
wipe signal. If a confirmation message is not received indicating that the 
remote wipe has succeeded, it’s very possible that the data has been 
compromised.