2 cissp ® Official Study Guide Eighth Edition

Understand SECaaS.
Security as a service (SECaaS) is a cloud provider concept in which 
security is provided to an organization through or by an online entity.
Understand smart devices.
A smart device is a range of mobile devices that offer the user 
a plethora of customization options, typically through installing apps, and may take advan-
tage of on-device or in-the-cloud artificial intelligence (AI) processing.
Comprehend IoT.
The Internet of Things (IoT) is a new subcategory or maybe even a new 
class of devices connected to the internet in order to provide automation, remote control, or 
AI processing to traditional or new appliances or devices in a home or office setting.
Understand mobile device security.
Device security involves the range of potential secu-
rity options or features that may be available for a mobile device. Not all portable elec-
tronic devices (PEDs) have good security features. PED security features include full device 
encryption, remote wiping, lockout, screen locks, GPS, application control, storage segmen-
tation, asset tracking, inventory control, mobile device management, device access control, 
removable storage, and the disabling of unused features.
Understand mobile device application security.
The applications and functions used on 
a mobile device need to be secured. Related concepts include key management, credential 
management, authentication, geotagging, encryption, application whitelisting, and transi-
tive trust/authentication.
Understand BYOD.
Bring your own device (BYOD) is a policy that allows employees to 
bring their own personal mobile devices to work and then use those devices to connect 
to (or through) the company network to business resources and/or the internet. Although 
BYOD may improve employee morale and job satisfaction, it increases security risks to the 
organization. Related issues include data ownership, support ownership, patch manage-
ment, antivirus management, forensics, privacy, on-boarding/off-boarding, adherence to 
corporate policies, user acceptance, architecture/infrastructure considerations, legal con-
cerns, acceptable use policies, and on-board cameras/video.