- In this lesson 14.5,
we're gonna continue our discussion about mobile devices.
But instead of talking about connectivity,
we're gonna talk about mobile device management.
So mobile device management encompasses deploying,
securing, monitoring, integrating,
and managing mobile devices in the workplace.
Now there are three different approaches
that kind of work together,
there's Mobile Device Management, MDM, which is software
that's used to control deployment, manage settings,
those settings are gonna be referred to as policies,
and report on activity and usage.
Then we have Unified Endpoint Management, or UEM,
which extends the functionality of MDM to IoT devices
and even to our wearables.
And then we have MAM,
which is Mobile Application Management,
which focuses on the management of mobile applications.
But before we talk about how we're managing the devices,
let's talk about who owns the devices
and how they get deployed.
There are three primary types of device ownership,
which correspond to how they're going to be deployed.
BYOD, COPE, and COBO, or C-O-B-O.
Now, BYOD is probably the one
that you're most familiar with.
BYOD stands for Bring Your Own Device,
and that's where users use their personally owned devices
in the workplace, so they're using
their personally owned devices
for both professional and personal use.
Probably still one of the most popular types
of device ownership out there.
It's interesting, because there's questions about,
okay, well who pays for the device?
Does the company give you a stipend for part of it?
And, you have to allow the company
to have access to your device,
because they're going to put some security controls
on your device.
The second is COPE,
that stands for Company-issued Personal Enabled,
where the users get issued a company-owned device,
but again, they can use it
for both professional and personal use.
But in BYOD, right?
The device was owned by the user,
in COPE, the device is owned by the company.
And the third option is COBO, or C-O-B-O,
which is Company-issued Business Only,
and that's when users get issued a company owned device
but it's for professional use only, end of story, right?
Not to be used at all for personal use.
Now, in all three of these though,
we can use our MDM software to manage those devices.
Now our Mobile Device Management software
is used to control deployment, manage settings, policies,
and report on activity and usage.
So our MDM control categories include device tracking,
device protection, access control,
application and content management.
The MDM solutions can be local, meaning on-prem,
or they can be cloud-based.
So let's go through each of those categories,
starting with device tracking.
Two very common things in device tracking
will be geolocation and geofencing.
Geolocation is the process
of determining the object's position
based on GPS, cell triangulation, or Wi-Fi proximity.
What's it used for?
Well, active device tracking,
user tracking, so, where's our user?
Or even to locate a lost device.
Geofencing is the process of defining a virtual boundary,
known as a geofence, around a specific area.
What is it used for in this case?
Well, it can define where devices can be used
or where they can't be used.
Now for data protection,
some options we have are containerization,
storage segmentation, full device encryption, FDE,
and DLP, data loss prevention.
Now containerization is the use
of a secure virtual container, one or more,
and we use those to segregate high risk applications,
like email or our browser, we can also use it
to segregate and encrypt confidential data.
Storage segmentation is a method
to segment personal and corporate data,
and it's also used to enforce access policies
and encryption policies by the storage location,
even, if we get very granular, by the folder.
FDE, full device encryption, is just what it sounds like,
it requires the entire device to be encrypted,
including, and this is important,
including any removable media.
And DLP, data loss protection,
is enforcement of DLP policies, it controls open-in,
so let's say you were opening a file, right?
What application could it open in?
And it also enforces copy and paste restrictions.
Our next category is access control, authentication,
content aware, local wipe and auto wipe, and screen lock.
Authentication enforces our password and biometric policies,
for our devices as well as for content access.
Content-aware is authentication requirement
based on activity, so access to a specific resource
or to a specific application.
Then we have local wipe and auto wipe,
that wipes a mobile device
after a pre-specified number of failed logins,
or it could even be that it gets wiped if the device
moves outside of a defined physical boundary or a geofence.
And then screen lock is a requirement that the screen lock
after X minutes of inactivity,
it can also have forced deauthentication,
it can say it can force you to deauthenticate
from an access point or from a wireless network.
Next is content management, application,
content itself, push notifications, and remote wipe.
Application content management
controls the application installation,
effectively gives you an app catalog,
this is what you can install on your device.
It enforces the user permission
that's required to install and to update apps,
and it also might automate the transparent download of apps
as well as the updates of apps.
Content management controls access to business content,
it enforces user permissions
required to access or to annotate content,
and it can also be used
to automatically push files to a device.
Push notifications control, well, what it sounds like,
push notifications.
Now, push notifications are popups, alerts,
or customized messages.
And then remote wipe is a remote clean that device,
it's a command sent to a remote device
to delete all or selected content,
it can also just reset that device
right back to factory settings.
So what are some of our mobile device security concerns?
Jailbreaking, rooting, sideloading, camera access,
microphone access, hotspots, GPS tagging, and device loss.
Now some of these should look familiar
because we've talked about some of these already.
Jailbreaking is removing the software restrictions
imposed by the manufacturer.
Rooting is gaining administrative access, or root access,
on an Android device.
Sideloading is installing applications
from sources other than the authorized distribution channel,
so from the Apple App Store or from the Google Marketplace.
Camera access is unauthorized video
by malicious or unauthorized apps.
That's a little scary,
your phone taking pictures of you and you don't even know.
Same thing with your microphone,
unauthorized recording by malicious or unauthorized apps.
Hotspots, so having your phone be a hotspot,
maybe getting unauthorized access
'cause somebody's connecting to it.
Also, issues of if someone's using your data,
maybe you're ending up with data usage
and charges that aren't yours.
GPS tagging, the concern there
is it can be used to reveal your location,
your movements, your activities,
ultimately it could be exposure
of vulnerable and sensitive locations.
And then of course, device lost.
If we lose a device,
you know, could somebody else get unauthorized access
to corporate data, to personal data, to financial accounts,
and to any other sensitive information?
So all things that we think about
when we're managing a mobile device.
And that, my friends, brings us to a three second challenge.
Five challenge questions, three seconds each, let's do it.
Extends MDM functionality to IoT and wearables.
One, two, three.
That's Unified Endpoint Management, or UEM.
Ownership mode for a mobile device that is company owned
and issued for work use only.
Company owned and issued for work use only.
One, two, three.
That's gonna be COBO, Company-issued Business Only.
Number three, removing iOS restrictions.
What's that called when you remove the iOS restrictions?
You're getting out of...
Jail, that's jailbreaking.
Number four, defining a virtual boundary
around a physical area.
One, two, three.
That's geofencing.
And lastly, number five,
this can reveal your location, your movements,
and your activities.
One, two, three.
That's gonna be GPS tagging.
All right, that brings us to a security-in-action
so we can apply our knowledge.
This is about mobile device abuse.
Pictures and videos of restricted areas in your workplace
are showing up online, all your employees insist
that they have not uploaded anything.
The employee mobile devices were inspected
and really nothing appears to be amiss.
And they're adamant, your employees,
they did not do anything.
So what do you suspect might be going on?
So what's going on here?
We're getting pictures and we're getting videos
of restricted areas in your workplace showing up online.
That's pretty unnerving.
But your employees say,
"We have not done anything.
Honest to God, we didn't do it."
You looked at their devices,
you know, you don't see any saved pictures,
you don't see any saved videos,
you don't see any texts that indicate something's going on.
What do you suspect might be happening?
Go ahead and put me on pause, write down your suspicions
or your analysis, and then...
Well one option is unauthorized access
to the restricted area.
Maybe, somebody else got in there,
not your employees, but somebody else got in there
and took those pictures and those videos.
So that's one option.
Another option is that there's a malicious app
has remote access to the camera
and is responsible for taking those photos and videos.
Now it's quite possible that the perpetrator
is also deleting the photos and the video
not to leave any kind of trail.
So part of inspecting those devices
would be what apps are on there,
and are any apps having access to the camera, right?
Or, also, to the microphone as well,
so you wanna take a look at that.
Now, authorized apps do not behave this way
so, good chance if you have an app that's doing this,
that one of the devices has been jailbroken
or, if it's Android has been rooted.
So you wanna take a really close look
at do any of those devices, right?
Have an app that has access to the camera or video.
And if you can out rule all of that,
then we need to also be start thinking
a little bit more seriously
about the fact that maybe there's unauthorized access
to that restricted area.
But doing that kind of analysis,
thinking about all of the different options
and, you know, what might have happened, as well as
how do you remediate this situation for the future?
That's security-in-action.
All right, my friends.
Ooh, that's a big word cloud, a lot there.
Go ahead and spend some time on this
before you move on to the next lesson.
But when you're ready, I'll be waiting for you.