CISA Releases Draft Version of “Applying Zero Trust Principles to Enterprise Mobility” for Public Comment
UPDATE: CISA, FBI, NSA, and Secret Service Re-release Advisory on Conti Ransomware
March 11, 2022NPCC has Announced the 2022 Spring Compliance and Reliability Webinar
March 11, 2022
Summary:
CISA has released a draft version of Applying Zero Trust Principles to Enterprise Mobility for public comment. The paper guides federal agencies as they evolve and operationalize cybersecurity programs and capabilities, including cybersecurity for mobility. The public comment period will close April 18, 2022.
Additional Discussion:
The mobile security ecosystem has evolved rapidly to keep pace with the pervasiveness of mobile devices as an enterprise resource used to conduct official business. The mobile security ecosystem includes a collection of enterprise mobile security tools and technologies to protect devices, data, and mobile applications (apps). Continued security enhancements to mobile operating systems also contribute to mobile device security. Additionally, prominent mobile device manufacturers have integrated tamper resistant hardware components that provide security-critical capabilities such as cryptographic key management. A few vendors are also preparing to respond to the greater security needs of the Federal community by offering continuous, behavior-based identity and access management to better align with ZT principles. A mapping between principles from the Cybersecurity and Infrastructure Security Agency (CISA) ZT maturity model and mobile security tools and technologies highlights the following key takeaways:
- The underpinnings of ZT exist in the mobile security ecosystem. Mobile device operating systems generally include built-in security features for sandboxing, segmentation, and secure memory management.
- Mobile devices implement application and data segmentation features are consistent with key ZT principles.
- Enterprise Mobility Management (EMM) provides tools to configure and enforce device security policy. Combined with mobile threat defense, these tools can provide a good starting point towards an agency’s ZT goals for mobile devices.
- Mobile application development and app security vetting need greater scrutiny to ensure alignment with ZT principles for access to enterprise resources (e.g., to support continuous authentication).
- A tighter integration between EMM and mobile threat defense and enterprise logging, monitoring, diagnostics, and mitigation systems is needed towards meeting ZT requirements of the May 2021 Executive Order 14028.
Associated Files:
Related Alerts:
