SYS.3.2.2 Mobile Device Management (MDM)

An organisation MUST develop a strategy which determines how its employees may use mobile devices and how the devices are to be integrated into its IT structures. The protection needs of the information to be processed MUST be a fundamental consideration in this regard. The strategy MUST cover at least the following aspects:

• Can the MDM system be operated as a cloud service?
• Should the MDM system be operated by the organisation itself?
• Should the MDM system provide all the necessary apps, or can users install apps themselves? What restrictions does the organisation want to impose on the apps it provides or those that are installed by users?
• Should the MDM system be integrated into a broader infrastructure?
• What support and response requirements does the MDM provider need to fulfil?
• What compliance requirements must be implemented?
• Which mobile devices and which operating systems does the MDM system need to support?
• Does the MDM solution need to be multi-client-capable? Does it guarantee the necessary separation of clients?
• Do cloud services need to be incorporated?
• Do document management systems need to be incorporated?
• Does the MDM system need to incorporate and manage peripheral devices, as well?
• What will the operating model involve: private end devices (bring your own device, BYOD), personalised end devices (owned by the organisation), or non-personalised end devices (owned by the organisation and used jointly)?

The strategy MUST be specified in writing and approved by the CISO.

The mobile devices and operating systems that are permitted in an organisation MUST be specified. All authorised devices and operating systems MUST satisfy the requirements of the MDM strategy at hand and fully comply with the organisation’s security requirements. The organisation's MDM system MUST be configured such that only approved devices can access the organisation’s information. The procurement of mobile devices MUST be restricted to those approved by the organisation.

When suitable MDM software is to be purchased, care MUST be taken to ensure that it satisfies all of the requirements specified in the MDM strategy at hand. It MUST also be able to implement all the necessary technical and organisational security safeguards and support all the mobile devices permitted.

All mobile devices MUST be integrated into the MDM system at hand before they are used. When devices receive their basic configuration, they MUST be set to factory settings. The connection between mobile devices and the MDM system MUST be appropriately secured. For devices which are already in use, all organisation-related data MUST be deleted first. An end device which has not been configured through the MDM system MUST NOT be able to access the corresponding organisation’s information.

When mobile devices are handed over to employees, the MDM client in question MUST be installed and configured on them if it is not already provided by the operating system in use.

Security settings MUST be checked regularly. For new operating system versions of mobile devices, it MUST be checked in advance whether the MDM system in use fully supports them and whether the configuration profiles and security settings are still effective and sufficient. Deviations MUST be corrected. The access rights assigned to users and administrators MUST be checked regularly to ensure that they are still appropriate (minimum principle).

The lifecycle of a mobile device (including its configuration history) SHOULD be sufficiently logged and centrally retrievable. If required, an administrator SHOULD be able to determine the current status of managed devices (device audit).

Apps SHOULD be installed, uninstalled, and updated via the MDM in use system in line with the requirements of the planned deployment scenario. The MDM system SHOULD force the installation, uninstallation, and update process as soon as a connection to a mobile device is established. Users SHOULD not be able to uninstall apps installed via the MDM system. The MDM system SHOULD support a blacklist or whitelist for the installation of apps.

The MDM system in use SHOULD itself be secured using technical safeguards in order to satisfy the protection needs of the information it stores or processes. The underlying operating system SHOULD be hardened.

Certificates for the use of services on mobile devices SHOULD be installed, uninstalled, and updated centrally via the MDM system in use. The installation of untrusted and unverifiable (root) certificates by the user SHOULD be prevented by the MDM system. The MDM system SHOULD support mechanisms that verify the validity of certificates.

The MDM system in use SHOULD ensure that all business data on mobile devices can be deleted remotely (remote wipes for existing data connections). If external storage devices are being used in a mobile device, the system SHOULD check whether these should also be deleted in a remote wipe. This function SHOULD be supported by the MDM system.

The process for decommissioning mobile devices (unenrollment) SHOULD ensure that no sensitive data remains on devices or their integrated storage media. This SHOULD particularly apply if the unenrollment is to be carried out remotely.

If the administrators of an organisation cannot select the admissible apps and users are able to install apps on their devices themselves, a reputation service SHOULD be used. The MDM system in use SHOULD then use information from the reputation service to at least limit the installation of apps.

Appropriate criteria SHOULD be defined and used as a basis for monitoring devices without violating legal or internal provisions. In particular, jailbreaks and attempts at rooting SHOULD be recognised.

A geofencing policy SHOULD ensure that devices with sensitive information cannot be used outside a pre-defined geographical area. If a user leaves this geographical area, the information designated for deletion on their device (or the device itself) SHOULD be wiped completely. Before the device is selectively or completely deleted, the administrators in charge, the security management personnel in question, and the user SHOULD be informed. The device SHOULD only be selectively or completely deleted after an appropriate time delay. The areas in which these additional security safeguards are necessary SHOULD be identified. The security safeguards SHOULD then be implemented in compliance with the relevant legal and internal provisions.

Violations of an organisation's regulations and manipulation of device operating systems SHOULD be detected by a suitable solution. The following actions SHOULD be taken if violations of regulations or OS manipulations are suspected. The solution SHOULD provide corresponding functions, including:

• automated warnings
• autonomous locking of devices
• deletion of the organisation’s confidential information
• deletion of the entire device
• prevention of access to company apps
• prevention of access to the organisation’s systems and information

If a violation or manipulation is suspected, an alert SHOULD be sent to the administrators in charge and the organisation's security management personnel.