DOJ Weighs ‘Bring Your Own Devices’ Amid Increased Threats

Officials at the Department of Justice reiterated the agency’s policy to use corporate-owned, business-only (COBO) mobile devices rather than personal devices, even as agencies across government work to implement zero trust architecture and multi-factor authentication amid bring-your-own-device (BYOD) policies.

DOJ Mobile Security Programs Manager Michael McHugh said the agency isn’t quite on board yet with allowing personnel to use their own devices in the face of high security risks and increasing cyber attacks on government systems.

“The containerization approach from different manufacturers and third parties, we just have not seen industry catch up with really hardening the environment and separating out and sandboxing that data,” McHugh said during a FedInsider webinar.

Threat actors are increasingly targeting specifically mobile devices, which can enable bad actors to move laterally within an organization.

“All of those kinds of social engineering techniques, which are really just about getting credentials from the device. … They are getting legitimate credentials … to get other data out of the organization or compromise other individuals,” said David Richardson, vice president of product, endpoint and security at Lookout, during the webinar.

DOJ has experienced both successes and challenges with its device policy.

Sharing between legacy and mobile devices creates visibility gaps, and due to manufacturers’ limited access to security management tools, mobile devices can’t be managed like legacy equipment can. Cyberattacks often start on mobile devices, allowing bad actors access to legacy devices later, McHugh said.

But at the Bureau of Prisons, for example, the policy is helping to ensure incarcerated prisoners can use technology once released.

“Whether it is an inmate going to a doctor’s visit or going to a learning facility or joining a conference like this to learn about mobile security, mobile impacts them,” McHugh said. “It is my job and [the bureau’s] job to secure that experience and make it beneficial.”