DOJ Weighs ‘Bring Your Own Devices’ Amid Increased Threats
The agency wants stronger industry standards around cybersecurity before considering a more tailored mobile device policy.
Officials at the Department of Justice reiterated the agency’s policy to use corporate-owned, business-only (COBO) mobile devices rather than personal devices, even as agencies across government work to implement zero trust architecture and multi-factor authentication amid bring-your-own-device (BYOD) policies.
DOJ Mobile Security Programs Manager Michael McHugh said the agency isn’t quite on board yet with allowing personnel to use their own devices in the face of high security risks and increasing cyber attacks on government systems.
“The containerization approach from different manufacturers and third parties, we just have not seen industry catch up with really hardening the environment and separating out and sandboxing that data,” McHugh said during a FedInsider webinar.
Threat actors are increasingly targeting specifically mobile devices, which can enable bad actors to move laterally within an organization.
“All of those kinds of social engineering techniques, which are really just about getting credentials from the device. … They are getting legitimate credentials … to get other data out of the organization or compromise other individuals,” said David Richardson, vice president of product, endpoint and security at Lookout, during the webinar.
DOJ has experienced both successes and challenges with its device policy.
Sharing between legacy and mobile devices creates visibility gaps, and due to manufacturers’ limited access to security management tools, mobile devices can’t be managed like legacy equipment can. Cyberattacks often start on mobile devices, allowing bad actors access to legacy devices later, McHugh said.
But at the Bureau of Prisons, for example, the policy is helping to ensure incarcerated prisoners can use technology once released.
“Whether it is an inmate going to a doctor’s visit or going to a learning facility or joining a conference like this to learn about mobile security, mobile impacts them,” McHugh said. “It is my job and [the bureau’s] job to secure that experience and make it beneficial.”
This is a carousel with manually rotating slides. Use Next and Previous buttons to navigate or jump to a slide with the slide dots
-
USPS Amid a Plan to Transform and Secure Mail Operations
CIO Pritha Mehra shares how the Postal Service is bringing its technology and systems up to date.
27m listen -
DOD Dominates CISA’s President’s Cup Cyber Competition
The competition featured real-world scenarios such as the LastPass major attack in 2022 and incorporates emerging technology.
4m read -
68 Software Firms Sign CISA’s Secure-by-Design Pledge
A year since CISA's initiative, tech companies say their products will have built-in security features from the start.
3m read -
Spain’s Cyber Agency is Incubating Businesses to Protect NATO Cyberspace
INCIBE Secretary General Carla Redondo Galbarriatu said the private sector is key to strengthening cybersecurity.
12m listen