DOJ Weighs ‘Bring Your Own Devices’ Amid Increased Threats
The agency wants stronger industry standards around cybersecurity before considering a more tailored mobile device policy.
Officials at the Department of Justice reiterated the agency’s policy to use corporate-owned, business-only (COBO) mobile devices rather than personal devices, even as agencies across government work to implement zero trust architecture and multi-factor authentication amid bring-your-own-device (BYOD) policies.
DOJ Mobile Security Programs Manager Michael McHugh said the agency isn’t quite on board yet with allowing personnel to use their own devices in the face of high security risks and increasing cyber attacks on government systems.
“The containerization approach from different manufacturers and third parties, we just have not seen industry catch up with really hardening the environment and separating out and sandboxing that data,” McHugh said during a FedInsider webinar.
Threat actors are increasingly targeting specifically mobile devices, which can enable bad actors to move laterally within an organization.
“All of those kinds of social engineering techniques, which are really just about getting credentials from the device. … They are getting legitimate credentials … to get other data out of the organization or compromise other individuals,” said David Richardson, vice president of product, endpoint and security at Lookout, during the webinar.
DOJ has experienced both successes and challenges with its device policy.
Sharing between legacy and mobile devices creates visibility gaps, and due to manufacturers’ limited access to security management tools, mobile devices can’t be managed like legacy equipment can. Cyberattacks often start on mobile devices, allowing bad actors access to legacy devices later, McHugh said.
But at the Bureau of Prisons, for example, the policy is helping to ensure incarcerated prisoners can use technology once released.
“Whether it is an inmate going to a doctor’s visit or going to a learning facility or joining a conference like this to learn about mobile security, mobile impacts them,” McHugh said. “It is my job and [the bureau’s] job to secure that experience and make it beneficial.”
This is a carousel with manually rotating slides. Use Next and Previous buttons to navigate or jump to a slide with the slide dots
-
DOD Has a New Cyber Resiliency Assessment Program
Defense officials tout the continuous assessment feature and scalability of the new program amid increased cyber threats.
5m read -
Cyber Resilience and Recovery Amid Evolving Cyber Threats
Data durability is a key aspect of NIST’s cybersecurity framework for public and private organizations.
21m listen -
How TMF is Helping Agencies Accelerate Tech Modernization
The program launched a new AI pilot to expedite TMF applications as agency leaders urge more to consider applying for funds.
4m read -
Energy Researchers Aim For Holistic Approach to AI Issues
A new center at the Oak Ridge National Laboratory is looking at under-researched areas of AI to better understand how to secure it.
2m read