📱 Mobile Device Management Skill

🎯 Purpose

This skill enforces mobile device management (MDM) controls for BYOD (Bring Your Own Device) environments, personal device security requirements, and endpoint protection. Based on Hack23 AB's Mobile Device Management Policy, it demonstrates enterprise-grade MDM without enterprise infrastructure.

Key Principle: "BYOD means 'Bring Your Own Disaster'—but only if devices remain unmanaged."

📚 Scope

This skill covers:

📱 BYOD Policy: Personal device security requirements for business use
🔐 Endpoint Protection: Encryption, malware protection, device health
📲 Mobile App Security: Approved apps, containerization, data separation
🔒 Device Encryption: Full device encryption requirements
☁️ Remote Wipe: Data protection for lost/stolen devices
📊 Compliance Monitoring: MDM enrollment, policy enforcement, auditing

⚙️ Security Rules

MUST Requirements

Mobile device controls you MUST implement:

📱 Device Enrollment & Policy

mdm_requirements:
  enrollment:
    pre_enrollment:
      - device_assessment: verify_os_version_and_security_status
      - ownership: personal_device_acknowledged
      - consent: user_agrees_to_MDM_policies_and_remote_wipe
    
    enrollment_platforms:
      aws_workmail:
        email_access: mdm_profile_required_for_corporate_email
        enforcement: email_not_delivered_until_enrolled
      
      alternative_mdm:
        intune: supported_for_future_employee_devices
        jamf: supported_for_ios_macos_fleet
        workspace_one: supported_for_enterprise_deployment
  
  policy_enforcement:
    mandatory_controls:
      - device_encryption: full_device_encryption_required
      - screen_lock: automatic_lock_5_minutes_maximum
      - passcode_complexity: 6_digit_minimum_or_biometric
      - os_updates: critical_security_patches_within_30_days
      - jailbreak_detection: rooted_jailbroken_devices_blocked

🔐 Encryption & Authentication

device_security:
  encryption:
    ios_devices:
      - device_encryption: enabled_by_default_ios_8_and_later
      - verification: mdm_reports_encryption_status
      - backup_encryption: icloud_backup_encrypted
    
    android_devices:
      - device_encryption: mandatory_android_10_and_later
      - verification: mdm_checks_encryption_status
      - sd_card: external_storage_encrypted_if_used
    
    workstations:
      - ubuntu_luks: full_disk_encryption_mandatory
      - windows_bitlocker: required_for_windows_devices
      - macos_filevault: required_for_mac_devices
  
  authentication:
    mobile_devices:
      - screen_lock: biometric_preferred_pin_backup
      - timeout: 5_minutes_idle_maximum
      - failed_attempts: 10_attempts_before_wipe_or_lockout
    
    mfa_requirements:
      - totp: google_authenticator_or_authy_required
      - hardware_tokens: yubikey_for_critical_systems
      - sms_backup: acceptable_but_not_primary_method

📲 App Management & Containerization

application_control:
  corporate_email:
    approved_email_apps:
      - ios_native_mail: with_aws_workmail_mdm_profile
      - android_gmail: with_workmail_integration
      - outlook_mobile: with_workmail_configuration
    
    data_separation:
      - corporate_container: email_calendar_contacts_isolated
      - personal_data: unaffected_by_selective_wipe
      - copy_paste: restricted_from_corporate_to_personal_apps
  
  business_apps:
    approved_list:
      - authenticator: google_authenticator_authy_microsoft
      - secure_messaging: signal_for_confidential_communications
      - cloud_access: aws_console_github_mobile
      - vpn: wireguard_openvpn_for_network_access
    
    prohibited_apps:
      - file_sharing: dropbox_personal_google_drive_personal
      - messaging: whatsapp_telegram_for_business_data
      - vpn: free_untrusted_vpn_services
      - remote_access: teamviewer_anydesk_without_approval

☁️ Remote Wipe & Device Loss

remote_management:
  wipe_capabilities:
    selective_wipe:
      scope: corporate_email_contacts_calendar_only
      trigger: device_loss_employment_termination
      user_impact: personal_data_photos_apps_unaffected
      process:
        - aws_workmail_console: select_device_initiate_wipe
        - verification: confirm_wipe_completion_within_24_hours
        - documentation: record_in_incident_response_log
    
    full_device_wipe:
      scope: entire_device_factory_reset
      trigger: theft_suspected_compromise_high_risk_scenario
      user_impact: all_data_lost_device_unusable
      process:
        - find_my_iphone: ios_devices_remote_wipe
        - find_my_device: android_devices_remote_wipe
        - mdm_console: enterprise_mdm_full_wipe_command
    
  device_loss_procedure:
    immediate_actions:
      - within_30_minutes:
          - disable_credentials: aws_github_google_accounts
          - initiate_wipe: selective_or_full_based_on_risk
          - change_passwords: all_accounts_accessed_from_device
    
    follow_up_actions:
      - within_24_hours:
          - review_logs: check_for_unauthorized_access
          - notify_stakeholders: inform_clients_if_data_exposure_risk
          - update_asset_register: mark_device_as_lost_stolen
          - police_report: file_if_theft_suspected

📊 Monitoring & Compliance

compliance_monitoring:
  mdm_dashboards:
    aws_workmail_console:
      metrics:
        - device_enrollment_status: active_pending_blocked
        - encryption_compliance: percentage_encrypted_devices
        - os_version_currency: devices_within_30_day_update_window
        - policy_violations: jailbreak_attempts_screen_lock_disabled
    
    review_frequency:
      - daily: critical_alerts_jailbreak_encryption_disabled
      - weekly: os_update_status_app_compliance
      - monthly: full_mdm_compliance_report_and_documentation
  
  device_health_checks:
    automated_checks:
      - encryption_status: mdm_verifies_daily
      - os_version: alert_if_30_days_behind_latest
      - jailbreak_detection: immediate_alert_and_block
      - malware_detection: os_native_av_plus_mdm_scanning
    
    manual_verification:
      - quarterly_audit: physical_inspection_of_device_security
      - annual_review: update_mdm_policies_based_on_threats

MUST NOT Prohibitions

Mobile device practices you MUST NOT do:

❌ Unmanaged Device Access

prohibited_practices:
  - email_without_mdm: accessing_corporate_email_on_unenrolled_devices
  - jailbroken_devices: using_rooted_jailbroken_devices_for_business
  - outdated_os: devices_more_than_60_days_behind_security_patches
  - disabled_encryption: turning_off_device_encryption_for_any_reason
  - shared_devices: using_shared_family_devices_for_corporate_access

❌ Insecure Practices

dangerous_behaviors:
  - public_wifi: accessing_sensitive_data_without_vpn_on_public_networks
  - sideloading_apps: installing_apps_from_untrusted_sources
  - disabled_screen_lock: removing_passcode_biometric_authentication
  - unsecured_backup: unencrypted_backups_to_computers_or_cloud
  - app_permissions: granting_excessive_permissions_to_untrusted_apps

❌ Data Leakage

prohibited_data_handling:
  - unencrypted_storage: storing_corporate_data_in_personal_cloud_apps
  - screenshot_sharing: taking_screenshots_of_sensitive_corporate_data
  - personal_messaging: forwarding_corporate_emails_to_personal_accounts
  - unsecured_forwarding: auto_forwarding_work_email_to_personal_email
  - file_attachments: downloading_sensitive_files_to_personal_storage

💡 Examples

Example 1: iOS Device Enrollment (Compliant)

Scenario: Enrolling personal iPhone for corporate email access.

# iOS Device MDM Enrollment
device_enrollment:
  device_info:
    model: iPhone_14_Pro
    os_version: iOS_17.2
    ownership: personal_device
    purpose: corporate_email_and_mfa
  
  pre_enrollment_checklist:
    - device_backup: icloud_backup_completed_before_mdm
    - os_update: ios_updated_to_latest_version
    - find_my_iphone: enabled_for_remote_wipe_capability
    - passcode: strong_passcode_configured_6_digits_minimum
  
  enrollment_process:
    step_1_aws_workmail_setup:
      - open_settings: navigate_to_mail_accounts_add_account
      - select_exchange: enter_hack23_com_email_address
      - accept_mdm_profile: tap_install_when_prompted
      - authenticate: enter_email_password_accept_mfa_challenge
    
    step_2_mdm_configuration:
      policies_applied:
        - device_encryption: verified_enabled
        - screen_lock: automatic_after_5_minutes
        - passcode_requirement: 6_digit_minimum_enforced
        - jailbreak_detection: enabled_will_block_if_detected
        - app_restrictions: corporate_data_containerized
    
    step_3_verification:
      - send_test_email: verify_email_delivery_to_device
      - check_calendar: confirm_calendar_sync_working
      - test_screen_lock: ensure_automatic_lock_activates
      - mdm_console: verify_device_shows_compliant_in_aws_workmail
  
  post_enrollment:
    security_configuration:
      - install_authenticator: google_authenticator_for_mfa
      - configure_vpn: wireguard_vpn_for_aws_console_access
      - install_approved_apps: signal_aws_console_github_mobile
      - test_remote_wipe: verify_find_my_iphone_accessible
    
    user_training:
      - data_separation: explain_corporate_vs_personal_data
      - remote_wipe: acknowledge_selective_wipe_capability
      - incident_reporting: know_procedure_for_device_loss
      - policy_compliance: review_mobile_device_policy

Result: ✅ Compliant - Device enrolled with full MDM protection

ISO 27001:2022 Mapping:

A.8.1: User endpoint devices
A.7.9: Security of assets off-premises
A.5.19: Information security in supplier relationships (AWS WorkMail MDM)

Example 2: Android Device with Work Profile (Compliant)

Scenario: Setting up Android work profile for data separation.

# Android Work Profile Configuration
android_work_profile:
  device_info:
    model: Samsung_Galaxy_S23
    os_version: Android_14
    ownership: personal_device
    byod_approach: work_profile_for_separation
  
  work_profile_setup:
    enrollment:
      - install_company_portal: download_from_google_play_if_using_intune
      - configure_email: add_exchange_account_prompts_work_profile
      - accept_policies: agree_to_mdm_enrollment_and_remote_wipe
    
    profile_configuration:
      work_container:
        apps:
          - gmail: work_profile_version_for_corporate_email
          - calendar: work_profile_calendar_for_business
          - contacts: work_profile_contacts_separate_from_personal
          - authenticator: work_profile_google_authenticator
        
        security:
          - separate_encryption: work_profile_encrypted_independently
          - separate_lock: work_profile_can_have_different_password
          - data_isolation: work_apps_cannot_access_personal_data
      
      personal_container:
        apps:
          - gmail: personal_gmail_unaffected_by_mdm
          - photos: personal_photos_not_visible_to_work_profile
          - social_media: personal_apps_separate_from_business
        
        protection:
          - unaffected_by_selective_wipe: personal_data_safe
          - no_corporate_access: personal_apps_cannot_access_work_data
  
  security_controls:
    enforced_policies:
      - work_profile_encryption: mandatory_for_enrollment
      - screen_lock: required_after_5_minutes_idle
      - password_complexity: 6_character_minimum
      - device_admin: mdm_has_device_admin_permissions
      - remote_wipe: selective_wipe_removes_work_profile_only
    
    monitoring:
      - compliance_checks: mdm_verifies_work_profile_security_daily
      - policy_violations: alerts_if_rooted_or_policies_disabled
      - app_inventory: mdm_tracks_apps_in_work_profile_only

Result: ✅ Compliant - Strong data separation with work profile

Benefits:

🔐 Corporate data protected in encrypted work profile
📱 Personal data unaffected by MDM policies
☁️ Selective wipe removes work profile only
👤 User privacy maintained for personal apps

Example 3: Remote Wipe After Device Theft (Incident Response)

Scenario: iPhone stolen from restaurant table, immediate response required.

❌ Initial Situation:

# CRITICAL INCIDENT - Device Theft
incident_details:
  date_time: 2026-02-10_19:30_UTC
  location: restaurant_stockholm_sweden
  device: iPhone_14_Pro_MOB-001
  circumstances: left_on_table_during_bathroom_visit_stolen
  data_at_risk:
    - corporate_email: 6_months_of_client_communications
    - aws_console: mobile_app_logged_in_with_session
    - github: mobile_app_with_push_notifications
    - signal: encrypted_messages_with_clients
    - authenticator: totp_tokens_for_all_business_accounts

✅ Immediate Response (Within 30 Minutes):

# PHASE 1: Credential Lockdown
credential_actions:
  - 00:00_discovery: realize_phone_missing_immediately_report
  
  - 00:05_passwords:
      - aws: change_root_and_iam_user_passwords
      - github: change_password_revoke_active_sessions
      - google: change_password_revoke_device_sessions
      - email: change_aws_workmail_password
  
  - 00:10_mfa_reset:
      - disable_totp: temporarily_disable_totp_on_all_accounts
      - use_backup_codes: switch_to_backup_authentication_codes
      - hardware_token: use_yubikey_as_primary_mfa
  
  - 00:15_device_control:
      action: initiate_full_device_wipe
      method: find_my_iphone
      steps:
        - login_icloud: from_workstation_browser
        - select_device: iPhone_14_Pro
        - initiate_wipe: full_device_erase_selected
        - activation_lock: mark_as_lost_with_message
      
      aws_workmail_action:
        - login_console: aws_workmail_admin_console
        - select_device: MOB-001_iPhone_14_Pro
        - selective_wipe: remove_corporate_email_calendar_contacts
        - block_device: prevent_future_enrollment_from_this_device_id

# PHASE 2: Monitoring & Investigation
follow_up_24_hours:
  - review_logs:
      - aws_cloudtrail: check_for_unauthorized_console_access
      - github_audit_log: review_repository_access_attempts
      - email_logs: check_for_sent_emails_after_theft
  
  - assess_exposure:
      - data_classification: mostly_HIGH_some_CRITICAL_client_data
      - breach_notification: assess_gdpr_breach_notification_requirement
      - client_impact: determine_if_client_notification_needed
  
  - documentation:
      - incident_log: record_in_incident_response_plan
      - asset_register: update_device_status_to_STOLEN
      - risk_register: update_device_theft_risk_with_actual_incident
      - police_report: file_theft_report_with_local_police
  
  - recovery:
      - procurement: order_replacement_iPhone
      - restore: restore_from_icloud_backup_to_new_device
      - re_enroll: enroll_new_device_in_aws_workmail_mdm
      - verify: confirm_all_security_controls_active

# PHASE 3: Lessons Learned
improvements:
  - policy_update:
      - restaurant_policy: no_devices_left_unattended_in_public
      - screen_lock_timeout: reduce_to_2_minutes_for_public_spaces
      - critical_app_review: remove_aws_console_from_mobile_device
  
  - technical_controls:
      - bluetooth_tracker: attach_airtag_to_phone_case
      - screen_lock_reminder: enable_ios_attention_aware_feature
      - backup_frequency: increase_icloud_backup_to_daily

Result: ✅ Incident Contained - Data exposure prevented through rapid response

Key Takeaways:

⚡ Speed matters: 30-minute credential lockdown window is critical
🔐 Remote wipe capability is essential for BYOD
📝 Documentation enables effective incident response
🔄 Lessons learned improve future security posture

🔗 Integration Points

ISMS Policy Integration

This skill implements controls from:

Mobile Device Management Policy - Complete MDM framework
Access Control Policy - Authentication and MFA requirements
Cryptography Policy - Device encryption standards
Information Security Policy - Overall security framework
Incident Response Plan - Device loss procedures

Related Security Skills

physical-security - Equipment protection and device loss prevention
access-control - Authentication, MFA, and session management
cryptography - Device and data encryption requirements
network-security - VPN and secure network access from mobile devices

Compliance Frameworks

ISO 27001:2022 Controls:

A.8.1 - User endpoint devices (MDM enrollment and policy enforcement)
A.7.9 - Security of assets off-premises (mobile device protection)
A.5.19 - Information security in supplier relationships (AWS WorkMail MDM)
A.5.23 - Information security for use of cloud services (MDM cloud platform)
A.6.4 - Access to networks and network services (mobile network access control)

NIST CSF 2.0 Functions:

PR.AC-01 - Identities and credentials managed for authorized devices (MDM enrollment)
PR.AC-03 - Remote access is managed (mobile device remote management)
PR.DS-01 - Data-at-rest is protected (device encryption)
PR.PT-01 - Audit/log records are determined and managed (MDM compliance logging)
DE.CM-01 - Networks and environments are monitored (mobile device health monitoring)
RS.RP-01 - Response plan is executed (device loss incident response)

CIS Controls v8.1:

1.1 - Establish and maintain detailed enterprise asset inventory (mobile device tracking)
4.1 - Establish and maintain a secure configuration process (MDM policy enforcement)
10.5 - Enable anti-exploitation features (mobile OS security features)
12.8 - Establish and maintain dedicated computing resources for high-value assets (work profile separation)
3.3 - Configure data access control lists (app containerization)

🎯 Best Practices

MDM Platform Selection

AWS WorkMail MDM (Current Implementation):

advantages:
  - cost: included_with_email_service_no_additional_licensing
  - integration: native_aws_workmail_email_integration
  - simplicity: suitable_for_single_person_company
  - capabilities:
      - selective_wipe: removes_email_calendar_contacts_only
      - policy_enforcement: encryption_screen_lock_os_version
      - compliance_monitoring: dashboard_shows_device_status

limitations:
  - basic_features: fewer_advanced_controls_than_enterprise_mdm
  - platform_support: primarily_mobile_devices_not_workstations
  - app_management: limited_app_distribution_capabilities
  - reporting: basic_compliance_reports_not_detailed_analytics

suitable_for:
  - small_businesses: 1-50_employees
  - email_focused: primary_use_case_is_corporate_email
  - budget_conscious: no_additional_mdm_licensing_costs

Enterprise MDM Platforms (Future Scaling):

microsoft_intune:
  best_for: windows_office_365_environments
  features:
    - conditional_access: azure_ad_integration
    - app_protection: without_full_device_enrollment
    - windows_management: autopilot_deployment
  cost: included_with_microsoft_365_e3_e5

jamf:
  best_for: apple_device_fleets_ios_macos
  features:
    - zero_touch_deployment: apple_dep_integration
    - advanced_inventory: detailed_device_management
    - custom_app_deployment: enterprise_app_distribution
  cost: per_device_annual_subscription

vmware_workspace_one:
  best_for: multi_platform_large_enterprises
  features:
    - unified_endpoint_management: all_device_types
    - workspace_integration: app_virtualization
    - advanced_analytics: device_usage_insights
  cost: per_device_tiered_pricing

Device Lifecycle Management

## Mobile Device Lifecycle

### 1. Pre-Enrollment
- [ ] Assess business need for mobile device
- [ ] Verify device OS meets minimum version requirements
- [ ] Obtain user consent for MDM enrollment (BYOD)
- [ ] Document device in Asset Register

### 2. Enrollment
- [ ] Install MDM profile (AWS WorkMail, Intune, Jamf)
- [ ] Verify encryption enabled
- [ ] Configure screen lock and timeout
- [ ] Test remote wipe capability
- [ ] Install approved business apps
- [ ] Configure VPN for secure access

### 3. Operational Use
- [ ] Monthly MDM compliance review
- [ ] Quarterly OS update verification
- [ ] Semi-annual app inventory audit
- [ ] Annual policy acknowledgment

### 4. Incident Response
- [ ] Device loss: Immediate credential lockdown
- [ ] Remote wipe: Selective or full based on risk
- [ ] Log review: Check for unauthorized access
- [ ] Documentation: Update incident log

### 5. Retirement
- [ ] Remove from MDM console
- [ ] Selective wipe of corporate data
- [ ] Update Asset Register status
- [ ] Document disposal method

BYOD Security Tiers

Classification	Email Access	App Restrictions	Monitoring	Remote Wipe
🔴 Critical	Work Profile Only	Approved Apps Only	Continuous	Full Wipe
🟠 High	MDM Required	Approved + Restricted	Daily Check	Selective Wipe
🟡 Medium	MDM Recommended	Guidance Provided	Weekly Check	Selective Wipe
🟢 Low	Basic Security	General Guidelines	Monthly Check	Email Only

📊 Risk Mitigation

Mobile Device Threats

Threat	Impact	Likelihood	Risk Level	Mitigation
Device Theft	🔴 Critical	🟡 Medium	🔴 High	Encryption, remote wipe, screen lock
Malware	🟠 High	🟡 Medium	🟠 High	OS-native AV, app approval, MDM scanning
Phishing	🟠 High	🔴 High	🔴 High	User training, email filtering, MFA
Jailbreak/Root	🟠 High	🟢 Low	🟡 Medium	MDM detection, device blocking
Public WiFi	🟡 Medium	🔴 High	🟠 High	VPN mandatory, TLS enforcement
App Vulnerabilities	🟡 Medium	🟠 High	🟠 High	OS updates, app approval process
Data Leakage	🔴 Critical	🟡 Medium	🔴 High	Containerization, DLP, monitoring

🔍 Validation & Testing

MDM Compliance Check

#!/bin/bash
# MDM Compliance Verification Script

echo "📱 Hack23 AB - MDM Compliance Check"
echo "====================================="
echo ""

# Check AWS WorkMail MDM Enrollment Status
echo "🔍 Checking MDM Enrollment..."
read -p "Is device enrolled in AWS WorkMail MDM? (yes/no): " mdm_enrolled

if [ "$mdm_enrolled" != "yes" ]; then
    echo "❌ CRITICAL: Device not enrolled in MDM - email access should be blocked"
    echo "📝 Action: Enroll device immediately or discontinue corporate email use"
    exit 1
fi

# Check Encryption Status
echo ""
echo "🔐 Checking Encryption Status..."
read -p "Is full device encryption enabled? (yes/no): " encryption_enabled

if [ "$encryption_enabled" != "yes" ]; then
    echo "❌ CRITICAL: Device encryption disabled"
    echo "📝 Action: Enable device encryption immediately"
    exit 1
fi

# Check Screen Lock
echo ""
echo "🔒 Checking Screen Lock Configuration..."
read -p "Is automatic screen lock enabled (<5 min)? (yes/no): " screen_lock

if [ "$screen_lock" != "yes" ]; then
    echo "⚠️  WARNING: Screen lock timeout too long or disabled"
    echo "📝 Action: Configure automatic lock within 5 minutes"
fi

# Check OS Version
echo ""
echo "📲 Checking OS Version Currency..."
read -p "Is OS version within 30 days of latest release? (yes/no): " os_current

if [ "$os_current" != "yes" ]; then
    echo "⚠️  WARNING: OS version outdated"
    echo "📝 Action: Install latest OS security updates"
fi

# Check Jailbreak/Root Status
echo ""
echo "🛡️ Checking Device Integrity..."
read -p "Is device NOT jailbroken/rooted? (yes/no): " not_jailbroken

if [ "$not_jailbroken" != "yes" ]; then
    echo "❌ CRITICAL: Jailbroken/rooted device detected"
    echo "📝 Action: Restore device to factory settings or use different device"
    exit 1
fi

# Check Remote Wipe Capability
echo ""
echo "☁️ Checking Remote Wipe Capability..."
read -p "Is remote wipe capability tested and functional? (yes/no): " remote_wipe

if [ "$remote_wipe" != "yes" ]; then
    echo "⚠️  WARNING: Remote wipe not verified"
    echo "📝 Action: Verify Find My iPhone/Android Device Manager accessible"
fi

# Final Report
echo ""
echo "====================================="
echo "✅ MDM Compliance Check Complete"
echo ""
echo "📝 Review MDM console for detailed device status:"
echo "   AWS WorkMail: https://console.aws.amazon.com/workmail/"
echo ""
echo "🔄 Next Review: Monthly compliance check scheduled"

🎓 Training & Awareness

Mobile Security Awareness

The Five Essential MDM Controls:

Device Enrollment: Register before access, know what's connecting
Policy Enforcement: Require encryption, screen locks, updates
App Management: Control what apps access what data
Remote Wipe: Lost device? Delete corporate data
Monitoring & Compliance: Track compliance, detect anomalies

BYOD Reality:

Personal devices bypass perimeters, roam networks, install apps
Accept BYOD reality, implement pragmatic controls
Maintain ability to protect corporate data when devices compromised

Resources

Mobile Device Management Policy: View on GitHub
ISO 27001:2022 A.8: User endpoint devices
NIST SP 800-124 Rev. 2: Guidelines for Managing the Security of Mobile Devices in the Enterprise
CIS Mobile Device Security Guide: iOS and Android security benchmarks

📋 Document Control

Skill Metadata:

Version: 1.0
Last Updated: 2026-02-10
Review Cycle: Semi-Annual
Owner: Hack23 AB Security Team
Classification:

Framework Compliance:

License: Apache-2.0
Repository: https://github.com/Hack23/homepage