CompTIA Security+ Preparation · lesson 30 of 45 · 25 min
Mobile Device Management Concepts
MDM (Mobile Device Management) — manages and secures mobile devices (smartphones, tablets, laptops). Capabilities: remote wipe, enforce encryption, push policies, manage apps, track location, enforce screen lock.
MAM (Mobile Application Management) — manages specific applications rather than the entire device. Useful for BYOD — corporate apps are managed without controlling personal data.
EMM (Enterprise Mobility Management) — umbrella term covering MDM + MAM + MCM (Mobile Content Management).
UEM (Unified Endpoint Management) — extends EMM to manage all endpoints: mobile, desktop, IoT, and servers from a single platform.
BYOD (Bring Your Own Device) — employees use personal devices for work. Risks: data leakage, lost/stolen devices, mixing personal and corporate data, malware from personal apps. Requires MDM enrollment and acceptable use policy.
COPE (Corporate-Owned, Personally Enabled) — company owns the device but allows personal use. More control than BYOD.
CYOD (Choose Your Own Device) — employees choose from a list of approved devices. Company owns and manages them.
Mobile Security Controls
Containerization — creates a separate encrypted container on the device for corporate data and apps. Personal and corporate data are isolated. If the device is lost, only the container is wiped.
Remote wipe — erase all data on a lost or stolen device remotely. Full wipe (entire device) or selective wipe (corporate data only).
Geofencing — restricts device functionality based on location. Example: disable camera when inside a secure facility.
Jailbreaking/rooting — removes manufacturer restrictions. Bypasses security controls, voids warranty, increases malware risk. MDM can detect and block jailbroken/rooted devices.
Mobile threat defense (MTD) — detects mobile-specific threats: malicious apps, network attacks, OS exploits.
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Mobile Device Management
MAM is preferred over MDM for BYOD because:
- MAM is cheaper
- MAM manages specific apps without controlling personal data on the device
- MDM does not work on personal devices
- MAM provides more control
- Answer: MAM manages specific apps without controlling personal data on the device
BYOD employees are often uncomfortable with full MDM control of their personal device. MAM manages only corporate apps, respecting personal privacy. Containerization on a mobile device:
- Encrypts the entire device
- Creates a separate encrypted space for corporate data, isolated from personal data
- Removes all personal apps
- Requires a company-owned device
Answer: Creates a separate encrypted space for corporate data, isolated from personal data Containerization isolates corporate apps and data — if the device is lost, only the container is wiped, leaving personal data intact. Jailbreaking a device is a security risk because:
- It makes the device slower
- It bypasses manufacturer security controls and increases malware risk
- It drains the battery faster
- It disables Wi-Fi
- Answer: It bypasses manufacturer security controls and increases malware risk
Jailbreaking removes OS security restrictions — apps can access the entire system, and malware can operate without restrictions. Geofencing can be used to:
- Track employee location permanently
- Disable device features (like camera) when inside a secure facility
- Block all internet access
- Enforce password complexity
- Answer: Disable device features (like camera) when inside a secure facility
Geofencing triggers actions based on location — disabling cameras in secure areas prevents unauthorized photography. COPE stands for:
- Corporate-Owned, Personally Enabled
- Company-Operated, Personal Equipment
- Corporate-Only, Protected Environment
- Choose Own Personal Equipment
- Answer: Corporate-Owned, Personally Enabled
COPE: the company owns the device but allows personal use — more control than BYOD, more flexibility than CYOD. A selective remote wipe:
- Erases the entire device
- Erases only corporate data, leaving personal data intact
- Locks the device without erasing
- Disables the SIM card
- Answer: Erases only corporate data, leaving personal data intact
Selective wipe removes corporate apps and data from the container — personal photos, contacts, and apps are preserved. UEM (Unified Endpoint Management) manages:
- Only mobile devices
- Only laptops
- All endpoints: mobile, desktop, IoT, and servers from one platform
- Only cloud workloads
- Answer: All endpoints: mobile, desktop, IoT, and servers from one platform
UEM extends MDM/EMM to all endpoint types — a single console for managing every device in the organization. MDM can detect jailbroken devices and:
- Automatically repair them
- Block them from accessing corporate resources
- Report them to law enforcement
- Upgrade their OS
- Answer: Block them from accessing corporate resources
MDM compliance policies can detect jailbreaking/rooting and automatically block the device from accessing corporate email, VPN, and apps.
BYOD stands for Bring Your Own _____.
Answer: Device
BYOD = Bring Your Own Device — employees use personal smartphones, tablets, or laptops for work purposes.
Mobile Threat Defense (MTD) detects:
- Only network attacks
- Mobile-specific threats: malicious apps, network attacks, and OS exploits
- Only malware in email
- Only physical theft
- Answer: Mobile-specific threats: malicious apps, network attacks, and OS exploits
MTD provides mobile-specific threat detection — it monitors apps, network connections, and OS behavior for signs of compromise.
Previous lesson: Endpoint security: EDR, DLP, application control, hardening
Back to CompTIA Security+ Preparation
Next lesson: Hardening techniques: patching, disabling services, secure baselines, CIS benchmarks