CSA SINGAPORE Mobile Cyber App User Guide
- August 6, 2024
- CSA SINGAPORE
Table of Contents
CSA SINGAPORE Mobile Cyber App
Specifications
- Product Name: Mobile Cyber Security Guide
- Aligned to Cyber Essentials
- Intended Audience: Organisations keen on securely deploying mobile devices or strengthening existing mobile deployments
Product Information
The Mobile Cyber Security Guide (Aligned to Cyber Essentials) is a cybersecurity resource designed to assist organizations in defending against mobile-specific risks as mobile device deployments increase and mobile threats become more targeted. It aligns with the Cyber Essentials mark certification standard.
Usage Instructions
Purpose & Intended Audience:
The guide serves as an implementation companion to the Cyber Essentials mark certification standard. It is aimed at organizations interested in securely deploying mobile devices or enhancing current mobile deployments.
Scope:
The guide focuses on three common types of mobile device deployments: Strict Enterprise Usage, Corporate-Owned Personally Enabled, and Bring Your Own Device (BYOD). Recommendations in this document are scoped to the BYOD model, suitable for smaller or less digitalized organizations starting their cybersecurity journey. For other deployment models, refer to CSA’s Guidelines for CII Owners to Enhance Cyber Security for 5G Use Cases.
BYOD Mobile Device Deployment Model:
BYOD involves using personally owned devices for work-related tasks. While it offers increased flexibility and access to organizational resources, it also poses unique security and privacy challenges to both organizations and device owners.
FAQ
- Q: What is the target audience for the Mobile Cyber Security Guide?
- A: The guide is intended for organizations looking to enhance mobile security through secure deployments or strengthening existing mobile practices.
- Q: Which deployment models are covered in the guide?
- A: The guide focuses on three common types of mobile device deployments: Strict Enterprise Usage, Corporate-Owned Personally Enabled, and Bring Your Own Device (BYOD).
Introduction
CSA Cyber Essentials mark and Cyber Trust mark are tiered cybersecurity
standards that are designed to support the cybersecurity needs of a range of
organizations. The Cyber Essentials mark takes on a baseline control approach
and is intended to protect organizations against common cyberattacks. The
Cyber Trust mark takes on a risk-based approach and is intended to enable
organizations to put in place the relevant cybersecurity preparedness measures
that are commensurate with their cybersecurity risk profile. Together, the
Cyber Essentials mark and Cyber Trust mark provide a cybersecurity risk
management framework for organizations. Globally, mobile devices have
continued to proliferate and become increasingly woven into the fabric of our
daily lives. Modern mobile devices have transformed how organizations deliver
IT services, organisations are shifting to mobile device deployments for
organizational business functions1. While mobility can enhance performance and
productivity, mobile devices bring unique threats to organizations. As
organizations embrace mobility, adversaries are refining their techniques to
target mobile devices. Mobile threats are growing, and the industry has seen
an increasing number of cases targeting mobile devices.
The “Mobile Cyber Security Guide (Aligned to Cyber Essentials)” helps
organizations in their defence against mobile-specific risks as mobile device
deployments rise and mobile threats become more targeted.
Purpose & Intended Audience
The “Mobile Cyber Security Guide (Aligned to Cyber Essentials)” is intended to serve as an implementation guide to accompany the Cyber Essentials mark certification standard, and should be read in conjunction with the Cyber Essentials mark certification standard. This guide is targeted at organisations keen on securely deploying mobile devices, or organisations keen on strengthening existing mobile deployments.
Scope
There are three (3) common types of mobile device deployments: (i) Strict Enterprise Usage, (ii) Corporate-Owned Personally Enabled, and (iii) Bring Your Own Device (BYOD). Cyber Essentials mark is targeted at smaller or less digitalized organizations that are starting out in their cybersecurity journey, such as Small and Medium Enterprises (SMEs). Correspondingly, this document provides recommendations scoped to Bring Your Own Device (BYOD) model, as small organizations tend to adopt such a model. For other mobile deployment models, organizations may wish to refer to CSA’s “Guidelines for CII Owners to Enhance Cyber Security for 5G Use Cases”, available at CSA’s website.
Bring Your Own Device (BYOD) Mobile Device Deployment Model
Bring Your Own Device (BYOD) refers to the practice of performing work-related activities on personally owned devices. Incorporating BYOD deployments into an organization can increase opportunities and methods available to access organizational resources, however, the increased flexibility and functionality of BYOD mobile devices present unique security and privacy challenges to both organizations and device owners.
To help organizations benefit from BYOD’s flexibility while protecting themselves from critical security and privacy challenges, this guide will address the following roles in the BYOD model:
- End user organization
- Mobile device owner
This approach enables the guide to capture the unique relationship between organizations and mobile device owners in BYOD deployment models. While organizations can implement and enforce various BYOD policies and security controls, mobile device owners remain the “device administrators”, with control over the installation of applications, device patching/updating, permissions granted to applications, and more. Therefore, the organization and device owner have distinct roles in managing the security of the organization and the mobile devices deployed within.
Balancing Cybersecurity and Privacy
A crucial factor of a successful BYOD deployment is establishing trust between
the organization and the device owner. The integration of personal devices
into the organizational environment necessitates a mutual understanding
between the two parties, particularly if organisations collect data from
employees’ personal devices. Data collection poses a cybersecurity and privacy
risk that both the organization and device owners must address. Managing this
risk requires striking a balance, ensuring the security of organisational data
while respecting the privacy and autonomy of device owners. Understanding the
personal nature of BYOD devices is important when implementing mobile security
measures or protocols.
The recommendations in this guide take into account both cybersecurity and
privacy risks faced by organizations.
References
In preparing this document, reference was made to the following publications:
- CSA Safe App Standard, Version 1.0
- CSA Guidelines for CII Owners to Enhance Cyber Security for 5G Use Cases, Version 1.0
- NIST Special Publication 800-124r2 Guidelines for Managing the Security of Mobile Devices in the Enterprise
- NIST Special Publication 1800-22 Mobile Device Security: Bring Your Own Device (BYOD)
- 2023 Global Mobile Threat Report, Zimperium
- NIST Privacy Framework: A Tool For Improving Privacy Through Enterprise Risk Management, Version 1.0
Acknowledgment is made for the use of information from the above publications.
Annex A: Mobile Cyber Security Guide (Aligned to Cyber Essentials)
Mobile Security Recommendation
| ****
End User Organisation Responsibility
| ****
Device Owner Responsibility
---|---|---
A.1 Assets: People
1. User education on mobile-specific threats and best practices
Why is this important:
· With the increase on
sophistication and scope of mobile threats, user education is crucial in reducing the likelihood of these threats materializing.
| What should the organization do:
· Organisations should enable training and awareness efforts by providing the necessary platforms and materials to employees e.g. security exercises,
training programs, formal education, etc.
· Beyond the inclusion of general cyber awareness
training for employees, the organization should also include topics for business users managing or accessing mobile organizational resources to
understand why they play important roles in mobile security, and how they can operate securely.
| What should device owners do:
· Device owners should enhance their education and awareness of mobile threats and best practices. This can include:
o How to identify phishing attacks
o How to properly manage authentication credentials
The organization’s privacy policy and personal information collected
o Why apps should only be installed from trusted sources
Additional measures:
· Insight on recent mobile security threats (e.g. phishing scams, malicious applications, etc.) can be found from various sources:
o Cybersecurity campaigns
o News forums
o Global cybersecurity reports
A.2 Assets: Hardware and Software
2. Mobile Asset Inventory
Why is this important:
· Knowledge of the organization’s mobile environment is the
| What should the organization do:
· An up-to-date asset inventory of all mobile hardware (mobile devices) and software (mobile applications) assets should be maintained.
· Mobile assets within the scope may include the following:
| What should device owners do:
· Device owners should ensure that they have
received approval from the organization before using their mobile device in the organizational environment
Mobile Security Recommendation
| ****
End User Organisation Responsibility
| ****
Device Owner Responsibility
---|---|---
foundational step to monitoring and protecting the assets within.| o BYOD
mobile devices used in the organizational environment
o Employees permitted to use BYOD mobile devices
o Software applications used for the organization’s business purposes
· Asset inventory lists should contain details of the assets where available:
o For hardware assets (mobile devices) – hardware name/model, asset type, asset owner, department, approval/authorized date, etc.
o For software assets (mobile applications) – software name, software publisher, software version, business purpose, approval/authorized date, etc.
|
3. Mobile application secure practices
Why is this important:
· With the increase in the distribution of malicious applications via various channels, it is important for organizations to ensure their organization’s resources are protected against malware, and for device owners to avoid
downloading these malicious
applications.
| What should the organization do:
· Organisations deploying in-house developed mobile applications should distribute apps via a dedicated mobile app store (e.g. Google Play Store, Apple App Store)
Additional measures:
· Applications on mobile devices may be managed using mobile device management systems such as Mobile Device Management solutions, or
Enterprise Mobility Management solutions.
| What should device owners do:
· Mobile device owners should only install
applications from official application stores (e.g.
Google Play Store, Apple App Store) as these
platforms have measures in place to detect and remove malicious applications
· Mobile device owners should restrict the
permissions assigned to each app (e.g. camera access, location access) to only the permissions required
Mobile Security Recommendation
| ****
End User Organisation Responsibility
| ****
Device Owner Responsibility
---|---|---
| · The following restrictions can be applied to
applications on mobile devices depending on how a device is managed and enrolled into a device management system:
o Restrict which app stores may be used
o Restrict which apps may be installed via an allowlist or blocklist
o Restrict permissions assigned to each app
o Automatically install, update, or remove apps on a mobile device
o Keep a current inventory of all apps installed on each device
· Organisations can consider Mobile Application Vetting (MAV) solutions, that typically conduct automated tests and analyses on applications prior
to deployment into the organizational environment. This can be applied to both in-house developed and 3rd party applications.
|
4. Mobile device security policies
Why is this important:
· Security policies provide a clear course of action for organizations to follow when deploying new
technologies, responding to security incidents, remediating issues, etc.
| What should the organization do:
· Mobile device security policies can be established according to the organization’s security needs.
· Mobile device security policies should define device configuration requirements for mobile devices that access organizational data.
o Organisations may reference suggested secure mobile device configuration
guidance from established entities such as Center for Internet Security (CIS)
| What should device owners do:
· Device owners should be made aware of all organizational mobile device security policies prior to deploying or onboarding their mobile
device onto the organizational environment, and signal their acknowledgement of the policy.
Mobile Security Recommendation
| ****
End User Organisation Responsibility
| ****
Device Owner Responsibility
---|---|---
| benchmarks, which are best-practice security configuration guides
· Mobile device security policies should define standards, procedures, and restrictions for end users accessing organizational resources. These policies should address the following domains:
o Access control – e.g. all mobile devices connecting to organisational resources must be pre-approved and in compliance with the organization’s security policies
o Mobile Device Management – e.g. device owners shall allow the organisation to
install software/agents and collect telemetry from the device
o Security – e.g. device owners must employ reasonable physical security measures to secure mobile devices from being lost or stolen
o Organisational Protocol – e.g. device owners agree to immediately report to his/her manager on any incident or
suspected incidents of unauthorized data access, device loss, data loss, and/or
disclosure of company resources, databases, networks, etc.
· Organisations should regularly review mobile device security policies to prevent weak or outdated security policies.
|
Mobile Security Recommendation
| ****
End User Organisation Responsibility
| ****
Device Owner Responsibility
---|---|---
A.3 Assets: Data
5. Data Storage & Privacy
Why is this important:
· Protecting the privacy of
employees and their personal data stored on their mobile devices is important in enabling the organization’s BYOD policy.
| What should the organization do:
· Organisations should clearly communicate BYOD policies to organizational leaders and employees to obtain support and provide transparency in
deploying BYOD
· Organisations should maintain the privacy of employees by:
o Providing concise and understandable
information about what data is collected from mobile devices
o Only storing or collecting data when
necessary for transactions to reduce the impact of potential breaches
o Securely storing data
· Organisations should refer to and comply with local data retention laws and regulations when collecting data and telemetry from mobile devices in the organizational environment. Commonly used standards and data retention laws include (but are not limited to):
o Personal Data Protection Act (PDPA)
o General Data Protection Regulation (GDPR)
o Payment Card Industry Data Security Standard (PCI DSS)
| What should device owners do:
· Device owners are responsible for their own personal data, and should ensure that their personal photos, documents, location
information and other data is kept private and
inaccessible to others, including the organization
· For storing sensitive data securely:
o Device owners may leverage device
encryption to ensure the confidentiality of their mobile data
o Otherwise, local storage options such as databases or files on the device itself can be used. This is a less secure option.
Mobile Security Recommendation
| ****
End User Organisation Responsibility
| ****
Device Owner Responsibility
---|---|---
A.4 Secure/Protect: Virus and malware protection
6. Antivirus applications for mobile devices
Why is this important:
· Antivirus applications are
typically able to conduct malware detection, phishing detection, and network protection, amongst other features.
| What should the organization do:
· Organisations should encourage device owners to install antivirus applications on their mobile
devices. Installation of antivirus applications may also be included as part of organizational mobile device security policies, ensuring compliance before mobile devices are allowed to connect to
organizational resources.
| What should device owners do:
· Device owners should install antivirus
applications on their mobile device, and conduct regular automated or regular scans to detect and fix any issues
· Device owners may take reference to CSA’s 5th National Cybersecurity Campaign, which
includes a list of mobile antivirus applications that have been tested and assessed on their effectiveness in Singapore’s current threat
landscape.
· Device owners may also install ScamShield, an app that detects scam messages and blocks scam calls
A.5 Secure/Protect: Access Control
7. Strong mobile authentication
Why is this important:
· Digital identity security threats, such as unauthorized access,
impersonation, and other types of fraudulent claims, pose a risk to organizational resources.
· It is important for organizations to enforce and employ the
appropriate authenticators based on the assurance level required
| What should the organization do:
· Organisations should implement and enforce strong authentication requirements to access
organizational resources.
· Organisations should implement Multi-Factor Authentication (MFA) for high-risk transactions
using two or more of the following authentication factors:
o Something-you-Know: Information the user knows such as passwords, PIN, patterns, etc.
| What should device owners do:
· Device owners are responsible for authentication on their personal device, and should enable
strong lock-screen authentication such as biometric authentication to prevent
unauthorized access to their mobile device.
Additional measures:
· Device owners can consider using credential management tools/software to protect any authentication credentials from unauthorized disclosure
Mobile Security Recommendation
| ****
End User Organisation Responsibility
| ****
Device Owner Responsibility
---|---|---
to access organizational
resources and digital services.
| o Something-you-Have: This requires the user to possess a physical device, application, or token that generates a time-based One-
Time Password (OTP) such as software tokens, hardware tokens, etc.
o Something-you-Are: This involves biometric authentication where the user’s unique physical characteristics are used for
verification such as fingerprints, facial recognition, etc.
o Further details on the implementation of the above authentication factors can be found in CSA’s “Safe App Standards”
· Organisations should implement and enforce policies and practices that govern the use of authenticators, for e.g. implementing a strict
password policy that requires users to set strong passwords and rotate them regularly
Additional measures:
· Organisations can consider partitioning the functionality of digital services to allow less sensitive data/functions to be available at lower levels of assurance.
· Organisations can consider additional requirements on authentication:
o Rate limiting to limit consecutive failed authentication attempts
|
Mobile Security Recommendation
| ****
End User Organisation Responsibility
| ****
Device Owner Responsibility
---|---|---
A.6 Secure/Protect: Secure Configuration
8. Secure mobile connections to organizational resources
Why is this important:
· Secure mobile connections to organisational resources to reduce the risk of data breaches,
unauthorized access, or
eavesdropping of organizational information, all of which could result in financial, reputational, and legal consequences to the organization.
| What should the organization do:
· Organisations should leverage strong encryption technologies such as a Virtual Private Network
(VPN) to protect the confidentiality and integrity of the organization’s communications, as well as
mutual authentication mechanisms to verify the identities of both endpoints before transmitting data
· Organisations should prohibit the use of unsecured Wi-Fi networks
Additional Measures:
· VPNs can assist in ensuring all organisation-approved applications on mobile devices rely on TLS and are unable to be downgraded to HTTP.
| What should device owners do:
· Device owners should not use unsecure Wi-Fi networks when connecting to enterprise
resources (e.g. public Wi-Fi)
A.7 Update
9. Rapid adoption of software updates
Why is this important:
· Software updates provide new features and address newly
discovered security vulnerabilities
| What should the organization do:
· Organisations should enforce the rapid adoption of software updates of organisation in-house
developed applications, or any 3rd party
applications utilized by the organization. This can be done via restricting access to organizational
resources from devices with outdated applications.
| What should device owners do:
· Mobile device owners should rapidly adopt security updates and patches of applications and device OS
Mobile Security Recommendation
| ****
End User Organisation Responsibility
| ****
Device Owner Responsibility
---|---|---
A.9 Respond: Incident response
10. Revocation of access to organizational resources
Why is this important:
· In the event of a cyber-attack, data breach, or device loss, organizations should have security policies and rules that
influence remediation actions for mobile devices
· Remediation actions may span a spectrum of possibilities ranging from notifying the affected
individuals to revoke access to organizational resources
| What should the organization do:
· Organisations should develop a clear incident
response plan that includes remediation actions to be taken in the event of a mobile-related security
incident, and ensure that the plan is made accessible to all employees
· Organisations should notify users in the event of a cyber-attack or breach via channels such as push notifications or SMS
· Organisations should temporarily revoke access to organizational resources of affected individuals and devices while the issue is being remediated to
minimize potential unauthorized access to organizational resources by malicious actors
| What should device owners do:
· Mobile device owners who are suspicious that
their device may have been compromised should immediately notify appropriate parties such as CISOs, Reporting Officers, or IT support to obtain guidance on the necessary steps to address the
issue
Annex B: Additional Cybersecurity Tools
**** The following table covers additional cybersecurity tools that organizations may consider. These cybersecurity tools will aid in fulfilling the Cyber Essentials clauses.
Additional Cybersecurity Tools
|
Recommendation
---|---
Device Management Systems
· Device management is most commonly
implemented via systems such as Mobile Device Management (MDM) and Enterprise Mobility Management (EMM) solutions.
· These systems offer a range of security
capabilities, and aid in mitigating threats to the organization’s use of mobile devices, such as
information disclosure arising from device
loss/theft, insecure access of organizational resources via misconfigured or compromised devices, and more
| · Organisations can consider using Device Management Systems such as MDM and EMM, that offer a wide range of capabilities. Organizations should identify the capabilities required to work effectively within their organization before acquiring a Device Management System.
· Device Management Systems should minimally be able to:
o Support the mobile devices deployed in the organization’s environment
o Enforce security policies on a mobile device, which can configure or restrict the use of mobile functionality and security capabilities
o Define and enforce user and device authentication
o Define and enforce protections for data communications and on-device data storage
o Integrate with the organization’s infrastructure (i.e. any on-promise operations, support for a SaaS model, or product certifications/accreditations and 3rd party service
integrations)
Mobile threat defense (MTD)
· MTD systems typically are able to detect network-based attacks (e.g. MITM), application-based attacks (e.g. malicious, sideloaded apps), phishing attacks, and more
· These systems can offer multiple remediation approaches in the event of an attack attempt, data breach, or compromised device
| · Organisations should consider implementing Mobile Threat Defence (MTD) systems to detect and protect mobile devices, apps, and end users against attacks.
· MTD systems should minimally have the following capabilities:
o Malware detection,
o Phishing detection, and
o Network protection (Wi-Fi scanning)
· MTD systems may be integrated with existing mobile device management systems in the organization to enable user and administrator alerts, automated response to remediate detected vulnerabilities, or quarantine apps and devices
Mobile Application Development Security
· Mobile Application Development Security
includes necessary security controls and best practices to better protect applications, and in turn, their end users
| · Application development is more commonly outsourced to app developers and providers
· If organisations intend to develop their own in-house applications, they should refer to CSA’s Safe App Standard which provides a common benchmark and guidance on securing
applications and end users against common malware and phishing attempts
---|---