SRG-OS-000034 |
CCI-000085 |
The operating system must monitor for
unauthorized connections of mobile devices to organizational
information systems. |
Mobile devices include portable storage
media (e.g., USB memory sticks, external hard disk drives)
and portable computing and communications devices with
information storage capability (e.g., notebook/laptop
computers, personal digital assistants, cellular telephones,
digital cameras, audio recording devices).
Organization-controlled mobile devices include those devices
for which the organization has the authority to specify and
the ability to enforce specific security requirements. Usage
restrictions and implementation guidance related to mobile
devices include, configuration management, device
identification and authentication, implementation of
mandatory protective software (e.g., malicious code
detection, firewall), scanning devices for malicious code,
updating virus protection software, scanning for critical
software updates and patches, conducting primary operating
system (and possibly other resident software) integrity
checks, and disabling unnecessary hardware (e.g., wireless,
infrared). In order to detect unauthorized mobile device
connections, organizations must first identify and
document what mobile devices are authorized. |