Page 623 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

media of a device can be encrypted, this is usually a worthwhile feature
to enable. However, encryption isn’t a guarantee of protection for data,

especially if the device is stolen while unlocked or if the system itself
has a known backdoor attack vulnerability.

Voice encryption may be possible on mobile devices when Voice over
Internet Protocol (VoIP) services are used. VoIP service between
computer-like devices is more likely to offer an encryption option than
VoIP connections to a traditional landline phone or typical mobile

phone. When a voice conversation is encrypted, eavesdropping
becomes worthless because the contents of the conversation are
undecipherable.

Remote Wiping

It’s becoming common for a remote wipe or remote sanitation to be
performed if a device is lost or stolen. A remote wipe lets you delete all
data and possibly even configuration settings from a device remotely.
The wipe process can be triggered over mobile phone service or

sometimes over any internet connection. However, a remote wipe isn’t
a guarantee of data security. Thieves may be smart enough to prevent
connections that would trigger the wipe function while they dump out
the data. Additionally, a remote wipe is mostly a deletion operation.
The use of an undelete or data recovery utility can often recover data
on a wiped device. To ensure that a remote wipe destroys data beyond
recovery, the device should be encrypted. Thus, the undelete operation

would only be recovering encrypted data, which the attacker would be
unable to decipher.

Lockout

Lockout on a mobile device is similar to account lockout on a company
workstation. When a user fails to provide their credentials after
repeated attempts, the account or device is disabled (locked out) for a
period of time or until an administrator clears the lockout flag.

Mobile devices may offer a lockout feature, but it’s in use only if a
screen lock has been configured. Otherwise, a simple screen swipe to
access the device doesn’t provide sufficient security, because an
authentication process doesn’t occur. Some devices trigger ever longer