More Security Controls You Won’t See in SP 800-53

Posted August 16th, 2007 by

AC-23 Self-Destructing Mobile Devices
The organization equips all mobile devices with self-igniting devices so that they are destroyed upon command.

Supplemental Guidance:
Contrary to what Adam Shostack believes, data breaches are not good for the US Government. Therefore, it is of the utmost importance that we not allow a data breach ala VA, TSA, and others.

Control Enhancements:
(1) The organization configures mobile devices to be destroyed when they are outside of a government facility. (2) The organization configures mobile devices to be destroyed when they are outside of arms reach of the registered owner. (3) The organization configures mobile devices to be destroyed at random to discourage users from putting data on them.

Low: PS-9 Moderate: PS-9(1)(2) High: PS-9(1)(2)(3)

Similar Posts:

Posted in FISMA, Odds-n-Sods, The Guerilla CISO | 4 Comments »

4 Responses

  1.  Bosco the CISSP Says:

    I think you missed something, with AC-23 Self-Destructing Mobile Devices

    It would appear that the control is secretly in place. After all, you have been reading about all of the exploding batteries and the recalls?

    Just what do you think the Pentagon is doing with all of that “Black Program” development money?

  2.  Adam Says:

    While I’m all in favor of preventing breaches, I think breaches and breach notices are good for the US government.

  3.  rybolov Says:

    Hi Adam

    I’m all for notification, too. It’s the only way to solve the root causes which are why are we collecting the information in the first place, why aren’t we protecting what we do collect, and how do we get people to understand the “public health” model instead of the “zero defects” model.

    I’m also a big fan of your security breach studies and I’ll take any opportunity to link to it, even if it’s in a tongue-in-cheek blog post. =)

  4.  Fergie Says:

    Nothing new or profound here …

    Big Daddy DRNSA has been doing it for years … it was only a matter of time before it transitioned (overtly) to the private sector.

Leave a Comment

Please note: Comment moderation is enabled and may delay your comment. There is no need to resubmit your comment.

Visitor Geolocationing Widget: