Posts RSS
Subscribe via Email
More Security Controls You Won’t See in SP 800-53
Posted August 16th, 2007 by rybolov
AC-23 Self-Destructing Mobile Devices
Control:
The organization equips all mobile devices with self-igniting devices so that they are destroyed upon command.
Supplemental Guidance:
Contrary to what Adam Shostack believes, data breaches are not good for the US Government. Therefore, it is of the utmost importance that we not allow a data breach ala VA, TSA, and others.
Control Enhancements:
(1) The organization configures mobile devices to be destroyed when they are outside of a government facility. (2) The organization configures mobile devices to be destroyed when they are outside of arms reach of the registered owner. (3) The organization configures mobile devices to be destroyed at random to discourage users from putting data on them.
Low: PS-9 Moderate: PS-9(1)(2) High: PS-9(1)(2)(3)
Similar Posts:
Posted in FISMA, Odds-n-Sods, The Guerilla CISO | 
4 Comments »
August 16th, 2007 at 5:52 pm
I think you missed something, with AC-23 Self-Destructing Mobile Devices
Control.
It would appear that the control is secretly in place. After all, you have been reading about all of the exploding batteries and the recalls?
Just what do you think the Pentagon is doing with all of that “Black Program” development money?
August 17th, 2007 at 7:58 pm
While I’m all in favor of preventing breaches, I think breaches and breach notices are good for the US government.
August 17th, 2007 at 8:45 pm
Hi Adam
I’m all for notification, too. It’s the only way to solve the root causes which are why are we collecting the information in the first place, why aren’t we protecting what we do collect, and how do we get people to understand the “public health” model instead of the “zero defects” model.
I’m also a big fan of your security breach studies and I’ll take any opportunity to link to it, even if it’s in a tongue-in-cheek blog post. =)
August 26th, 2007 at 10:18 am
Nothing new or profound here …
Big Daddy DRNSA has been doing it for years … it was only a matter of time before it transitioned (overtly) to the private sector.