1. About this guidance

This guidance is divided into four parts:

  1. An introduction to the guidance, its aims, scope, audience and assumptions. This part concludes with a summary of recommended actions for system administrators responsible for deploying End User Devices (EUDs).

  2. A discussion of the philosophy behind the Government’s approach to EUD security and the outline of generic security recommendations which should be considered regardless of the technology platforms adopted.

  3. The implementation guides, which provide platform-specific configuration and risk-management guidance

  4. A final part containing additional considerations which are applicable to all platforms.

2. What is this guidance?

This security guidance describes how devices such as smartphones, laptops and tablets can be configured to meet the Government’s End User Device Security Framework. The purpose of this guide is to:

  1. Provide advice to system administrators deploying devices, helping to balance user needs and expectations with security recommendations and good practice.

  2. Highlight for risk owners any areas where the platform does not meet the Security Framework, and identify key items for consideration when deploying devices in their systems.

3. Guidance Aims

Modern end user devices provide users with great flexibility and functionality - coupled with security technologies to help protect information. The aim of this guidance is to harness these security technologies in a way that does not significantly reduce this functionality. Different devices will expose organisations to different risks and in different ways - by exacerbating existing risks to corporate assets, or introducing new ones. Careful consideration of these risks is important to maintaining information security.

This guidance can also be used as a starting point for other security configurations for different devices such as desktops and servers. System administrators should consider how applicable the recommendations are in such scenarios and customise the guidance accordingly. Following this guidance may therefore help you fulfil your obligations as a data controller.

4. Who is this guidance for?

This material is for UK Public Sector organisations, their agencies and suppliers who are considering deploying different types of devices for mobile or remote working at OFFICIAL.

The guidance is written for system administrators and information risk owners to help them:

  • manage the risks associated with different types of end user device;

  • make informed decisions about the configuration, management, and use of these platforms.

5. How will the guidance be updated?

End user devices evolve rapidly. When newer versions of the platforms are released, organisations should determine whether the technical controls from this guidance are still supported. CESG will continue to assess new versions of the platforms as required and, if necessary, update this guidance to ensure it remains relevant. However, CESG does not intend to publish updated guidance for every subsequently released version.

Minor errors may be corrected as they are found and reported. If you become aware of any errors or inconsistencies then please let us know at the e-mail address platform@cesg.gsi.gov.uk.

6. How will the devices be used?

The primary situation this guidance is for is a mobile knowledge worker (as defined in the EUD documentation). In this, a knowledge worker uses a corporately managed device to access their OFFICIAL email, calendar, collaboration tools, and other enterprise services, whilst in or out of the office.

It is expected that these devices will be personally-issued, meaning only a single user account will be present on each device. Whilst this guidance does not preclude multi-user devices, consideration must be given as to how to customise the configurations detailed in this documentation for multi-user scenarios.

The guidance does not cover the use of these devices in physically high-security environments - or for use at higher classifications. It is recommended that organisations carefully consider the particular risks from allowing OFFICIAL end user devices into such high-security locations.

This guidance also assumes that:

  • users will use the device to access various Internet-based services, both for official and limited personal use

  • users will be made aware of the appropriate use of the system prior to receiving the device

  • some devices will inevitably be lost or stolen (though precautions in this guidance should help ensure that data loss is minimised)

  • devices will connect to a range of trusted networks to access OFFICIAL information

  • networks will be provided by the enterprise, telecoms networks, third-parties (e.g. home, hotel or coffee shop Wi-Fi)

  • any networks that the device connects to will not necessarily be trustworthy, and so protection of the data in transit on these networks is important

  • the device will be deprovisioned when the device no longer needs access to OFFICIAL information

  • when deprovisioned, any sensitive information will be removed and the device’s ability to connect to the enterprise network will be revoked. The device can then be reused, recycled or returned to its owner

Although devices are expected to be corporately managed, the ownership model is not particularly relevant to the remainder of this guidance. The critical aspect is that the enterprise takes over the management of the device via a device provisioning process and is able to control all relevant aspects of it throughout the time it accesses OFFICIAL information.

7. Bring Your Own Device (BYOD)

Whilst enterprise ownership of a device makes many information security aspects much simpler, it is not a prerequisite of this guidance. What is necessary is that the device is placed under the management authority of the enterprise for the complete duration it is permitted to access OFFICIAL information.

To ensure information security when using devices not owned by the enterprise, the enterprise must take control of device management at the point of provisioning, ensuring that the device is placed into a ‘known good’ state prior to allowing it to access OFFICIAL information. Limitations of current technology mean that a ‘health check’ or ‘device status’ check is not sufficient to verify ‘known good’ - malware can easily subvert such a check. If possible, consider returning to an understood state such as by a firmware reinstall or wipe to factory state and replacing any existing configuration on it.

For further information on the risks associated with BYOD, see the Bring Your Own Device guidance.

To get the most from this guidance, you should:

  1. read the guidance for your selected device(s) in full and consider how applicable the usage scenario and recommendations are with your intended use

  2. set up a pilot of devices in a non-operational environment before deployment. Try to simulate as far as possible the environment where the devices will be deployed

  3. determine the business functions that devices need to perform before deciding on the final configuration, and apply security configurations to the device or supporting infrastructure where applicable, based on this guidance.

  4. read and assess the security checklist to track and record the chosen settings for each security task and note which settings are changed to secure the device. This information can be helpful when developing an organisational security standard for mobile devices.

  5. produce security operating procedures, user education packages and training documents to help staff to keep information secure on mobile devices. Particular points of note for each device are included in this guidance, and general advice are provided in the General Security Recommendations section.

  6. establish a helpdesk facility to respond to the loss or theft of devices by performing remote lock or wipe, and revoke their ability to access enterprise information.

  7. prepare a system management plan to deal with security critical updates and patches which will be released by the vendor during the lifecycle of the deployment.

When business or operational needs require deviation from this guidance, these deviations should be evaluated to help determine any additional security risks. Measures should be taken to help monitor or mitigate these risks.

Deployments of multiple device types should also be supported by this guidance, although CESG have not tested this at the time of writing. Rather than having multiple instances of the recommended network architecture for each device type, it is recommended that system administrators merge the suggested networks together to form a single system.