ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

In spaces that process highly sensitive information, best practice is to prevent any personal mobile or IoT device from entering rather than trying to secure each potential threat. NIST guidance on mobile device security and physical protection of information systems recommends prohibiting or isolating personally owned wireless devices in controlled areas or requiring them to be stored in tamper-resistant, radio-frequency-shielded containers outside the secure zone. Mandating placement of phones and wearables in monitored, RF-shielded lockers at the entrance directly eliminates their ability to connect to or eavesdrop on Bluetooth-enabled sensors and aligns IT security with physical access controls.

Mobile device management, improved Wi-Fi security, or host-based firewalls on the IoT sensors help reduce some risks but do not stop radio-frequency attacks or the introduction of rogue wireless bridges once the personal devices are inside. Only physically barring or shielding the devices keeps them from threatening the lab's confidentiality and integrity, making this the most effective option.