Mobile Platform, IoT, and OT Hacking · Topic 2 of 4
Mobile Device Management and Security
Understand MDM, BYOD and COPE models, mobile security guidelines, and mobile security and testing tools such as MobSF, Frida and Zimperium for CEH v13.
- 4 min
- MDM enforces policy, manages apps, and can lock, wipe and track devices.
- BYOD gives the lowest control, and COBO the highest.
- Containerization separates work data from personal data.
What it is
Mobile Device Management (MDM) is software that lets an organization enroll phones and tablets, set security rules and control them remotely. It is the main way a company keeps control of devices that leave the building.
Mobile security guidelines are the practices users and administrators follow. Mobile security tools protect devices, scan apps or test them. The exam asks which control fits a scenario, and what MDM can and cannot do.
How it works
MDM functions
An MDM platform has a server that talks to an agent or built in management interface on each device.
| Function | What it does |
|---|---|
| Enrollment | Registers a device and its user |
| Policy enforcement | Requires a passcode, device encryption, and blocks risky settings |
| App management | Pushes approved apps, blocks or removes others, can restrict installs to managed stores |
| Remote lock and wipe | Locks a lost device or erases it completely, or only the corporate data (selective wipe) |
| Containerization | Separates work data from personal data on one device |
| Compliance checking | Flags jailbroken or rooted devices and out of date operating systems, and can block them from corporate resources |
| Inventory and reporting | Lists devices, versions and apps |
| Location and tracking | Finds a lost device where the policy allows |
Examples of MDM products include Microsoft Intune, VMware Workspace ONE, Jamf for Apple devices and Ivanti.
Deployment models
| Model | Meaning |
|---|---|
| BYOD (bring your own device) | Employees use personal devices for work. It is cheap but gives the least control. |
| COPE (corporate owned, personally enabled) | The company owns the device and allows personal use |
| COBO (corporate owned, business only) | The company owns it and allows work use only |
| CYOD (choose your own device) | Employees pick from an approved list |
BYOD raises the most privacy and data leakage questions. Containerization and selective wipe are the usual answers, because the company can remove its own data without erasing personal photos.
Mobile security guidelines
- Set a strong passcode or biometric lock with a short auto lock timer.
- Keep the operating system and apps updated.
- Install apps only from official stores and check permissions.
- Do not root or jailbreak.
- Turn off Bluetooth, Wi-Fi and location when not in use, and avoid unknown public Wi-Fi.
- Use a VPN on untrusted networks.
- Encrypt device storage and back up data.
- Enable remote find and wipe.
- Be careful with links in messages and emails.
- Use multi-factor authentication and an authenticator app rather than SMS where possible.
Mobile security and testing tools
| Tool | Role |
|---|---|
| Mobile threat defense apps such as Zimperium and Lookout | Detect malicious apps, risky networks and device compromise |
| Antivirus and anti-malware for mobile | Scan installed apps for known malware |
| MobSF | Automated static and dynamic analysis of Android and iOS apps |
| Frida | Instrumentation toolkit to observe app behavior at run time |
| Drozer | Assesses Android app attack surface |
| Objection | Run time mobile exploration built on Frida |
| zANTI | A mobile penetration testing toolkit from Zimperium |
| Burp Suite | Intercepting proxy to inspect app traffic |
Defenders and testers use many of the same tools. The difference is permission and purpose.
A worked example
A company allows employees to read corporate email on personal phones. A sales manager loses a phone on a train. The phone holds work email and a customer file.
The MDM server shows the device last reported a day ago. The administrator first locks it, then issues a selective wipe so only the managed work container is erased. Because the phone was encrypted and had a passcode, the risk of exposure was low. The policy also flagged the device for follow up with the user.
How the exam asks about this
- "Which MDM action removes only corporate data from a personal phone?" → Selective wipe.
- "Which model lets employees use their own phones for work?" → BYOD.
- "Which tool performs automated static and dynamic analysis of mobile apps?" → MobSF.
What to remember for the exam
- MDM enforces policy, manages apps, and can lock, wipe and track devices.
- BYOD gives the lowest control, and COBO the highest.
- Containerization separates work data from personal data.
- A compliant device is not rooted or jailbroken, is encrypted, and is updated.
- MobSF, Frida and Drozer are analysis tools, and Zimperium and Lookout are threat defense products.
Remote wipe does not prevent theft or a malicious app. It only removes data afterwards, so it must sit alongside encryption and a passcode.
Common mistakes
Thinking MDM replaces user awareness. It sets rules but cannot stop a user entering credentials on a phishing page.
Using SMS codes as the strongest second factor. SIM swap and interception weaken them, so app based authentication is better.
Confusing mobile threat defense with MDM. MDM manages and enforces policy. Threat defense detects attacks.
Check yourself
What is the difference between full wipe and selective wipe?
A full wipe erases the whole device, and a selective wipe removes only the managed corporate data.
Which deployment model gives the company the least control?
BYOD.
Why should MDM flag rooted or jailbroken devices?
Those devices have lost platform protections, so they can be blocked from corporate resources.
Topic 2 of 4 in Mobile Platform, IoT, and OT Hacking
Test yourself on Mobile Platform, IoT, and OT Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.