Endpoint Protection · Topic 6 of 9
Enterprise Mobile Policies, Risks and Management
Compare BYOD, COPE and CYOD mobile policies, their risks and guidelines, and the MDM, MAM and UEM solutions that enforce enterprise mobile security.
- 4 min
- BYOD gives the least control, and COBO the most.
- MDM manages devices, MAM manages apps, EMM and UEM combine and extend them.
- Containerization separates work and personal data.
What it is
Employees use smartphones and tablets to read email, open documents and reach company applications. An enterprise mobile usage policy decides which devices are allowed, who owns them and what the user must accept. Each choice changes the risk, and management tools enforce the rules.
How it works
Common mobile usage policies
| Policy | Meaning | Control for the company |
|---|---|---|
| BYOD (bring your own device) | Employee owns and uses a personal device for work | Lowest. Privacy limits what IT can do. |
| CYOD (choose your own device) | Employee picks from an approved list of devices | Medium |
| COPE (corporate owned, personally enabled) | Company owns the device and allows personal use | High |
| COBO (corporate owned, business only) | Company owns the device and permits business use only | Highest |
BYOD saves cost and is popular, but it mixes personal and corporate data on a device the company does not fully control.
Security risks and challenges
- Lost or stolen devices exposing stored data.
- Data leakage through personal apps, cloud backup or screenshots.
- Malicious or over permissioned apps, including those installed from outside the official store.
- Unsecured networks: public Wi-Fi allows eavesdropping and rogue access points.
- Outdated operating systems that no longer receive patches.
- Jailbroken or rooted devices that bypass built in protections.
- Phishing and smishing by email, text and messaging apps.
- Shadow IT and unmanaged cloud services.
- Legal and privacy issues when personal data sits next to company data, and what happens at employee departure.
- Scale and diversity: many models, versions and vendors are hard to support consistently.
Guidelines to reduce the risk
- Publish a written policy that the user must accept, covering acceptable use, ownership, monitoring and the right to wipe corporate data.
- Require a screen lock with a PIN, password or biometric, plus automatic lock after a short idle time.
- Require device encryption and keep the OS and apps updated.
- Allow apps only from official stores and block rooted or jailbroken devices.
- Require a VPN or secure connection for corporate access, and avoid sensitive work on public Wi-Fi.
- Turn off unneeded radios (Bluetooth, NFC) when not in use.
- Enable remote locate, lock and wipe.
- Separate work and personal data and use multifactor authentication.
- Train users on phishing and lost device reporting.
- Back up work data and define what happens at offboarding.
Enterprise mobile security management solutions
| Solution | Scope |
|---|---|
| MDM (mobile device management) | Manages the whole device: enforces passcodes and encryption, pushes settings, locates, locks or wipes |
| MAM (mobile application management) | Manages specific apps and their data, which is useful for BYOD |
| MCM (mobile content management) | Controls corporate documents |
| EMM (enterprise mobility management) | Combines MDM, MAM and content management |
| UEM (unified endpoint management) | Manages phones, laptops and other endpoints from one console |
| Containerization / work profile | Creates a protected, separate space for corporate apps and data |
| Mobile threat defense (MTD) | Detects malicious apps, network attacks and device compromise |
| Conditional access | Grants access only to compliant, enrolled devices |
On a BYOD phone, a work container lets IT wipe only the company data (a selective wipe) and leave personal photos alone. A fully managed company device allows a full wipe.
A worked example
A sales team uses personal phones. IT selects MAM with a work profile, requires a PIN and encryption for the work profile, and sets conditional access so only compliant devices reach company email. When a phone is lost, IT performs a selective wipe of the company data.
How the exam asks about this
- "Which policy lets employees use their own phones for work?" → BYOD.
- "Which solution can remotely wipe only corporate apps and data?" → MAM or a work container with a selective wipe.
- "Which technology manages many types of endpoints from one console?" → Unified endpoint management (UEM).
What to remember for the exam
- BYOD gives the least control, and COBO the most.
- MDM manages devices, MAM manages apps, EMM and UEM combine and extend them.
- Containerization separates work and personal data.
- Screen lock, encryption, updates and remote wipe are baseline controls.
- Jailbreaking or rooting weakens the device security model.
A full device wipe on a personal phone can destroy the employee's personal data and cause legal problems. For BYOD, the answer is usually a selective wipe.
Common mistakes
Assuming MDM and MAM are the same. MDM controls the device, MAM controls apps and their data.
Writing no policy. Without an accepted policy the company may have no right to monitor or wipe.
Ignoring rooted devices. A rooted phone can bypass the controls MDM relies on, so compliance checks must detect it.
Check yourself
What does COPE stand for?
Corporate owned, personally enabled.
Why use a work container on BYOD devices?
It separates corporate data from personal data and allows a selective wipe.
Which control stops non compliant devices from reaching corporate email?
Conditional access based on device compliance.
Topic 6 of 9 in Endpoint Protection
Test yourself on Endpoint Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.