Mobile, Wireless, and IoT Device Security is the discipline of identifying, classifying, and protecting information assets that reside on or transit through portable computing devices (smartphones, tablets, laptops), wireless networks (Wi-Fi, Bluetooth, 5G/LTE, Zigbee), and purpose-built connected devices (sensors, cameras, industrial controllers, wearables, smart meters). Within the ISACA CISA framework it is a core sub-domain of Domain 5 — Protection of Information Assets, covering the policies, technical controls, and lifecycle management practices that prevent unauthorized access, data exfiltration, service disruption, and compliance violations arising from these device categories. The discipline spans three converging threat surfaces: (1) the device itself — hardware, firmware, and OS; (2) the wireless communication channel; and (3) the back-end infrastructure that receives, stores, and processes device-generated data.
Where it stops · what it isn't
- —INCLUDES: MDM/UEM policy design and enforcement; wireless encryption standards (WPA3, TLS 1.3); IoT device inventory and lifecycle management; BYOD risk frameworks; mobile app security; zero-trust access for mobile and IoT endpoints; OT/IT IoT convergence controls
- —INCLUDES: Threat vectors specific to mobile, wireless, and IoT — rogue access points, Bluetooth sniffing, firmware exploits, SMS phishing (smishing), mobile malware, botnet recruitment of IoT devices
- —EXCLUDES: General server and cloud endpoint hardening (Network and End-Point Security cubelet); mobile application secure coding practices (Secure SDLC cubelet); cryptographic algorithm design (Data Encryption cubelet)
- —EXCLUDES: Physical device security (Physical and Environmental Controls cubelet); enterprise identity federation beyond mobile-specific authentication (Identity and Access Management cubelet)
- —DISTINGUISHED FROM general endpoint security: mobile and IoT devices have constrained resources, heterogeneous OS environments, always-on connectivity, and physical mobility that produce a fundamentally different threat model from traditional workstations
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFProtection of Information Assets (CISA Domain 5)
REQUIRESNetwork and End-Point SecurityIdentity and Access Management
RELATED TOData Loss PreventionData EncryptionSecurity Incident Response
ENABLESZero-Trust Architecture Implementation
CONSTRAINSBYOD Policy and Governance