Chapter 17 — Device trust

Chapter 17 — Device trust

Lesson map

Lesson 17 published. Map, example, EX049.

flowchart TD
  N0["Learning outcomes"]
  N1["17.1 Managed devices"]
  N2["17.2 Access rules"]
  N3["17.3 Personal phones"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX049"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["17.1 Managed devices"]
  N2["17.2 Access rules"]
  N3["17.3 Personal phones"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX049"]

[Learning outcomes]
    |
    v
[17.1 Managed devices]
    |
    v
[17.2 Access rules]
    |
    v
[17.3 Personal phones]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX049]

Learning outcomes

You will (1) explain managed and unmanaged devices; (2) set device-based access rules; (3) handle personal phones.

17.1 Managed devices

A managed device is enrolled with Fernhill's device management, which keeps it updated, encrypted and lockable. Kai finds that clinic workstations are managed but 14 staff use personal laptops at home for rota planning and email. He explains that an unmanaged device may have outdated software or be shared with family, so the directory cannot be sure the session is safe. Knowing which devices are managed is the first step to deciding what each may reach. Kai records each device's owner and status in a short register.

17.2 Access rules

Kai sets rules: clinical and payroll systems are reachable only from managed devices; email and rota planning are allowed from personal devices through a browser, with downloads blocked. Admin accounts work only from managed devices. These rules follow the zero trust idea in NIST SP 800-207, that access decisions should consider the device and context, not just the network. Kai keeps the rules few and clear so staff understand what works where. He tests the rules with three staff before rollout. A short notice tells staff what changed and why.

17.3 Personal phones

Many staff use personal phones for authenticator apps and email. Kai uses app protection for email, which keeps work data inside the work app and can be wiped without touching personal data. For staff who prefer not to use personal phones, Fernhill provides a hardware security key. Offering choices respects privacy while keeping protection, and Kai records which option each person chose so support staff know how to help when a device is lost. Lost keys follow the recovery process described later in this book.

Worked example

14 staff use personal laptops; clinical and payroll access is limited to managed devices, and 6 staff choose hardware keys instead of phones.

Synthetic case. Devices and counts are synthetic; NIST SP 800-207 is a real source.

Errors and limits

Wiping a whole personal phone to remove work data invades privacy and discourages reporting losses.

Exercises

• EX049 — Clinical access rule. Where can clinical systems be reached from? Rubric: 3 = managed devices only;; 2 = managed;; 1 = anywhere;; 0 = none.
• EX050 — Zero trust source. Which source describes zero trust? Rubric: 3 = NIST SP 800-207;; 2 = 800-207;; 1 = 800-63B;; 0 = none.
• EX051 — Phone alternative. What is offered to staff who prefer not to use personal phones? Rubric: 3 = hardware security key;; 2 = key;; 1 = vague;; 0 = none.

Synthesis

Device-aware rules let staff work flexibly while keeping sensitive systems on trusted devices.

Continue studying — chapter 17 of 30

← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →