Delete information from mobile devices
Summary
The system must delete the information from mobile devices after 10 failed authentication attempts.
Description
The purpose of this requirement is to mitigate the risk of data exposure in the event that an unauthorized user gains physical access to the mobile device and then try to brute force authentication by making several attempts systematically.
Supported In
This requirement is verified in following services
| Plan | Supported |
|---|---|
| Essential | 🔴 |
| Advanced | 🟢 |
References
- CWE™-307. Improper restriction of excessive authentication attempts
- CWE™-459. Incomplete cleanup
- ePrivacy Directive-4_1a. Security of processing
- SOC2®-C1_2. Additional criteria for confidentiality
- CCPA-1798_105. Consumer's right to delete personal information
- MITRE ATT&CK®-M1036. Account use policies
- CMMC-AC_L2-3_1_8. Unsuccessful logon attempts
- CMMC-AC_L2-3_1_21. Portable storage use
- CMMC-MP_L2-3_8_7. Removable media
- FedRAMP-AC-7_2. Unsuccessful logon - Purge, wipe mobile device
- FedRAMP-MP-6. Media sanitization
- ISO/IEC 27002-8_1. User endpoint devices
- ISA/IEC 62443-UC-2_3. Use control for portable and mobile devices
- NIST 800-171-1_18. Control connection of mobile devices
- SIG Lite-SL_142. Is there a mobile device management solution in place?
- SIG Core-M_1_25. End user device security
- ISO/IEC 27001-8_1. User endpoint devices
free trial
Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.