Mobile Data Loss Prevention

[ClaudiusR]

Good afternoon, or morning or what have you.

I am trying to make some decisions for my company in regards to Data loss prevention for our corporate devices. I have seen some articles about an exploit called juice jacking, and have even been able to replicate it in a closed environment, though on an older Samsung device. When we tested on a Google Pixel 4a our attempt was stopped by a software application that didn't allow data transfer without changing the setting to allow this. My question is, would it be worth the purchase of USB data stoppers, or is the built-in software to handle the safety from such an exploit sufficient?

Thank you in advance for any help. I just finished an IT and SEC+ program and am still new to the CyberSec world.

-Claudius

[denbesten]

For DLP, i would focus on a single, broader message.....   "Use only company equipment to process company data".

In the specific case of data-blockers, users are likely to complain about "one more dongle".  So, instead I would purchase travel batteries so employees can remain mobile throughout the day and jack-in during sleeping hours, at which time there is less resistance to pulling out the "company charger".

In a similar vein, I encourage users to hot-spot off their mobile phone instead of hunting down a Starbucks with a working WiFi.   In doing so, I explain that this not only reduces MITM risks, but it also tends to have fewer combability issues with the corporate VPN. 

Both approaches play into the broader "use our stuff to process our data" message, both leverage multiple rationales for different audiences, and both carry an underlying tone that we too value convenience.