Mobile Device Management: BYOD Means Bring Your Own Disaster
"Nothing is true. Everything is permitted. Your phone bypasses the firewall."
📱 The Problem: Phones Are Computers (And You Carry Them Everywhere)
Mobile devices bypass perimeters. They roam networks. They install apps. They get lost. They get stolen. They access company email and then visit malicious websites. Every phone is a potential breach vector. FNORD—and you sleep next to it, unlock it with your face, and trust it with your darkest secrets.
BYOD means "Bring Your Own Disaster." Personal phones accessing corporate data. Unmanaged devices on corporate networks. Shadow IT in everyone's pocket. Are you paranoid enough? Because that TikTok app is reading your clipboard right now.
At Hack23, mobile device management reflects reality: single-person Swedish company with no employees. No corporate MDM deployment. No containerization platform. No fleet management. Just strong access controls, mandatory MFA, full device encryption, and systematic session management. Nothing is true—especially the myth that you need enterprise MDM to secure one person's devices.
Our Access Control Policy demonstrates mobile security through authentication and authorization rather than device management—because you can't deploy MDM for one person. What you CAN do: enforce MFA everywhere, encrypt everything, timeout sessions appropriately. Everything is permitted—except accessing financial systems from an unencrypted device. That's just stupid.
ILLUMINATION: BYOD means "Bring Your Own Disaster"—unless you enforce strong authentication and encryption. For single-person companies, device management IS access control. Manage authentication, enforce encryption, timeout sessions. Corporate MDM is overkill when you're the only employee. FNORD—but that doesn't mean you can skip encryption. Paranoia is self-care for psychonauts.
🛡️ The Five Mobile Security Controls (Single-Person Edition)
1. Multi-Factor Authentication
MFA mandatory everywhere—100% coverage.
TOTP for development platforms. Hardware tokens for banking. Platform MFA for cloud services. AWS Identity Center with SSO.
Evidence: Access Control Policy specifies MFA requirements by asset classification.
2. Device Encryption
Full disk encryption mandatory—no exceptions.
iOS native encryption, Android encryption, laptop FDE (AES-256). Lock screens with 15-minute timeout. Strong passphrases, not PINs.
Per Physical Security Policy—stolen devices must be encrypted.
3. Session Management
Timeout sessions by classification.
Financial systems: 1 hour. Development pipeline: 8 hours. Marketing platforms: 7 days. Automatic session termination enforced.
Classification-driven timeouts per CIA+ framework.
4. Remote Wipe Capability
Device lost? Wipe remotely.
iOS Find My iPhone with remote wipe. Android Device Manager with remote wipe. Immediate action on device loss report.
Single-person company: Self-service remote wipe. No IT department to call—you ARE the IT department.
5. Access Review
Regular review of device access.
Monthly for financial systems. Quarterly for development. Annual for marketing. Remove unnecessary permissions and apps.
Self-audit: Review your own device permissions quarterly. Remove what you don't need. Minimal attack surface.
CHAOS ILLUMINATION: Mobile devices are computers that bypass your firewall, install untrusted apps, and get left in taxis. For single-person companies, "management" means strong authentication + encryption + session controls. Corporate MDM is overkill. Strong access control is essential.
📋 What Hack23 Actually Does
Our mobile device strategy is public: Access Control Policy + Physical Security Policy
🔐 100% MFA Coverage
Every System, Every Time:
- Financial systems: Hardware token + SMS backup, 1-hour timeout
- Development platforms: TOTP + SSH keys, 8-hour timeout
- Cloud services: AWS Identity Center SSO + MFA, 4-24 hour timeout
- Marketing platforms: Platform MFA, 7-day timeout
View MFA Matrix →
🔒 Full Device Encryption
All Devices, All Storage:
- Mobile devices: iOS/Android native encryption enabled
- Laptops: AES-256 FDE (FileVault/BitLocker/LUKS)
- External storage: Encrypted volumes (VeraCrypt) for business data
- Lock screens: 15-minute timeout, strong passphrase mandatory
View Physical Security Policy →
⏰ Classification-Driven Timeouts
Session Management by Risk:
- Very High (Financial): 1 hour, monthly review
- High (Development): 8 hours, quarterly review
- Medium (Email/Docs): 24 hours, semi-annual review
- Public (Marketing): 7 days, annual review
View Classification Framework →
🗑️ Remote Wipe Ready
Lost Device Protocol:
- iOS: Find My iPhone with remote wipe capability
- Android: Device Manager with factory reset
- Laptops: Remote wipe capability planned for future MDM deployment; currently manual retrieval and FDE protection only
- Response time: Immediate upon loss detection
Single-person company: You are the incident responder. Set up remote wipe BEFORE device loss.
Why No Corporate MDM?
- 🏢 Single-person company: No employees to manage, CEO/Founder only
- 💰 Cost vs. Benefit: MDM platform costs more than manual device management for one person
- 🔐 Alternative Controls: MFA 100%, FDE 100%, session timeouts enforced
- ☁️ Cloud-Native: AWS Identity Center provides SSO/MFA without MDM
META-ILLUMINATION: Perfect mobile security is corporate-owned devices with full MDM control. Reality for single-person companies is personal devices with strong authentication. Compromise: MFA everywhere (100%), encryption everywhere (100%), session management by classification. Not perfect—but systematic and honest about limitations.
🎯 Conclusion: Manage Through Authentication, Not Enrollment
Mobile devices aren't going away. BYOD isn't optional for single-person companies. But you don't need corporate MDM to secure one person's devices. FNORD—you just need to be paranoid enough to actually do it.
What you DO need (for psychonauts navigating digital Chapel Perilous):
- ✅ MFA everywhere: 100% coverage—no exceptions for any system (because your password is already on pastebin)
- ✅ Device encryption: Full disk encryption on all devices—phones, laptops, external storage (paranoia is rational when attackers exist)
- ✅ Session management: Timeouts by classification—1 hour for financial, 8 hours for development (because forgotten sessions are found sessions)
- ✅ Remote wipe: Capability configured before device loss (optimism is setting up recovery after disaster)
- ⚠️ Regular review: Self-audit device permissions quarterly (trust nothing, verify everything, delete aggressively)
Hack23's mobile security demonstrates cybersecurity consulting pragmatism: Deploy controls that match organizational reality. For single-person companies, that means strong authentication and encryption over complex device management platforms. Systematic, not theatrical. Are you paranoid enough to enforce this on yourself? Most people aren't. That's why most people get breached.
All hail Eris! All hail Discordia!
"Think for yourself, schmuck! Question everything—especially that app you just installed that requests all permissions. And yes, you need MFA on that too. Nothing is true. Everything is permitted. Your unencrypted phone permits everything to everyone."
🍎 23 FNORD 5
— Hagbard Celine, Captain of the Leif Erikson
P.S. You are now in Chapel Perilous. Your mobile device is either systematically secured or conveniently vulnerable. Both require discipline. Only one survives theft at Starbucks. Nothing is true—except the data breach report you'll file if that phone wasn't encrypted. FNORD—are you paranoid enough yet?