Encryption of data-at-rest, Encryption of data-at-rest, On device data, Lost or stolen screen lockout policy, Physical security physical security, asset loss device password policy, physical password/pin policy security Lost or stolen On device data Physical security Encryption of data-at-rest Encryption of data-at-rest hard drive Lost and stolen Removable media Physical security Encryption of data-at-rest Encryption of data-at-rest media Malware Removable media N/A N/A AM/AV, Disable Autorun transport Corporate Malware N/A DNS/URL/IP blacklisting AM/AV, device hardening credentials Corporate App spoofing N/A DNS/URL/IP blacklisting App whitelisting credentials Anti-malware, Device ransom, jail break detection and online ad theft, Patching, DNS/URL/IP Malware N/A reversal, patching, credential theft, blacklisting application black listing, data theft DNS/URL/IP blacklisting Accidental data User saves to N/A Data-in-transit DLP Data-in-transit DLP exfiltration insecure site Accidental data Delete of N/A N/A Backup where applicable deletion network master Domain credentials required, blocking inbound remote Credentials not access tools (such as LogMeIn, Terminated terminated upon N/A N/A TeamViewer), application employee end of blacklisting, 802.1x (Wireless employment Auth), JIT access where applicable 48-hour delay Remove where supported: Terminated before Email sync, O365 access, N/A N/A employee credentials are remote access, RMS protected invalid docs access,
On device data, asset loss Lost or stolen device Physical security Encryption of data-at-rest, physical security, password/pin policy Encryption of data-at-rest, screen lockout policy, password policy, physical security On device data Lost or stolen hard drive Physical security Encryption of data-at-rest Encryption of data-at-rest Removable media Lost and stolen media Physical security Encryption of data-at-rest Encryption of data-at-rest Removable media Malware transport N/A N/A AM/AV, Disable Autorun Corporate credentials Malware N/A DNS/URL/IP blacklisting AM/AV, device hardening Corporate credentials App spoofing N/A DNS/URL/IP blacklisting App whitelisting Device ransom, online ad theft, credential theft, data theft Malware N/A Patching, DNS/URL/IP blacklisting Anti-malware, jail break detection and reversal, patching, application black listing, DNS/URL/IP blacklisting Accidental data exfiltration User saves to insecure site N/A Data-in-transit DLP Data-in-transit DLP Accidental data deletion Delete of network master N/A N/A Backup where applicable Terminated employee Credentials not terminated upon end of employment N/A N/A Domain credentials required, blocking inbound remote access tools (such as LogMeIn, TeamViewer), application blacklisting, 802.1x (Wireless Auth), JIT access where applicable Terminated employee 48-hour delay before credentials are invalid N/A N/A Remove where supported: Email sync, O365 access, remote access, RMS protected docs access,
7863_Creating_security_controls_for_IoT_devices_at_Microsoft.docx