Mobile › Module 8 › Lesson 3
Enterprise Controls
Enterprise mobile controls literacy — conditional access, MAM, DLP, attestation — defender stack on $MOB_LAB policy mapping.
Visual · t27_enterprise_controls
Enterprise controls = layered mobile defense. $MOB_LAB. Original Cyberlium.
Opening
MDM alone is not enough — map conditional access, MAM, and DLP as the enterprise control stack defenders actually run.
Enterprise controls literacy beyond MDM: conditional access (device compliance, app protection policies), MAM without full device enrollment, DLP on copy/paste and save-as, app protection policies (PIN, encryption, block jailbreak), hardware attestation / SafetyNet / DeviceCheck signals, VPN per-app, certificate pinning as app defense (not bypass). Map controls to Module 6 jailbreak implications and Module 7 MASVS resilience. Cyberlium on $MOB_LAB policy mapping exercise — NOT disabling enterprise controls on employer fleet without authorization, NOT exfiltrating DLP-bypass techniques for stranger apps. Lab row: control stack diagram with six controls and failure mode each.
1. Control stack
Conditional access, MAM, DLP, app protection, attestation, MDM compliance — six named layers.
Failure mode column: what attacker/risk bypasses if control alone — literacy for purple review.
Command guide
Try these commands — Control stack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Android enterprise controls — https://developer.android.com/work/managed-configurations Apple supervision — https://support.apple.com/guide/deployment/about-supervision-dep4df894dda/web CISA mobile security — https://www.cisa.gov/topics/cybersecurity-best-practices/mobile-device-security
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export MOB_LAB=${MOB_LAB:-$HOME/cyberlium-lab/t27-mob}
cat > "$MOB_LAB/notes/enterprise-controls.txt" <<'EOF'
enterprise controls literacy:
- device compliance (OS patch level, encryption, screen lock)
- app allow/block lists via MDM
- remote wipe for lost enrolled corp devices only
- audit logs for config changes
lab: document controls in notes — do not push profiles to stranger devices
EOFCommand — copy this
grep -E 'compliance|remote wipe|stranger' "$MOB_LAB/notes/enterprise-controls.txt" curl -sS https://www.cisa.gov/topics/cybersecurity-best-practices/mobile-device-security | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: Android enterprise controls (https://developer.android.com/work/managed-configurations); Apple supervision (https://support.apple.com/guide/deployment/about-supervision-dep4df894dda/web); CISA mobile security (https://www.cisa.gov/topics/cybersecurity-best-practices/mobile-device-security). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. MASVS alignment
Enterprise controls complement app-level MASVS — neither replaces the other.
Resilience checks fail on jailbreak — tie to Module 6 implications table.
3. Scope refuse
No unauthorized disable of org mobile controls; no DLP bypass PoC on prod without RoE.
Mapping exercise on $MOB_LAB policy templates only unless brief assigns tenant.
4. What you ship: enterprise control stack diagram
Six controls + failure mode + MASVS tie-in + scope line.
5. What you record before the next lesson
Enterprise control stack diagram path.
6. Wrong vs right: stranger phones vs lab emulator apps
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Disable employer conditional access 'to test mobile lab' without ticket.
Right
Enterprise control stack from $MOB_LAB mapping. Next: MDM Lab.
Mission: enterprise control stack
1) Name six enterprise controls. 2) Failure mode per control. 3) Link two controls to MASVS categories. 4) Write NEVER unauthorized disable line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “MAM vs MDM — minimum difference?”
Knowledge Check
APPLY: Conditional access may require:
Multiple choice
Knowledge Check
APPLY: True or False: Disable org mobile controls without authorization is lab.
True or False
Knowledge Check
APPLY: Enterprise controls complement:
Multiple choice