Wireless, mobile deployment, application security and sandboxing

Objective 4.1 in this course covers computing resources. The previous lesson took baselines and hardening; this one takes the remaining items in CompTIA's scope note for it — mobile solutions, wireless security, application security and sandboxing — and it is the applied lab for 4.1.

Why this matters

These three areas share a problem: the device or the code is only partly under your control. A phone belongs to the user, wireless traffic leaves the building whether you like it or not, and the application was probably written by someone else.

The exam's questions here are about which model and which protocol, and they are unusually specific. Know the deployment model acronyms, know that WPA3 is the answer and why, and know the difference between the two kinds of code analysis.

The lesson

BYOD, COPE and CYOD, and who owns the wipe

The mobile deployment models, and the question that separates them is who owns the device:

• BYOD (bring your own device) — the employee owns it. Cheapest for the organisation and hardest to control. You cannot dictate the whole configuration, you cannot wipe the device without wiping personal data, and the device leaves when the employee does, with whatever is on it.
• COPE (corporate-owned, personally enabled) — the organisation owns it and permits personal use. Full control, including a full wipe, at the cost of buying the devices.
• CYOD (choose your own device) — the organisation owns it, and the employee picks from an approved list. COPE with a choice, which improves acceptance.
• Corporate-owned, business only — no personal use, strictest control, usually for regulated or high-risk roles.

The wipe is the clearest illustration of the trade and a favourite exam angle. On a corporate-owned device you can perform a full device wipe when it is lost or the employee leaves. On BYOD you generally cannot, legally or practically — so you use a selective wipe that removes only the managed corporate container, leaving personal photos and messages untouched.

That is why containerisation matters on mobile: corporate data lives in a managed workspace separate from personal apps, so it can be encrypted, restricted from copy-paste to personal apps, and removed independently. If a scenario says personal device and corporate data must be removable, the answer is containerisation plus selective wipe.

Mobile device management, and the control it actually gives you

MDM — and its broader forms, mobile application management and unified endpoint management — is the tooling that enforces mobile policy.

What it can do: require and verify a passcode; require device encryption; enforce minimum OS version; push and remove applications; restrict app sources and block sideloading; configure Wi-Fi, VPN and certificates; detect rooting or jailbreaking; geolocate; and wipe fully or selectively.

What it cannot do, which is the part worth knowing: it depends on the platform's own integrity. On a rooted or jailbroken device the guarantees fail — the management profile can be defeated or spoofed, so the MDM may report compliance that does not exist. That is why detection of rooting is itself a core MDM function and why the standard policy is to block such devices from corporate access entirely rather than to manage them.

MDM is usually paired with conditional access: the identity provider refuses the login unless the device is enrolled, compliant and healthy. That combination — device posture as a factor in the access decision — is zero trust's adaptive identity from Domain 1 in its most common real implementation.

Cellular, Wi-Fi and Bluetooth as three different risk stories

• Cellular. The carrier's network, largely outside your control. Risks include SIM swapping — which is why SMS is a weak second factor — and the fact that a device on cellular is off your network and outside your inspection, which is the split tunnelling problem from Domain 3.
• Wi-Fi. The main enterprise concern. Risks are rogue access points, evil twins, weak or shared keys, and clients automatically joining remembered networks — an attacker broadcasting a familiar SSID collects connections without doing anything else.
• Bluetooth. Short range, pairing-based, and easy to forget. Risks are bluejacking and bluesnarfing from Domain 2, plus peripherals that are input devices on the host. Policy: off when unused, non-discoverable, paired only with known devices.

For GPS and location, the exam notes both sides: geolocation supports finding a lost device and geofencing access decisions, and it is also personal data with privacy obligations, particularly on BYOD.

WPA3, AAA/RADIUS, cryptographic protocols and authentication protocols

The wireless security stack, in the order the exam asks about it.

WPA3 is the current standard and the right answer. What it improves over WPA2:

• SAE (Simultaneous Authentication of Equals) replaces the pre-shared key handshake. It resists offline dictionary attacks — with WPA2-Personal, an attacker who captures the handshake can guess the passphrase offline at whatever speed their hardware allows; SAE removes that.
• Forward secrecy, so a later compromise of the passphrase does not decrypt previously captured traffic.
• Protected management frames, which blunt deauthentication attacks.
• Enhanced Open for public networks, giving encryption without authentication — so open Wi-Fi is no longer plaintext.

Personal versus Enterprise is the other axis:

• WPA3-Personal uses one shared passphrase. Everyone who knows it can join, it cannot be revoked per user, and it is shared with whoever the staff shared it with.
• WPA3-Enterprise authenticates each user or device individually via 802.1X against a RADIUS server — the AAA components from Domain 1. Credentials can be revoked individually, access can be logged per user, and users can be placed on different VLANs by policy.

The EAP methods from Domain 3 apply here: EAP-TLS with certificates is the strongest, PEAP and EAP-TTLS tunnel a password-based method inside TLS.

The exam's expected answer for an enterprise wireless requirement is WPA3-Enterprise with 802.1X and RADIUS, and the cost named is certificate or credential management.

Input validation, secure cookies, static analysis, code signing and sandboxing

Application security as CompTIA scopes it for this exam:

• Input validation is the root control for the entire injection family from Domain 2. Validate on the server — client-side validation is a usability feature, not a security control, because the client is under the attacker's control. Prefer allow-listing what is acceptable over blocking what is known bad.
• Secure cookies means the flags: Secure so the cookie is only sent over HTTPS, HttpOnly so script cannot read it (limiting what XSS can steal), and SameSite to blunt CSRF.
• Static code analysis (SAST) examines source code without running it. It finds insecure patterns early and cheaply and produces false positives, because it cannot see runtime context.
• Dynamic analysis (DAST), including fuzzing, tests the running application by sending it unexpected input and observing crashes or misbehaviour. It finds real, reachable problems and finds them later.

The exam's discriminator: static reads code and needs no running system; dynamic exercises a running application and needs no source. Use both.

• Code signing proves the origin and integrity of the software, and is what makes a malicious update detectable when the signing key has not been stolen.
• Secure coding practices and a secure SDLC put these activities into the development process rather than at the end.

Sandboxing runs untrusted code in a constrained environment where it cannot affect the host. Three uses the exam names: detonating email attachments and downloads to observe behaviour before delivery; isolating applications, as browsers do per tab and mobile platforms do per app; and providing a safe malware analysis environment.

Its limitation is worth knowing: capable malware performs sandbox evasion — checking for virtualisation artefacts, small disk sizes, absent user activity or a recent boot, and staying dormant if it thinks it is being watched. So a clean sandbox verdict is evidence, not proof, which is why sandboxing sits alongside behavioural detection on the endpoint rather than replacing it.

What to take into the exam

• BYOD means selective wipe and containerisation; corporate-owned means full wipe is available.
• MDM's guarantees depend on device integrity, so rooted and jailbroken devices are blocked rather than managed.
• WPA3-Enterprise with 802.1X and RADIUS is the enterprise answer; WPA3-Personal shares one passphrase that cannot be revoked per user.
• SAE's benefit is resistance to offline dictionary attacks on the captured handshake.
• Static analysis reads code, dynamic analysis exercises a running app — and input validation must happen server-side.
• A clean sandbox result is evidence, not proof: evasion is a standard malware feature.