CJIS Compliance And Mobile Device Security
We've got some great deals going on right now exclusively for our online customers... chat now to hear more! Author: Jamie Italiano,Date modified: September 16, 2024,Time is running out. As of October 1, 2024, the Federal Bureau of Investigation (FBI) requires that organizations who access criminal justice information (CJI) must implement multi-factor authentication (MFA) on all systems that contain CJI. That includes smartphones, tablets, computers and any device or system that is used to access arrest records, forensic evidence, criminal investigation data, and other digital information. This makes the security of these devices, systems and digital transactions paramount to fighting crime and protecting the public. is strict, requiring anyone who has access to CJIS data to undergo security awareness training within six months of their first assignment, and training must be updated every two years. All smartphones and tablets or other devices must use a CJIS-compliant multi-factor authentication (MFA) process, and they must also be enrolled in an agency-controlled capable of remotely locking a device or, if needed, erasing the memory of a lost or compromised device. All work-related data transmitted or stored on a device needs to be encrypted. Come October 1, 2024, any agency that is accessing criminal justice information (CJI) - for example arrest records, digital evidence, text communications - or criminal justice systems and applications must implement multi-factor authentication (MFA). CJIS Security Policy Version 5.9.2 requires that individuals must provide at least two authentication factors to prove they are who they say they are. Failure to comply could result in monetary fines and denial of access to FBI CJIS resources. No matter if your organization has a bring your own device (BYOD) program or if they are , non-compliance with CJIS security requirements could result in phishing attacks or other breaches of confidential information. MFA is a security control that requires a user to provide a combination of two or more different authenticators - an authenticator could be something you know (a password), a biometric (a fingerprint or face ID), or something you have (a security token). This provides two layers of protection in the event one is compromised, like a password is guessed. This makes it harder for unauthorized users or bad actors to gain access to CJI. Mobile device management (MDM), a requirement of CJIS security policy, provides increased security and remote management of devices and applications set by your IT administrators. Meaning, MDM's can help your organization adhere to compliance policies and management functions, like adhere to CJIS security policy. Mobile devices are critical to law enforcement (LE) agencies dedicated to keeping citizens safe and the data used is extremely sensitive, making stringent mobile device security a must. Because law enforcement agencies must adhere to a different set of compliance rules than other industries, it's important to note that BYOD creates the possibility that your personal phone, with your personal information contained within, could potentially become evidence and subject to discovery in court proceedings. Any device accessing any criminal data used by law enforcement must follow (CJIS) compliance for mobile device security. The stringent policies of CJIS compliance makes BYOD among LE difficult—but not impossible. Many organizations have accepted or embraced bring your own device (BYOD) as part of their workplace culture. Some states, require the employer to compensate their employees for the use of their device when conducting agency business. Compliance regulations including CJIS compliance will dictate how—or if—an organization can adopt BYOD. BYOD policies can be uniquely tailored to each individual organization. Here is a list of what is included in most mobile threat detection policies:,BYOD policy will have a slightly different look for law enforcement under CJIS compliance. BYOD carries the same threats and risks that corporate-owned devices face; the difference is where responsibility lands. Who is responsible for the mobile device management around those threats, the deployment of mobile threat detection or the mitigation of any cyber incident that occurs? Mobile threats—such as phishing, unsecured Wi-Fi usage or excessive permissions in apps—are potentially a big concern because they can lead to data leakage or data loss, which could result in a significant security issue for LE. Unique to BYOD are threats caused by cross-contamination. When a mobile device holds both professional and personal credentials, it tends to make mobile device security more difficult. It may even be used by other family members for personal use. That simple action could potentially put you and your agency in violation of CJIS compliance. If an agent or officer's personal device was lost or stolen, would your IT team be notified? Do you trust your employees to be honest if an important database was manipulated because a family member accessing BYOD thought it was a different application? Do those using BYOD recognize what constitutes a data breach and what types of incidents should be reported?,Of course, these mobile threat detection and device management guidelines should be included in LE BYOD policy, but that doesn't mean the employee will follow the directive. If the device is lost or stolen, they may not worry about the organization's security concerns; they may instead react to their personal losses. If there is another type of incident that is a more clear breach, they may be too afraid of the repercussions to come forward with the truth. As previously mentioned, all BYOD and mobile device management policies should include clear language outlining the division between personal and work material on mobile devices. That way, when the worst case scenario happens, there are no questions of responsibility. For example, the organization should have the right—and the ability—to remotely wipe any device holding corporate information. There should be a clear reporting policy without intimidation. Rules for working with an employee post-breach should be the same for both BYOD and department-owned devices whenever possible. An officer frightened of losing their job because they lost their phone may remain silent for as long as possible, which could lead to greater risk of compromise for data and assets. In other industries, BYOD is seen as a cost-saving measure, but don't expect this to be the case in law enforcement. First, devices used by LE need to be reliable; LE shouldn't use a phone/data service plan that has spotty coverage and limited range. They need devices that are able to handle the mobile device security measures necessary to meet CJIS compliance. Official help to enhance both the security and functionality for law enforcement and agencies. Modern 5G-enabled provide fast, secure, reliable communications and there are many applications designed specifically for first responders. For example, in 2023, the for expenses related to a ransomware attack. the MOVEit global supply chain attack spanned 790 organizations including 200 government agencies leaking personal identifiable information (PII) including social security numbers, home addresses, income information, medical records, and more. The attack surface will continue to expand the more we connect: meaning the connection between devices, people, places, partners, applications, and things. Maintaining security is only as strong as your weakest link, which is typically the result of according to the 2024 DBIR. The Cybersecurity and Infrastructure Security Agency (CISA) provides on implementing phishing-resistant MFA which helps make it more difficult for criminals or threat actors to gain access to networks and information systems for instance if passwords or personal identification numbers (PINs) are compromised through phishing or other means. Devices used by LE are valuable to criminals, and not just cyber criminals. The FBI has well-defined parameters of what constitutes (PII), and PII's protection is a priority in tandem with protecting CJI. Any time a LE device or computer is used, it puts the user's PII at risk, especially if the device ends up in the hands of a criminal. Some agencies may decide that it is better to keep personal and work materials separate, including not conducting private activities on department-issued devices. CJIS security policy includes regular software/security updates, multi-factor authentication (MFA), encryption and agency-controlled mobile device management solutions. Mobile device management offers enhanced security and functionality for agencies and first responders. CJIS compliance helps prevent unauthorized access to sensitive data like CJI. Verizon offers a for public safety customers built on America's most reliable 5G network. Verizon also offers a discount program with exclusive offers only for our First Responders. More than 40,000 agencies rely on Verizon Frontline and its mission-critical solutions. Learn more about and mobile cyber security measures from Verizon. Choose your country to view contact details. Manage your account or get tools and information. These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. We use both third party and first party cookies for this purpose. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly. These cookies may be set through our site by Verizon and third parties. They are used to present Verizon advertising on third party sites that you may visit. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising from Verizon. BackClear Filters,All Consent Allowed
Learn more