IIA CIA IIA-CIA-Part3 Question # 224 Topic 23 Discussion

Understanding BYOD Risks:

A Bring-Your-Own-Device (BYOD) policy allows employees to use personal devices (e.g., laptops, smartphones, tablets) for work.

This increases security risks such as unauthorized access, malware infections, data leakage, and non-compliance with IT security policies.

Why Option C (Detection and Authentication Controls) Is Correct?

Detection and authentication controls ensure that:

Only authorized devices can connect to the organization's network.

User authentication mechanisms (such as multi-factor authentication) verify identities before granting access.

Devices with security vulnerabilities are flagged and restricted.

This aligns with IIA Standard 2110 – Governance, which emphasizes IT security controls for risk mitigation.

ISO 27001 and NIST Cybersecurity Framework also recommend device authentication and monitoring for secure network access.

Why Other Options Are Incorrect?

Option A (Limit personal use of employee devices):

Limiting personal use does not fully address network security risks; malware can still infect devices.

Option B (Control access through approvals and reviews):

While access control is important, it does not mitigate the broader risks of compromised devices connecting to the network.

Option D (Software scans and patch reminders):

Patching is important, but it does not prevent unauthorized access or ensure authentication for devices.

Implementing device detection and authentication controls is the most effective way to mitigate security risks in a BYOD environment.

IIA Standard 2110 and ISO 27001 emphasize strong network security measures.

Final Justification:IIA References:

IPPF Standard 2110 – Governance (IT Risk Management & BYOD Security)

ISO 27001 – Information Security Management

NIST Cybersecurity Framework – Access Control & Authentication