Certified: The ISACA CISA Prepcast

Welcome to The Bare Metal Cyber CISA Prepcast. This series helps you prepare for the exam with focused explanations and practical context.
Mobile devices, wireless networks, and Internet-of-Things systems have expanded the digital perimeter far beyond the traditional boundaries of the enterprise. These technologies introduce convenience and flexibility but also bring significant risk. Devices often operate outside of secured environments, are not centrally managed, and can bypass traditional controls. Attackers know this and increasingly target mobile phones, tablets, smart TVs, sensors, and connected systems to gain access, observe user behavior, or launch broader attacks. The mobility of these devices, combined with their often-invisible presence on networks, creates monitoring blind spots. Weak authentication, poor encryption, and lack of centralized logging are all common findings in audits involving mobile or IoT environments. On the CISA exam, you can expect scenarios where security gaps related to device mobility, cloud integration, or IoT mismanagement increase exposure and lead to data compromise. Auditors must know how to assess whether these modern endpoints are being secured with the same rigor as traditional infrastructure.
Mobile device security starts with enforcing basic protection measures across all managed phones and tablets. Every corporate-owned device should be enrolled in a mobile device management platform that allows administrators to define and enforce policies. These include enabling screen locks, encrypting storage, requiring complex passwords, and enabling automatic wipe after repeated authentication failures. Administrators must restrict access to corporate applications and data, and prevent installation of unauthorized apps or services. Tools such as sandboxing or containerization can separate enterprise data from personal content, ensuring privacy and data security coexist. Auditors must verify that mobile devices are enrolled in MDM, have the correct security posture, and are monitored for violations. They also check that device configurations are reviewed periodically and updated in line with evolving threats. On the CISA exam, you may be asked to identify weaknesses in mobile configuration or recognize missing policies that contribute to endpoint risk.
Bring Your Own Device environments, while common, present unique challenges for security and auditing. These personal devices are outside the direct control of the organization but still access enterprise data and systems. To address this, organizations must establish clear BYOD policies that define acceptable use, required security controls, and user responsibilities. Employees must agree to security terms and consent to monitoring or remote wipe if needed. MDM solutions should be used to apply minimum security requirements, such as encryption, app controls, and access restrictions. Systems must be able to detect and block jailbroken or rooted devices, which often bypass built-in protections. Auditors must assess how the organization tracks BYOD enrollment, enforces policy compliance, and monitors for violations. The CISA exam may present scenarios involving privacy conflicts, unmonitored device usage, or lack of enforcement, requiring candidates to recommend appropriate controls or policy improvements.
Wireless network security is another area where poor configuration leads to elevated risk. Internal networks should use WPA3 encryption wherever supported, and at a minimum, WPA2. Pre-shared keys must be complex and rotated regularly. Organizations should disable SSID broadcasting on internal networks to limit visibility. Guest traffic should always be separated from production traffic using VLANs or firewall rules. Monitoring is essential to detect rogue access points, unauthorized devices, and unusual traffic patterns. Network segmentation ensures that wireless devices, even if compromised, cannot reach sensitive systems or internal services without crossing additional layers of control. Auditors must review wireless controller settings, assess encryption configurations, and verify whether access is logged and reviewed. On the CISA exam, candidates should be prepared to evaluate wireless segmentation strategies, key management practices, and the presence of unauthorized access points that increase exposure.
Internet-of-Things devices introduce risk because many of them lack basic operating system protections. Devices such as smart thermostats, badge readers, security cameras, or factory sensors often run on proprietary platforms without patching mechanisms, logging capabilities, or strong authentication. Organizations must change default credentials immediately upon deployment and disable services that are not needed. IoT devices must be segmented into isolated network zones where lateral movement is restricted and data exposure is minimized. Firewalls or microsegmentation tools can be used to control what IoT devices can communicate with. Centralized management platforms, when available, must be used to monitor firmware versions, access logs, and connectivity behavior. Auditors assess how IoT devices are deployed, inventoried, segmented, and monitored. CISA scenarios may ask you to recognize the limitations of IoT visibility or identify environments where IoT systems are exposing sensitive services without adequate safeguards.
Access management for mobile and IoT systems requires more than passwords. Strong authentication must include certificates, tokens, or multi-factor mechanisms wherever possible. For mobile users, authentication should be federated with corporate identity systems and monitored for anomalies such as repeated failures or login attempts from unusual geolocations. IoT devices, especially those that communicate autonomously, should be assigned least-privilege access to only the services they need. Permissions must be reviewed periodically to identify whether devices are requesting or receiving more access than justified. Many IoT devices use hardcoded credentials or static tokens, which represent serious risks if not addressed. Auditors must review provisioning workflows, access control configurations, and device authentication logs. The CISA exam may include access mismanagement scenarios where token overuse, privilege creep, or lack of session expiration contribute to unauthorized access or lateral movement.
Data protection must extend to every mobile and IoT communication path. All transmissions should be encrypted using strong protocols such as HTTPS, TLS, or VPN tunnels. Data at rest on mobile devices must also be encrypted to prevent access if the device is lost or stolen. DLP policies should be extended to mobile applications and cloud-connected devices to prevent unauthorized data transfers. Mobile app developers must validate the use of secure storage APIs, ensure that logs do not contain sensitive information, and restrict access to device telemetry. IoT systems often transmit command-and-control data or sensor information that is operationally sensitive. This data must be encrypted in transit and authenticated at each endpoint. Auditors assess how mobile apps handle data, how IoT telemetry is transmitted, and whether logs show any signs of data exposure. On the exam, you may be asked to evaluate a data leak scenario and determine whether encryption or DLP controls were missing or misapplied.
Monitoring and alerting for mobile and wireless environments requires integration with enterprise security platforms. Logs should be collected from mobile device management systems, wireless access controllers, and IoT management platforms. Events such as geolocation changes, device reboots, or policy violations should trigger alerts for review. Usage patterns should be monitored to detect behavioral anomalies, such as mobile devices transferring large amounts of data, or IoT devices communicating outside of normal parameters. Firmware updates, unexpected reboots, or configuration changes must also be logged and reviewed. Logging must comply with retention requirements and be secured from tampering. Alerts must be actionable and routed to the appropriate teams for follow-up. Auditors assess whether mobile and IoT activity is visible to the security operations center, whether alerts are being responded to, and whether logs are complete and consistent. The CISA exam may include questions about alert thresholds or failures to detect policy violations in mobile environments.
Governance and training are required to ensure mobile and IoT controls are not just defined—but followed. Acceptable use policies must cover mobile access, wireless connectivity, and the responsibilities of users and administrators. These policies must define how devices are onboarded, who owns them, and what happens when they are retired or lost. Regular training should cover mobile threats such as phishing via text, public Wi-Fi risks, and insecure app usage. IoT policies must also include inventory and ownership definitions. Risk assessments should consider mobile and IoT usage in every business unit, not just IT. Policies must be updated regularly to reflect new device types, evolving threats, and changes in regulatory obligations. Auditors review the availability of policies, whether training logs are maintained, and whether user awareness is tested through simulations or internal assessments. The CISA exam may present governance breakdowns and expect you to identify whether documentation or enforcement was missing or incomplete.
For CISA candidates, understanding the risks and controls for mobile, wireless, and IoT environments is now a baseline expectation. You must know how to evaluate mobile device management systems, assess wireless encryption and segmentation, and review how IoT devices are isolated and monitored. Expect exam questions on BYOD policy enforcement, data leakage through mobile apps, or unauthorized access to unsegmented IoT systems. These devices expand the organizational threat surface by introducing more endpoints, more data flows, and more opportunities for attackers to gain access. As an auditor, your role is to ensure that security controls reduce—not amplify—these risks. Devices must be visible, policies must be enforced, and behavior must be monitored continuously. Mobile and IoT security is not a special case—it is part of day-to-day operational security, and it must be treated with the same discipline and urgency as core infrastructure.
Thanks for joining us for this episode of The Bare Metal Cyber CISA Prepcast. For more episodes, tools, and study support, visit us at Baremetalcyber.com.
________________________________________