In 2023, a Dhaka-based insurance company lost BDT 4.2 crore through a single compromised field agent laptop. The device had no MDM enrollment, no remote wipe capability, and no application whitelisting. When the agent was terminated and refused to return the device, it took 6 weeks of legal process to establish the company's right to disable it. By then, the client database had been sold to a competitor.
What Bangladesh Bank's 2024 ICT Guidelines Require
Bangladesh Bank's revised ICT Security Guidelines (BRPD Circular No. 14, 2024) mandate that all financial institutions implement: (1) Mobile Device Management for all devices accessing core banking systems. (2) Containerization of work applications — no commingling of personal and corporate data. (3) Certificate-based VPN for all remote access. (4) Remote wipe capability with cryptographic verification. (5) Quarterly MDM compliance audit reports. Non-compliance carries a BDT 50 lakh fine per audit cycle.
Zero-Trust Architecture in Practice
CDS implements Zero-Trust MDM on the principle that no device should be trusted by default — even devices inside the corporate network. Every access request is verified against: current device compliance status (patch level, encryption, app inventory), user identity (MFA-verified), geographic location (geo-fencing), and behavioral baseline (time-of-day, access pattern). Devices failing any check are automatically quarantined pending re-verification.
- Zero-Touch Enrollment: new devices configure automatically, no IT touch required
- Application Whitelisting: only approved apps can run — malware blocked at installation
- Containerization: work apps and data in encrypted container, personal apps cannot access
- Certificate-based VPN: no password-based remote access to core systems
- Geo-fencing: automatic policy change when device leaves defined zones
- Remote Wipe: cryptographic erasure in <60 seconds, confirmed by audit log
“After the MDM deployment, our Bangladesh Bank ICT audit was the first time in three years we received zero critical findings on mobile device security. The examiner specifically cited our geo-fencing logs as best practice.”
— CISO, Private Commercial Bank