An organization's engineering team is developing a mobile application that uses near-field communication (NFC) capabilities but wants to ensure that…

Near-Field Communication (NFC), being a wireless protocol, is inherently susceptible to eavesdropping and man-in-the-middle (MitM) attacks, despite its very short range. To ensure the confidentiality of data transmitted over the NFC air interface, the data must be rendered unintelligible to any unauthorized party that might intercept it. Encryption is the fundamental cryptographic control that transforms plaintext data into ciphertext, providing confidentiality and directly mitigating the risks of eavesdropping and MitM attacks. Implementing an encrypted secure channel at the application layer is the standard method for protecting sensitive information in NFC communications.

A. Kerberos is a network authentication protocol, primarily designed for authenticating users in a client-server model. It is not a direct mechanism for encrypting the data payload in a peer-to-peer NFC transaction.

B. This option is incorrect because it refers to Bluetooth, which is a different wireless communication protocol from NFC. Security controls for one do not apply to the other.

C. Portable Device Management (PDM), or MDM, is used to enforce device-level policies (e.g., disabling NFC). It does not provide confidentiality for the data being transmitted within an authorized protocol.

1. Lehtonen, M., et al. (2007). A Survey on Security of Near Field Communication (NFC). Laboratory of Theoretical Computer Science, Helsinki University of Technology. In Section 3.1, "Eavesdropping," the paper states, "Eavesdropping is possible on the NFC link... To protect against eavesdropping, the transmitted data must be encrypted."

2. Haselsteiner, E., & Breitfuß, K. (2006). Security in Near Field Communication (NFC). In Proceedings of the Workshop on RFID Security (RFIDSec), Graz, Austria. On page 6, the paper discusses eavesdropping attacks and notes that a primary countermeasure is to "establish a secure channel between the two communicating devices," which is achieved through cryptographic protocols that use encryption.

3. Madlmayr, G., et al. (2008). NFC Devices: Security and Privacy. In Proceedings of the Third International Conference on Availability, Reliability and Security (ARES '08). DOI: https://doi.org/10.1109/ARES.2008.119. Section III.A, "Eavesdropping," explains the vulnerability and implicitly points to encryption as the solution by discussing the need for secure channels, stating, "To prevent this, a secure channel has to be established."