Mobile Security Best Practices

Posted by Jim Van on August 19, 2011 under data security, eOffice, mobility, portability, security, small business | 2 Comments to Read

We continue our focus on security with this week’s post: Mobile Security.

With the explosion of mobile devices, particularly smartphone and tablets, there’s been an explosion of potential data exposure. So what’s a person to do?

Of course, the best practice is not to store sensitive data on mobile devices in the first place. Instead, keep data on servers, either inside company firewall, or on a secure cloud-based server. Restrict access to authorized users in a view-only mode, where the data cannot be downloaded nor copied.

Not only does this policy protect data accessed by mobile devices, but also by workstations in the office as well. In this fashion, users can access and even work on data from almost anywhere there is an internet connection, while keeping the data protected, either behind a company firewall or on a secure cloud server.

There IS however, one data source that almost always resides on the mobile device that can be classified as sensitive: call lists. For example, perhaps your employees have names, numbers and information about clients on their smartphone. That data should be comapany confidential, as it is, after all, the lifeblood of any business (its customer base). How does one protect that?

There are a couple of different approaches:

1. Use a hosted phone provider to place calls from all phones. Store the client data on the hosted phone server, which provides smartphone and tablet users with client information from the server, and does not reside on the portable device.
2. Use an anti-theft software application, which can destroy data on a portable device at the click of a moouse. In this fashion, if the device is ever lost or stolen, the data can be destroyed before being accessed by unauthorized users.
3. Make sure each device has a password lock. It’s far more difficult to access the data on a mobile device when it is locked and requires a password to unlock it. Most devices offer this for free.

Additionally, virtually every security software manufacturer, such as McAfee, Trend, Symantec, Kaspersky and the like, offers modules that cover mobile devices. These are generally low-cost and worth the investment over the 12-month subscription.

Yet another threat is the use by employees of their personal devices to access company data. There should be a strict rule that those who choose to use their personal devices to access and user company data are required to use company security policies as though the device is a company device. Best practice, though, is for them to have a company-owned device. Keeping personal devices off the network, if possible, will cut security risks to the company network by 40% or better.