Should my company provide phones or allow BYOD?

Company phones offer more control and security but cost more. BYOD reduces costs but requires clear policies and employee cooperation. Many SMEs use a hybrid approach: company phones for roles handling sensitive data, BYOD with security requirements for others.

How do I secure personal devices used for work?

Require minimum security standards (screen lock, encryption, current OS), use work profiles to separate data, install company VPN, and establish clear policies. Consider MDM solutions that respect personal privacy while protecting company data.

What should I do if an employee loses their phone?

Act quickly: remotely lock the device immediately, attempt to locate it, assess what company data was accessible, and remote wipe if not recovered within 24 hours. Change passwords for any accounts accessed from that device.

Is mobile antivirus necessary?

On iOS, the closed ecosystem provides strong protection. On Android, a reputable security app adds value, especially if users might install apps from outside the Play Store. Focus first on keeping OS updated and installing only official store apps.

How do I train employees on mobile security?

Keep it practical: focus on the 7 tips in this article. Use real examples of smishing attacks. Make security easy by providing VPN apps and clear procedures. Regular brief reminders are more effective than annual training sessions.

Mobile Security for Businesses: 7 Essential Tips

1

Lock Your Device with Strong Authentication

The first line of defense is a locked screen. Use biometric authentication (fingerprint or face recognition) combined with a strong PIN of at least 6 digits. Avoid simple patterns or easily guessable codes like 123456 or birthdates.

Use fingerprint or face recognition as primary unlock
Set a strong backup PIN (6+ digits, not sequential)
Enable auto-lock after 60-120 seconds
Disable lock screen notifications for sensitive apps

2

Keep Your Operating System and Apps Updated

Software updates patch security vulnerabilities that attackers exploit. Many mobile attacks target known flaws that have already been fixed in newer versions. Delaying updates leaves your device exposed.

Enable automatic OS updates
Update apps weekly or enable auto-update
Replace devices that no longer receive security updates
Check update status monthly in device settings

3

Only Install Apps from Official Stores

The Google Play Store and Apple App Store review apps for malware. Installing apps from other sources bypasses these protections. Even on official stores, check reviews and publisher reputation before installing.

Only use Google Play Store or Apple App Store
Disable "Install from unknown sources" on Android
Review app permissions before installing
Regularly audit installed apps and remove unused ones

4

Use Company WiFi or VPN on Public Networks

Public WiFi networks at cafes, hotels, and airports are hunting grounds for attackers. They can intercept unencrypted traffic or create fake networks that look legitimate. Always use a VPN when connecting to public WiFi.

Provide VPN software to all employees with mobile access
Make VPN mandatory for accessing company systems remotely
Train staff to verify WiFi network names before connecting
Consider mobile data as a safer alternative to public WiFi

5

Enable Remote Wipe Capability

If a phone is lost or stolen, you need the ability to remotely erase company data. Both iOS (Find My iPhone) and Android (Find My Device) offer this feature. For company devices, Mobile Device Management (MDM) solutions provide centralized control.

Enable Find My iPhone / Find My Device on all phones
Test remote wipe functionality before an emergency
Document the procedure so IT can act quickly
Consider MDM for company-owned devices

6

Separate Personal and Work Data

Mixing personal and business data on one device creates risk. Personal apps may have weak security. If an employee leaves, recovering company data becomes complicated. Use work profiles or separate containers to isolate business data.

Use Android Work Profile or iOS managed apps
Establish clear BYOD (Bring Your Own Device) policies
Define which apps can access company data
Ensure company data can be wiped separately from personal data

7

Train Staff on Smishing Attacks

Smishing (SMS phishing) is phishing via text messages. Attackers send fake messages about package deliveries, bank alerts, or IT issues with malicious links. Mobile users are more likely to click because screens are smaller and URLs harder to verify.

Train employees to recognize smishing red flags
Never enter credentials via SMS links
Verify requests by calling official numbers
Report suspicious messages to IT and block the sender

BYOD Policy: Essential Elements

If employees use personal devices for work (Bring Your Own Device), you need clear policies to protect company data while respecting personal privacy.

Minimum Security Requirements

Define required OS versions, screen lock policies, and encryption standards.

Approved Applications

List which apps can access company data and which are prohibited.

Data Ownership

Clarify that company data remains company property, even on personal devices.

Exit Procedures

Define how company data will be removed when an employee leaves.

Support Boundaries

Specify what IT will and will not support on personal devices.

Mobile Device Management (MDM)

For organizations with many mobile devices, MDM software provides centralized security management. Consider MDM when you have 10+ company mobile devices.

MDM Benefits

Enforce security policies automatically
Deploy apps and updates centrally
Track device location (with consent)
Remote wipe lost or stolen devices
Separate work and personal data

Lost Device Procedure

Every organization needs a clear procedure for when devices go missing. Quick action prevents data breaches.

1

Report immediately

Employee contacts IT within 1 hour of discovering loss.

2

Attempt to locate

Use Find My Device to check location.

3

Remote lock

Lock the device immediately if location is unknown.

4

Assess data risk

Determine what company data was on the device.

5

Remote wipe

Wipe the device if recovery seems unlikely after 24 hours.

6

Change credentials

Reset passwords for accounts accessed from that device.

Ready to Secure Your Mobile Devices?

Easy Cyber Protection helps you with a step-by-step approach to implement mobile security in your organization.