Build a security strategy to address mobile device threats

When an enterprise allows users to connect their mobile devices to the network and download confidential corporate data, whether it is internal information or customer data, we need a set of security policies that, at a minimum, dictate how the devices should be encrypted.

Establishing a Strategy

Enterprises need to budget for mobile device security because IT departments need authentication tools and similar professional software to track devices and delete data in the event of hardware loss.

IT managers should focus on authentication both inside and outside the device. Many of the enterprise-grade mobile device platforms available include stronger authentication than what is installed inside the device itself. The same authentication strategy can be used for all different types of devices and can be extended to the entire network.

This type of authentication means that employees must enter a password each time they access a device. IT managers must ensure that the password is difficult to guess and that employees do not tape the password in an obvious place (such as on a laptop computer bag).

It may be a little inconvenient to require employees to enter a password every time they check for new email, but doing so will remind employees that they are using a device that contains confidential information for work.

Of course, the enterprise's mobile device security policy needs to be the most applicable rules and provide sufficient help information. IT managers should warn employees not to leave mobile devices on tables in restaurants or bars, but to carry them with them. When staying in a hotel, if the device is not in use, it should be locked in a safe or other security device.

Employees should be warned not to allow others to use their work laptops or smartphones.

What if the device is stolen?

An enterprise's mobile device security policy should also outline what to do if an employee loses a device. Typically, this means contacting a response center or contacting the IT department or someone in the company to shut down the device.

Mobile device security policies should also require IT departments to install device protection mechanisms on laptops and software that can remotely wipe data from stolen devices. Keep in mind that mobile device tracking software relies on technology embedded in chips produced by major chip manufacturers.

If a laptop is lost or stolen, the tracking software should be synchronized with the device chip containing GPS capabilities when the device is connected to the Internet, so that the device can be tracked and located. The tracking software can also remotely wipe all confidential corporate information. In addition, this tracking function can also be used for smartphones.

Security policies don't have to be overly restrictive. Often, they simply require some viable common sense about device usage, combined with specific hardware and software to protect the company's sensitive information with the help of the IT department.