Mobile devices are treated as peripheral in most security programmes, while in practice carrying company mail, messaging, documents, and frequently the second factor that protects everything else. A phone in the wrong hands with a weak passcode is a complete access path.
The baseline
- A strong passcode or biometric — not a four-digit PIN, on devices holding company data.
- Automatic operating system updates, with a policy on how long an unsupported device may remain in use.
- Device encryption, which is default on current platforms but worth verifying.
- Find-my-device and remote wipe enabled and tested.
- Applications installed only from official stores.
Separate work from personal where you can
Work profiles on Android and managed application configurations on iOS allow company data to be wiped without touching personal content. This is usually more acceptable to staff than full device management, and it resolves the practical objection that prevents mobile security from being addressed at all.
Review app permissions
Applications routinely request access to contacts, location, microphone, and photos with no functional need. Contacts access in particular exports your professional network to a third party. Periodically review what each application holds and revoke what is not required.
Travel and public spaces
- Avoid public USB charging ports; use a power-only cable or a wall adapter.
- Disable automatic connection to open wireless networks.
- Be aware of shoulder surfing when entering passcodes and reading mail in transit.
- Consider a privacy screen for anyone who regularly works in public.
Write the lost-device procedure now
Who is contacted, who triggers a wipe, what credentials are rotated, and whether the device held anything requiring a breach assessment. Someone reporting a lost phone at 9pm should not be working out the process from scratch, and the value of speed here is considerable.