Drew Robb in his article ” How to Secure Mobile Devices” has created an excellent guide to thinking about the security of mobile devices, not just for consumers but for the enterprise.

The article is recreated below:

“More and more frequently, employees are linked to sensitive data via a number of different devices, providers, and operating systems,” said Will Hedrich, a security architect at CDW-G. “If laptops, tablets, and smartphones are left unattended for even a few minutes, you are at risk.”

Anyone can download an application for $50 to $150, for example, that will allow them to listen to phone conversations, listen to anything around that phone even when it’s not on a call, view the camera, swipe files from the phone, or access the corporate network. They can download, view, or listen to this information wirelessly using the phone’s public IP address, Bluetooth or Wi-Fi. After the program is downloaded on to it, the person would never know it is on his or her phone.

Recently, for example, an employee of a large enterprise left a smartphone in the car while shopping. The phone, which was stolen, contained the social security numbers and other personal information of company employees. Because the phone was not equipped with any security measures, the information was easily accessed.

Most company employees do not even have basic firewall or password protections on their phones, so they are risking this kind of data loss on a regular basis.

The financial consequences can be severe. The government fines companies $204 or more per piece of personal information leaked, such as a social security number, credit card information, and other personally identifiable information (PII) or payment card industry (PCI) compliance information.

“It is important to have a mobile management security strategy in place to prevent data loss and malicious attacks,” said Hedrich. “The strategy should extend to devices, the data center, and cellular carriers.”

He added that a comprehensive solution for locking down the mobile workforce did not exist until recently. Such solutions, now becoming available from a variety of vendors, should encompass a four-pronged approach.

Physical security

Devices accessing the network need data encryption and multi-factor authentication, which includes a user name, password, and a series ofPINnumbers, such as a four digit personalPINand a six digit code that is generated automatically and changes every minute. Device certificates are also important.

Content security

If appropriate security protocols are in place, anyone trying to access information via the public IP address of an encrypted device will find that the information is completely scrambled. A combination of anti-malware, content filtering, encryption, data loss prevention (DLP) software, and intrusion prevention software installed on all devices will prevent unauthorized access to data.

“If a phone, tablet, or other device falls into the wrong hands, you want to be sure that data on it cannot be accessed,” said Hedrich. “Data encryption and multi-factor authentication are crucial to ensuring that only the authorized user can access the information on the device.”

Device management

Organizations should also set access levels and permissions for each person or group on the network, such as legal, marketing, IT, etc. These access policies control the data they can access via their devices and the functions they can perform remotely.

“Centralized device management allows IT to update access rights as well as roll out updates to operating systems and applications from one central console,” said Hedrich. “And, if a device is lost or stolen, the IT manager can wipe the device remotely to prevent data loss.”

.