Mobile device security

Phones are business computers now

For many staff, the phone is where they read email first, approve MFA prompts, join Teams calls and open shared files. That makes a lost or compromised phone a real business risk. A device left in a taxi with no passcode can expose client emails and saved passwords, and a phone running a malicious app can capture information without the owner noticing.

Mobile security does not need to be complicated, but it needs to be deliberate. The approach depends on whether the business owns the device or the employee does, and on how sensitive the data is. A few clear rules, applied consistently and supported by the right tools, cover most of the risk. The sections below start with basics that apply to every phone and then look at company-owned and personal devices separately.

The basics for every device

Some protections apply to every phone that touches business data, whatever its ownership. A strong passcode or biometric lock is essential, along with automatic locking after a short idle time. Current iPhones and Android phones encrypt storage when a passcode is set. Keep the operating system and apps updated, and replace devices once the manufacturer stops providing security updates.

Install apps only from the official Apple App Store or Google Play store, and be wary of apps that ask for permissions they do not need. Turn on the built-in find and erase features, so a lost phone can be located or wiped remotely. Avoid jailbreaking or rooting phones, which removes built-in protections.

• Passcode or biometric lock
• Automatic lock after a short idle time
• Current operating system and apps
• Official app stores only
• Remote locate and erase enabled

Company-owned devices

For phones and tablets the business owns, use mobile device management, often called MDM. Tools such as Microsoft Intune let you enforce passcodes and encryption, push approved apps, configure email and Wi-Fi settings and wipe the device completely if it is lost or the employee leaves. Apple Business Manager and Android Enterprise allow new devices to enrol automatically when they are first turned on.

Decide in advance what users may install and whether personal use is allowed. Clear rules prevent arguments later, particularly when a device needs to be wiped or returned. Put the rules in writing and have staff acknowledge them when they receive a device. Include what happens to personal photos or messages if a wipe becomes necessary, so nobody is surprised.

Bring your own device

Many small businesses let staff use personal phones for work. That is reasonable, but the business should protect its own data without taking control of the employee's personal life. Mobile application management, available in Microsoft Intune, applies policies only to work apps such as Outlook, Teams and OneDrive. You can require a PIN for those apps, block copying business data into personal apps and wipe only the business data when someone leaves.

Write a short bring-your-own-device policy explaining what the business can and cannot see, what happens if a phone is lost and what happens when employment ends. Being transparent about this builds trust and makes staff more willing to report problems. Review the policy each year and whenever your tools or obligations change.

Everyday habits

Technology controls cover a lot, but habits matter too. Text message phishing, sometimes called smishing, is now common in Canada, with fake delivery notices, bank alerts and toll or tax messages. Staff should treat links in unexpected texts with the same suspicion as email, and report suspected scams to the Canadian Anti-Fraud Centre.

Ask staff to report a lost or stolen device immediately, even outside business hours, and make it easy to do so. A quick report lets you wipe business data and reset access before anyone can misuse it. Avoid charging phones at unfamiliar public USB ports where a wall outlet is available.