Phone Security Best Practices to Protect Your Mobile Data

TL;DR

Smartphones are prime targets for data theft, malware, and physical theft. Protecting your device requires a layered approach: enabling screen locks, two-factor authentication (2FA), and VPNs; avoiding public WiFi and suspicious apps; and, for organizations, enforcing mobile security policies, role-based access, and regular staff training. Both Android and iPhone users have device-specific steps to further harden their security.

Why smartphone security matters

Smartphone security practices help you defend your devices against malicious actors that hope to steal your data or gain access to your company's confidential information.

Think about all the information you store deep within your phone. And now, think about all of the data you can access with a few taps on your screen. Smartphone security steps ensure that you're the only one who can use these two sources of information.

What are the most common cell phone security threats?

Creating a secure mobile environment begins with understanding the risks you face. Just having a handheld device can open you up to hacking threats. But you can keep them from impacting your everyday life. 

These are four well-known mobile phone security threats:

• Applications: Open up the app store on your phone, and you'll see plenty of enticing programs that make your device better. Unfortunately, some of them come with security problems. For example, many Android apps contained malware designed to steal banking information, and screeners didn't catch that issue before the programs showed up in the store.
   
• Networks: Do you connect to the internet via WiFi hookups? Do you use Bluetooth to latch your device to things like headphones or speakers? Both of these access points could allow hackers to tap into your phone and take over.
   
• Theft: It's estimated that thieves steal more than 70 million cell phones annually. Anyone who has physical possession of your cell phone could steal data from you.
   
• Websites: Phishing email messages can entrap you into giving up access. And malware embedded in website assets like links and photos could steal even more.

These are just some of the risks you can thwart with strong phone security practices. 

How can individual users improve their smartphone security?

Whether you're using a company device or one of your own, it's wise to think about what you can do to keep data safe and secure. These are a few good places to start.

Enhance your phone security with these tools:

• App distrust: Research before you install an app or program on your phone. Check out the developer. Read reviews. And perform a quick web search to see if others have privacy concerns about this product.
   
• Biometrics: Move past a password and use something like a fingerprint to unlock your phone.
   
• Bluetooth: Turn off this capability when you're not using it. And when you are, perform quick checks to see what you're linking to.
   
• Charging: So-called "juice jacking" involves loading malware onto public charging stations. If you plug into a corrupted charger, you could install malware onto your device. Keep a battery-powered device with you to charge on the go.
   
• Data encryption: Don't send sensitive information as attachments from your phone. Encrypt it first, or wait until you're on a protected line.
   
• Locking: Less than 30 percent of smartphone owners lock down their devices. If you aren't using this feature, enable it now.
   
• Remote wiping: Dig deep into your settings and ensure that you can wipe your device clean from your computer. If it's stolen, you can log in and protect your data from afar.
   
• Software: Keep anything loaded on your phone up-to-date. If developers upload security patches, you must implement them as quickly as possible.
   
• Two-factor authentication (2FA): Of all active Gmail accounts, 90 percent don't use 2FA. It is a hassle to require another device to log in to something you use every day. But this simple step keeps your data secure.
   
• Virtual private networks (VPNs): If you're using your phone in a public space (like a coffee shop), log in to your workplace with a VPN. All of your communication is encrypted and safe from hacking.
   
• WiFi: Don't use public networks to log onto the internet. And turn off your WiFi connectivity when it's not in use.

This is a long checklist. But each step is a critical part of phone security best practices. 

How can companies strengthen mobile phone security for their teams?

Are you in charge of protecting security for an organization filled with cell phone users? Your work could help to keep critical assets sound and secure. 

These five mobile phone security tips could help:

• Craft comprehensive policies. Determine what is and isn't allowed by each person within your company. Share those policies with the team, and ask them to review them annually.
   
• Monitor as needed. Talk with your company's legal team, and determine appropriate oversight rules. Explain them carefully to your employees, and use the data to track progress towards your goals.
   
• Protect devices. Some cell phones have protections built right in. Others do not. And sometimes, users disable these features in a bid to make their phones faster. Ensure company devices are updated regularly to ensure they have effective protection.
   
• Segment appropriately. Use role-based rules to limit access. For example, your receptionists may not need access to accounting data from company cell phones. Limit your risks accordingly.
   
• Train your staff. Educate employees how security breaches put the company at risk. Hold regular training about your rules, and ask all employees to prove they completed the training.

If you have no phone security rules now, your staff may balk at some of these steps. Explain the risks as carefully as you can, and you may convince them to cooperate with you.

How do security tips differ by device type?

While core threats are universal, the steps you take to mitigate them can vary by platform. Here is a breakdown of key security steps for Android and iPhone users.

We'll reiterate that 2FA is critical for anyone working with a cell phone. If you're not exactly sure what this is or how it works, check out our blog post.

Frequently asked questions

What are the biggest security threats to smartphones?

The four most common threats are malicious apps that carry malware, unsecured networks (including public WiFi and Bluetooth connections), physical theft of the device, and phishing websites or links that trick users into giving up access or installing malware.

Why is two-factor authentication important for mobile security?

Two-factor authentication (2FA) adds a second layer of verification beyond your password, making it much harder for attackers to access your accounts. Despite this, the article notes that 90 percent of Gmail users still don't use 2FA, leaving their accounts vulnerable.

What is juice jacking and how can I avoid it?

Juice jacking involves malware being loaded onto public charging stations. If you plug your phone into a corrupted charger, you could install malware onto your device. To avoid this, carry a battery-powered portable charger so you don't need to use public USB ports.

How should companies manage mobile phone security for employees?

Companies should craft comprehensive policies, monitor device usage appropriately, protect and regularly update devices, segment access by role using role-based rules, and train staff regularly on security risks and company policies.

Are Android and iPhone security steps different?

Yes. Android users should enable built-in security features, use the Android security app, and only download apps from Google Play. iPhone users should keep iOS updated and enable the "find my phone" feature by linking their phone to their computer.

What can I do if my phone is stolen?

Enable remote wipe in your settings beforehand so that if your phone is stolen, you can log in from your computer and erase your device to protect your data from afar.

References

These Dangerous Android Apps Can Hijack Your Phone. What to Do Now. (March 2021). Tom's Guide.

3.1 Million Smartphones Were Stolen in 2013, Nearly Double the Year Before. (April 2014). Consumer Reports. 

Traveling Through An Airport? Your Phone Could Get Hacked if You Charge It This Way. (November 2019). USA Today.

Americans and Cybersecurity. (January 2017). Pew Research Center.

Over 90 Percent of Gmail Users Still Don't Use Two-Factor Authentication. (January 2018). The Verge. 

Is Your Cell Phone Policy Outdated? (July 2018). HR Payroll Systems.