Protecting mobile devices from cyber threats matters as much as protecting laptops, and gets far less attention. Here are ten practices worth applying:
-
Use Long Passphrases and Multi-Factor Authentication
- Favour length over complexity rules. A long passphrase beats a short password full of symbols.
- Enable MFA, preferably with an authenticator app or passkey rather than SMS.
-
Keep Devices and Apps Updated
- Install updates promptly to patch known vulnerabilities.
- Check that your devices still receive security updates at all.
-
Understand What a VPN Does and Does Not Do
- A VPN moves trust from the network to the VPN provider. That is sometimes worth doing.
- It is not a general privacy or security solution, and it is oversold as one.
-
Confirm Data Encryption Is On
- Modern iOS and Android devices encrypt storage by default once a passcode is set.
- The passcode is what protects the data. A device with no passcode is not protected.
-
Deploy a Mobile Device Management (MDM) Solution
- MDM gives centralized control over devices, apps, and security settings.
- Benefits include remote wipe, policy enforcement, and update management.
-
Develop and Enforce a BYOD Policy
- Establish rules for employees using personal devices for work.
- Define acceptable use, security requirements, and what IT can and cannot see.
-
Use a Password Manager
- Password managers generate and store unique passwords for each account.
- Look for end-to-end encryption and cross-platform support.
-
Take Care on Public Wi-Fi
- The risk is lower than it was, but rogue networks and captive portals still matter.
- Disable auto-connect and verify network names.
-
Perform Regular Data Backups
- Back up to protect against loss, failure, and ransomware.
- Test that you can actually restore.
-
Conduct Employee Security Awareness Training
- Train regularly on current threats, especially phishing.
- Use varied formats: modules, workshops, and simulations.
These will not make a device unbreakable. They close the routes attackers actually use, which is a different and more achievable goal.
1. Use Long Passphrases and Enable Multi-Factor Authentication
Advice on passwords has changed, and a lot of published guidance has not caught up.
Length beats complexity. Current guidance from NIST no longer recommends forcing a mix of uppercase, lowercase, numbers, and symbols, and no longer recommends routine forced password changes. Those rules pushed people toward predictable substitutions and sticky notes without adding much real strength. What matters is length and uniqueness. A passphrase of several unrelated words is both stronger and easier to remember than an eight-character string of symbols.
Practical version: aim for a long passphrase, never reuse it, and check it against known-breach lists rather than against a complexity rule.
Multi-Factor Authentication
MFA requires a second piece of evidence beyond your password. In rough order of strength:
- Passkeys or hardware security keys: resistant to phishing, the strongest option
- Authenticator app codes: good
- SMS codes: better than nothing, but vulnerable to SIM-swap attacks
One clarification worth making: unlocking your phone with a fingerprint or face is not multi-factor authentication. It is a convenient substitute for typing the passcode. The passcode remains the thing protecting the device, which is why its length still matters.
Enabling two-factor authentication on iPhone or iPad
Two-factor authentication is switched on by default for Apple Accounts created in recent years. To check or enable it:
| Step | Action |
|---|---|
| 1 | Go to Settings > [your name] > Sign-In & Security. |
| 2 | Tap Two-Factor Authentication. |
| 3 | If it is off, tap to turn it on and follow the prompts. |
| 4 | Enter a trusted phone number for verification. |
| 5 | Enter the verification code sent to that number. |
Menu names shift between OS versions. If the path above does not match your device, search the Settings app for “two-factor”.
2. Ensure Regular Updates for Devices and Applications
Updates are the highest-value item on this list and the one most often postponed. Most successful attacks use vulnerabilities that were patched some time ago.
Risks of Outdated Software
| Risks | Description |
|---|---|
| Exploitation of known vulnerabilities | Published vulnerabilities are exploited fastest right after the patch is released |
| Data breaches and theft | Sensitive data can be stolen or compromised |
| Malware infections | Unpatched flaws are the usual entry point |
| Identity theft and fraud | Compromised accounts follow compromised devices |
| Damage to reputation | Breaches traced to unpatched devices are hard to defend |
The point most guides miss
A phone that no longer receives security updates cannot be secured by any of the other practices here. Manufacturers support devices for a fixed number of years and then stop. Before you worry about anything else on this list, find out whether your fleet is still receiving patches. If a device is past end of support, replace it. There is no configuration that substitutes.
Best Practices for Updates
- Enable automatic updates for the operating system and apps
- Install security patches promptly rather than deferring them
- Track the end-of-support date for every device model you own
- Use MDM to monitor and enforce patch levels across the organization
3. Understand What a VPN Does and Does Not Do
VPNs are the most oversold product in consumer security, so it is worth being precise about what one buys you.
What a VPN actually does
A VPN encrypts traffic between your device and the VPN provider’s server. That hides your activity from the local network and your internet provider, and hides your real IP address from the sites you visit.
What it does not do
| Common claim | Reality |
|---|---|
| “A VPN keeps you anonymous” | It moves trust from your network provider to your VPN provider. They can see what your ISP would have seen. |
| “You need one on public Wi-Fi or you will be hacked” | Nearly all web and app traffic is now HTTPS-encrypted end to end. The classic coffee-shop interception attack is much harder than it was. |
| “A VPN stops malware and phishing” | It does neither. Some providers bundle separate filtering products; the VPN itself does not. |
| “A VPN stops tracking” | Advertisers identify you by account logins and browser fingerprinting, not mainly by IP address. |
When a VPN is genuinely worth it
- Connecting to internal company systems, which is what corporate VPNs are for
- Hiding browsing from the operator of a network you do not trust
- Reaching services restricted by location, within the terms you have agreed to
How to Choose One
- Trustworthiness: You are handing this company all your traffic. Look for independently audited no-log claims rather than marketing statements.
- Security: Modern protocols such as WireGuard or OpenVPN.
- Speed and server locations: Practical rather than security concerns.
- Business model: Be wary of free VPNs. If you are not paying, your traffic is likely the product.
4. Confirm Data Encryption Is On
Encryption converts stored data into a form that is useless without the key, so a lost or stolen device does not become a data breach.
The current situation
Older guides walk through turning encryption on. On current devices there is nothing to turn on, because it is already on:
- iOS and iPadOS: Storage is encrypted by hardware. Data Protection ties the keys to your passcode, so the protection becomes meaningful the moment you set one. There is no separate “encrypt data” setting.
- Android: Devices shipping with Android 10 and later use file-based encryption by default. The “Encrypt phone” option that appeared in older versions no longer exists on current devices.
What this means in practice: the security of an encrypted phone rests almost entirely on the passcode. A six-digit PIN is far weaker than an alphanumeric passphrase against an attacker with the physical device. If a phone holds anything sensitive, set a real passphrase rather than a PIN.
What to check
| Check | Why |
|---|---|
| A passcode is set on every device | Without one, encryption protects nothing |
| The passcode is strong | It is the key to the encrypted storage |
| Remote wipe is enabled | Find My iPhone, Find My Device, or your MDM |
| Backups are encrypted too | An unencrypted backup undoes the device encryption |
5. Deploy a Mobile Device Management (MDM) Solution
MDM gives a central way to configure, monitor, and if necessary wipe the devices that hold company data.
Benefits of MDM Solutions
| Benefit | Description |
|---|---|
| Remote management | Enforce settings, revoke access, or wipe a lost device |
| Patch visibility | See which devices are behind on updates, which is the main practical win |
| App control | Distribute approved apps and block others |
| Policy enforcement | Require passcodes and encryption rather than hoping for them |
Steps to Deploy an MDM Solution
- Install the MDM software and create an account
- Enrol devices, manually or through automated device enrolment
- Configure device settings such as passcode policy and network access
- Deploy applications to devices
- Assign permissions so users get only the access they need
The trade-off to be honest about
Full MDM on a personally owned phone gives the employer significant reach into a device the employee paid for, including the ability to wipe it. This causes real friction and sometimes legal difficulty. Most platforms offer a lighter mode that manages only work apps and data and leaves personal content alone. For BYOD, that is usually the right choice, and it should be stated plainly in the policy below.
6. Develop and Enforce a BYOD Policy
A BYOD policy sets out the rules for employees using personal devices for work.
Why You Need a BYOD Policy
- Cost: The company buys fewer devices. Note that support costs rise instead, because you are now supporting many device models.
- Familiarity: People already know their own devices.
- Flexibility: Supports remote and mobile working.
Key Elements of a BYOD Policy
| Element | Description |
|---|---|
| Acceptable use | Define what personal devices may be used for |
| Device security | Minimum requirements: passcode, current OS, encryption |
| IT control | State exactly what IT can see and what it can wipe |
| Exit process | How company data is removed when someone leaves |
| Communication | Make sure employees have read and accepted it |
The clause people forget is the exit process. Decide in advance how you remove company data from a personal phone when someone resigns, and write it down before you need it rather than during a dispute.
7. Integrate a Password Manager
A password manager generates and stores a unique password for every account, which is the only realistic way to avoid reuse.
Why You Need One
- Unique passwords everywhere: One breached site then cannot open your other accounts. This is the main benefit and it is a large one.
- Phishing resistance: A manager will not autofill credentials on a lookalike domain, which catches attacks people miss.
- Cross-platform access: Passwords available across devices without insecure workarounds.
Choosing a Password Manager
| Factor | Description |
|---|---|
| Security | End-to-end encryption, and a published record of independent audits |
| Breach history | Check how the vendor handled past incidents. This industry has had several. |
| Features | Sharing, passkey support, and MFA on the vault itself |
| Compatibility | Works on the devices and browsers your team uses |
| Recovery | Understand what happens if someone forgets the master password |
8. Take Care on Public Wi-Fi
Public Wi-Fi advice has aged badly. The dramatic version, that anyone in the cafe can read your banking session, largely predates near-universal HTTPS. The residual risks are narrower but real.
Risks worth taking seriously
| Risk | Description |
|---|---|
| Rogue access points | An attacker runs a network named to look like the venue’s, then controls your DNS and captive portal |
| Auto-connect | Your device rejoins a spoofed network with a familiar name without asking you |
| Certificate warnings | A network intercepting traffic will trigger them. People click through, and that is where the damage happens. |
| Shoulder surfing | Unglamorous and still effective in public places |
Tips to Stay Safe
- Disable auto-connect to open networks, and remove saved public networks you no longer use.
- Never dismiss a certificate warning. On a public network, treat it as an attack rather than a glitch.
- Verify the network name with staff rather than picking the plausible-looking one.
- Prefer mobile data for anything sensitive. Tethering is simpler and safer than most alternatives.
- Use a VPN if you do not trust the operator, with the caveats in section 3 in mind.
9. Perform Regular Data Backups
Backups protect against theft, hardware failure, and ransomware.
Why Backups are Important
- Device theft or loss
- Hardware and system failure
- Ransomware, where a backup is often the only alternative to paying
Best Practices for Data Backups
| Factor | Description |
|---|---|
| Security | Backups must be encrypted, or they undo your device encryption |
| Automation | Manual backups do not happen. Automatic ones do. |
| Separation | A backup reachable from the compromised device can be encrypted along with it |
| Restoration | How quickly can you actually get someone working again? |
Testing Your Backups
An untested backup is an assumption, not a backup. Restore one to a spare device periodically and confirm the data is complete and readable. Organizations discover their backups were broken at the worst possible moment with depressing regularity.
10. Conduct Ongoing Employee Security Awareness Training
Most breaches start with a person, not a machine, so training is not optional padding.
Why Training is Important
- Attack techniques change, and phishing in particular has become markedly more convincing
- New employees do not know your policies yet
- Habits decay without reinforcement
Best Practices for Training
| Factor | Description |
|---|---|
| Frequency | Short and regular beats an annual session everyone forgets |
| Content | Weight it toward phishing and credential theft, which is where the losses are |
| Delivery | Mix modules, workshops, and simulations |
| Culture | Make reporting a suspected mistake safe. Punishing people for falling for a simulation buys you silence, not security. |
Measuring Training Effectiveness
| Metric | Description |
|---|---|
| Reporting rate | How many people report a simulated phish. Better signal than how many click. |
| Time to report | How fast the first report arrives, which decides how fast you can respond |
| Knowledge retention | Short assessments after training |
| Employee feedback | Used to improve the programme |
Conclusion
Mobile devices hold as much company data as laptops and get a fraction of the security attention.
Key Takeaways
If you do only three things from this list, do these:
- Keep devices patched, and replace those past end of support. Nothing else compensates for an unpatched device.
- Set strong passcodes and turn on MFA, preferably passkeys or an authenticator app rather than SMS.
- Enable remote wipe, so a lost phone is an inconvenience rather than a notifiable breach.
Prioritizing Mobile Device Security
Mobile security is maintenance, not a project. Devices age out of support, staff change, and policies drift out of date. Review the fleet on a schedule.
And be sceptical of products sold as complete answers. A VPN subscription is not a security programme. Patching, strong authentication, and the ability to wipe a lost device will do more for you than most things you can buy.
More on this topic
Browse all 79 articles on Security & Compliance.