How can you enforce mobile device security policies while respecting employees' privacy rights?

Organisational security is everyones responsibility. Good security starts with organisational culture. It is important that everyone understands their roll in the overall security posture of their organisation, and why they need to practice a security-aware mindset. It is in their interest to help protect the organisation they work for and the customers that transact with them. Once this is in place, security policies that are in place become self-explanatory. The balance the organization needs to find is making sure those same policies do not restrict productivity.

With cyberattacks on the rise, organizations are at constant risk of unauthorized access to their sensitive information. Mobile device security policies establish clear guidelines for employees, ensuring that they employ the necessary security measures to protect confidential data. By doing so, these policies significantly reduce the likelihood of costly and damaging data breaches, which can tarnish a company's reputation and result in financial losses.

The article didn’t draw any clear distinctions between personally owned and corporate owned devices but one initial and long standing approach to accepted mobile device management practices involves the practice of dissuading employees from using their personally owned devices to access corporate data in the first place. This can be achieved by requiring employees to sign a consent form to which he must agree to having the device wiped in case of a loss or theft. Beats worrying about legal & ethical obligations. For company owned devices, I’d have to assume most employees use a common sense approach to protecting their devices vs reading through corp policy so hardening the device & Apps through best MDM practices becomes equally important.

Need to take the right measures to protect sensitive information stored on and transmitted by laptops, smartphones, tablets, wearables, and other portable devices. At the root of mobile device security is the goal of keeping unauthorized users from accessing the enterprise network. There is nothing like a single fit for all, but a carefully crafted policy can equip the organization as well as users to efficiently handle their endpoints with confidence. Making mobile devices secure is not a simple task, but it should be a high priority for any enterprise. To combat the growing threat of cyber-attacks, companies must continually audit their mobile security solutions and consider new security measures as they become available.

Mobile device security policies aren’t there to restrict you, but rather, to keep you and the organization safe from outside intrusions. They are everyone’s responsibility to uphold, therefore, it makes it an important cornerstone in any organization. Regardless of industry.

Focus on the data, I think at a minimum it should cover these three things. One, containerization should separate corporate data to personal data. If the device is BYOD, then that is super important. Two, the ability to do remote wipe, and aware that only corporate container is to be wiped, although the ability to wipe everything is also needed in some cases. Three, enforcement policies for device use, most importantly to enforce screen locks and installation sources,

If an organization provides mobile devices to his employees can force any policy wants. Enrolled devices with super strict policies and a lot of control. If the device is employee owned the BYOD policies should apply to this devices with very clear terms of use. The employee must be exact informed about what is tracking by these policies. Of course the organization can use mix of these policies. The most important is the strategy of an organization and if will allow personal device to have access to corporate data.

Mobile device security policies should be comprehensive, clear, and easy to understand. They should be communicated to all employees and regularly reviewed and updated to adapt to evolving security threats and technological changes.

It's tempting to enforce traffic inspection and route everything through a corporate gateway. While the intent is good this is often unneccesary and intrusive to the user. If you need it for controlling access to sensitive data or data loss prevention you should either limit it to the apps that require it, (app specific VPN through MAM for instance), or have an easy way for users to enable it when needed and correspondingly to disable the traffic redirection afterwards. Tracking the location of users should also be limited. You may want to raise flags if the user triggers "impossible travels". You probably do not need to know they are in the office when reading their email. The less info collected, the better. Logging is not prevention.

As a company you need to have a mobile device strategy for each level of employee and clearly state what data is needed and why. For an office emoyee we may only need a separation of work and personal data. The only data collected should be compliance with device security. Other devices may need to share a list of applications, since certain apps can be problematic when interacting with the government or secure information. On a field employees phone, the company may needs to collect location data for safety and productivity reasons. Whatever the policy is, it clearly needs to be communicated to the device holder and the policies need to be reviewed frequently.

When a corporate device is permitted for personal use, using Mobile Application Management (MAM) ensures a distinct boundary between work and personal data. MAM focuses on work-related apps, ensuring corporate security without infringing on personal privacy. If a device is exclusively for work, it's optimal to use Mobile Device Management (MDM) for comprehensive control. For personal devices in a work setting (BYOD), MAM is the preferred approach, striking a balance between corporate security and personal autonomy. Crucially, education and clear explanation for employees are key. Understanding the rationale behind these measures fosters trust, compliance, and a harmonious work environment.

Depends. For COPE devices, IMHO employees tend to accept that corporate set and enforce policies and limitations. It's a bit tricky for BYOD, thus the ability to create corporate container on the device, and set and enforce policies on that container only is very important. Then, let employees know the difference between their own and corporate spaces, and let them continue to use their personal devices on their personal container. Where policies would affect the whole device, then employees can opt out, and let the corporate knows this.

The organization should communicate to the employees all the data collection and inspection that are enforcing the policies. Also depending the type of device "corporate" or "personal" the collected data should be different.

Framing policies as a benefit for the user helps drive adoption. "If you lose your device you can send a remote wipe to it to ensure whoever finds it cannot access your personal data." "We offer a secure connection to the corporate network not only for internal websites, but also if you want a trusted way to access online banking when travelling." (Or something along the same lines.) There is of course a limit - you will probably not be able to pitch locking down the camera so that users are prevented from taking embarrasing pictures when they are at parties. If you have a legit need for disallowing photos be honest about it and inform the user why you need it.

You can use an MDM solution and almost all of these solutions are supporting MAM policies for personally owned devices. In both implementations you can have controls loke wipe corporate data, install updates e.t.c.

Encourage the use of secure Wi-Fi networks and VPNs for remote access to corporate resources. Discourage the use of public Wi-Fi for sensitive tasks. Provide technical support for employees to help them comply with security policies.

We should at least have an idea of the types of devices our employees use. With Android phones, the specification range is quite wide. Use MDM and have the ability to update policies to the devices, but then should have a feedback channel, by system or manually through user inputs, to set the optimal level of policies. I've seen cases where the policies were too tight, with no option to reject, that users struggle to effectively use their mobile devices. What risks are we trying to protect from, versus how users can effectively contribute to company goals, seek the optimal settings.

Start by reviewing your current mobile device security policies. Identify areas that need to be updated or improved. Make changes and revisions as necessary.

I've seen cases where company has collaboration with a mobile phone store and offer their employees discounts when they buy there and for specific models. I believe this is a win-win case for BYOD, employees can get their hands on higher spec models, and company has limited number of devices to support. This works even better for bigger companies with more employees.