Smartphones and tablets are often the weakest link. The right settings and a clear policy close that gap.
Imagine You grab a quick coffee before a client meeting. Your signal is poor, so you connect your phone to the café's Wi-Fi to read your email and go through your presentation. You don't realise the connection isn't private. A brief connection is enough for a hacker to intercept your communication, steal your business credentials and get into the company network.
Mobile device security is often the neglected child. Companies assume laptops are the biggest risk, and stepping in on devices employees also use privately seems difficult. The result: phones are often insufficiently secured, even though they go everywhere.
Companies often see phones as a communication tool, not as a gateway for hackers. Their security focuses on networks, workstations and servers. But employees usually also have access to work email, sensitive files and the company network through their iPhone.
That's why specific guidelines and measures are often missing, especially when employees use their own device (BYOD). The result is a lack of control, of security and of awareness of the risks.
Phones and iPads are a gateway to email, business apps and cloud storage. They often also hold the two-step verification app, which means the device gives access to a lot of accounts.
According to a Zimperium report, no less than 82% of the phishing sites studied in 2023 specifically targeted mobile devices. And according to Lookout, more than 30% of users were exposed to mobile phishing every quarter in 2022. On a phone you're less alert, you don't see full URLs and you click faster.
Phishing on phones happens through email, but also through calls (vishing), text messages (smishing), WhatsApp or QR codes (quishing). Attackers increasingly target specific people and combine these techniques to convince them to approve a login, share a code or install malware.
Imagine You receive a personalised email from the so-called IT department, with a link to a convincing fake login page. If you don't respond right away, the attacker calls you posing as the helpdesk. Once he has your password, he makes repeated login attempts. After a while you assume it's a glitch and tap "allow". He's in.
Employees often use their phone for both private and business purposes, and install apps more readily without checking them. Those apps have access to data, can themselves be insecure or outdated, and so put company information at risk.
Due to the Digital Markets Act, Apple also has to allow third-party app stores, which increases the chance of untrustworthy apps. But even an app from the App Store is no guarantee: the popular mail app Spark, for example, stores copies of your business email on its own servers. In a regulated sector, or under European privacy law, that can be a problem.
An iPhone goes everywhere. That increases the chance of loss or theft, and of logging in on public Wi-Fi. We advise against public networks almost always. Bluetooth in a public space can be risky too.
The passcode is the first line of defence, but often the weakest: a four-digit code is enough, even something like 0000. Anyone with physical access to your device then quickly has access to everything on it.
Whatever the size of your company: secure your cloud environment, such as Microsoft 365 or Google Workspace, and set a policy for using iPhones, iPads and Android devices with company data.
Employees keep their own device, and you look for a balance between protecting company data and your employees' privacy:
Every device is owned by the organisation and fully managed through MDM, while preserving the user's privacy.
With an MDM solution you roll out your security policy to all devices and manage them centrally.
Tip For a sole trader, an MDM usually isn't the right solution. In that case, book a consultation with one of our Hi-T team members to get your settings right together.
A VPN encrypts your connection and is ideal for people who work on the go a lot. With Jamf's Zero Trust Network Access solution, business traffic is secured automatically, without touching the user's private data.
Include passcode requirements in your password policy. With an MDM you enforce them. In a BYOD scenario, conditional access with an app such as Jamf Trust can help.
Even perfectly configured devices remain a risk. Make clear agreements about passcodes, installing apps and using public Wi-Fi, and train your employees to recognise phishing, smishing and vishing.
In short
More than 30% of users face mobile phishing every quarter Smaller screen, faster clicks, less alert MDM or a BYOD policy closes the gap
The information in this article is intended as general knowledge about using Apple products in a professional environment. Your organisation may have its own policies that restrict certain features or software. Always consult your organisation's IT policy before changing anything on company hardware or software.
