Sixty percent of the endpoints in the average company are mobile devices. Employees work much differently today than a decade or two ago. They’re often working from home and when traveling. Laptops, tablets, and smartphones make this possible.
But those laptops and mobile devices also mean higher security risk. They often don’t have the same protections in place as desktop computers. They are also much more susceptible to theft or loss.
Approximately 70 million smartphones are lost every year with only 7% of them recovered.
When a mobile device or laptop goes missing, all the data that the device has access to is at risk. A thief could automatically be logged into a business email account, for example, without even needing to know the password.
These devices have persistent connections to company networks and business data through apps that sync with company files. So, as soon as a device is lost, it can mean a data privacy compliance violation or data breach that impacts the entire organization.
One of the HIPAA fines issued in 2020 was to Lifespan Health System, which had to pay $1,040,000 for a stolen, unencrypted laptop breach. That’s a hefty penalty to pay for a lost or stolen device.
Here’s What Employees Should Do When a Work Device Goes Missing
Time is of the essence when a device goes missing. The faster you can respond to disconnect the missing device from your company data and network, the better chance you have of avoiding a breach.
It’s important to train employees on the steps to take immediately after a device is lost or stolen, so company risk can be mitigated.
Report the Device As Missing to the Company
Precious time can be lost when a device goes missing if the employee is trying to rectify the situation themselves, but doesn’t report it to the company right away.
They should report any device that goes missing that has a connection to a business application, business email, or has business data stored on it. This includes personal mobile devices used for work.
87% of businesses depend on employees using their personal mobile devices to access business applications.
The first thing an employee needs to do as soon as they realize their device is missing is to notify the company. Even if they think they might know where it was left and are going to search for it, they should notify the company anyhow.
Because if your organization has an endpoint device management solution in place, you can disconnect that device instantly, and always reconnect it should it be located.
Log the Device Out of Active Sessions in Cloud Apps
Apps are often designed with “persistent” logins. This means that every time you open your phone or laptop, you don’t need to log back into Slack, Trello, or Microsoft 365. The apps keep you logged in.
This makes it easy for a criminal that has a stolen device to access an employee’s account, and through that, company data and cloud systems.
Employees should log the device out of all active cloud applications. This can be done by going to those applications in a browser, looking for an area that shows devices in the settings, and logging out the lost device.
Activate “Lock My Device” and/or “Wipe My Device”
Technology has long been around to remotely find, lock, and wipe a device. This only works if it has been enabled and if location services (the GPS tracking mechanism of a device) have also been turned on.
Employees can quickly lock the device, which can slow a thief down because they have to crack the passcode to get in. Additionally, if there is sensitive information on the missing device, and all that data is backed up elsewhere, it can be wiped.
Note, before using “wipe my device,” it should first be logged out of any cloud storage syncing applications on that device. Otherwise, deleting those files could also delete them from cloud storage.
Only use the “find my device” feature if a device isn’t thought to be stolen, but just misplaced (like left in the back of a cab). You don’t want to go walking into a criminal enterprise.
Stop Cloud Storage Syncing
When logging the device out of active sessions in cloud apps, make sure that employees include any cloud storage platforms that the device may be syncing with. A criminal could use that connection to inject ransomware into a company’s cloud storage account.
This includes apps like OneDrive, Google Drive, Dropbox, iCloud, and others.
Change Passwords to Cloud Apps
Another way to protect accounts should a laptop or mobile device go missing is to change those passwords, especially for an email account. Business email is often used on mobile devices, and when you change the password, the device will no longer be able to use that account until the new password is entered.
Doing this can help ward off attempts to use that account for sending out phishing emails.
Improve Your Mobile Device Security With Help from Connect2Geek
Don’t wait until a device goes missing to address laptop, smartphone, and tablet security. Connect2Geek can help your Treasure Valley area business put endpoint device management solutions in place to reduce your risk.
Schedule your free consultation to learn more today! Call 208-468-4323 or reach out online.