Smartphones and tablets are everywhere you look; on trains and buses, in parks and coffee shops. In fact, AIMIA’s 2011 Australian Mobile Phone Lifestyle Index shows that Australia’s uptake of smartphones is higher than the industry average, with 67 percent of Australians owning a smartphone[1]. In the same report, almost half of those surveyed said they either owned a tablet, or were planning to buy one in the near future.
Apart from playing Angry Birds and logging on to Facebook, people are also using their mobile devices for work purposes. They’re reading work emails, tweaking presentations and often accessing private, company data on their smartphones, tablets and laptops, both at home and while travelling.
According to a recent Optus survey, around half of Australian businesses are allowing their staff to bring their own mobile devices to work, with this number only expected to increase in the coming years[2]. This expectation that employees have of being able to connect their personal devices to a work network, sometimes known as ‘The Consumerisation of IT’, poses a number of issues for employers, one of the main issues being security.
How does this relate to small business?
The security threats to small businesses are not dissimilar to those faced by larger organisations when it comes to mobile security; this is basically because the mobile devices are used by employees. So whether you have ten employees using smartphones or a thousand employees using smartphones, the principals are the same.
Traditionally, the IT security issues businesses were faced with included malware, viruses, cybercrime and ID fraud. However, most of these issues were contained within the four walls of the business. Now, with the introduction of business mobile devices, having staff that are remotely accessing company data from a multiple number of devices, means the boundaries of your business are extended far beyond what they used to be; your business is now exposed to security threats from multiple access points. On top of that, the fact that the devices themselves can be lost or stolen, with emails readily accessible, makes your business vulnerable to loss of intellectual property.
You might have done everything you can to make sure your business network is secure, but what about your employees? If they are not using a secure connection to send out business proposals from home; if they’re not protected while paying an invoice using the company credit card on their tablet; if their smartphones don’t have password access and encryption in case the devices are lost or stolen, then the security of your data is at risk.
Here’s a quick risk checklist:
- Do any of my employees have a smartphone, tablet or laptop?
- Do any of my employees access their work emails from these devices?
- Do any of my employees work from home?
If you answered yes to any of the above questions, this means that at least some of your sensitive, company data is not safely kept within the confines of your office. This means that it is possible for your businesses information to be accessed from a number of devices and from a number of locations, making it more vulnerable to hackers and more open to data theft.
What is the solution?
One response from businesses might be to ban all mobile devices. No remote access, no email access on phones, and no external devices to be brought into the company. Sure, this might be one solution, but if offering your staff mobile access to increase productivity and offer a more flexible lifestyle, going backwards and removing this benefit may have a negative reaction.
If having a flexible, mobile workforce is important for you as a small business owner, three simple things can help increase your business’ security:
- A great security tool
- A formal IT policy
- Employee education.
Security tool
There are a number of security solutions on the market for businesses of all sizes. You just need to do some research and choose the one that best suits you. Some of the key features you need to look for when it comes to a security for a heavily mobile business are:
- Professional password management (across devices and also individual files)
- Security that can be managed across a number of devices, whether in the building or working remotely
- Encryption capabilities to safely send files.
A formal IT policy
An IT policy is an essential document for every business, so that all employees have clear guidelines to follow when it comes to using their personal devices for work purposes. For example:
- All devices that are used for work should have the login function enabled
- All devices should have the file encryption function switched on, particularly for sensitive applications or data
- Any devices that cannot be secured cannot be allowed access to the work server.
Even if you don’t have a dedicated IT department, it might be worth speaking to a consultant to discuss the best policy for your business to ensure the adequate guidelines are implemented.
Employee education
One of the biggest issues for businesses is that employees are often unaware of the risks of using their mobile device for work. They may not understand the consequences of leaving their unprotected smartphone full of company emails on it at the pub after a few drinks. They might not know how to put on the password, or why it’s so important. Simply educating employees about the risks to your business their actions may cause you will increase their awareness and help to change their behaviour.
As a business owner, particularly for businesses who don’t have a dedicated IT department, it’s important to think about where and how your employees are logging on, and come up with a mobile security policy that helps combat any potential issues to minimise risk to the business. Keeping your company’s data secure is essential if you want to protect your intellectual property and stay ahead of the competition.
–Nigel Hedges is Technical Services Manager, Kaspersky Lab ANZ.
[1] Australian Mobile Phone Lifestyle Index, 7th Edition, October 2011, Australian Interactive Media Industry Association
[2] Future of Work report, Optus, 2011,
