How to protect executives' smartphones and corporate communications

Why executives' smartphones are the target of attacks

Executives, business owners, CFOs, lawyers and senior managers have access to information that can be valuable to attackers.

These can be:

• financial documents;
• commercial negotiations;
• access to banking;
• correspondence with partners;
• internal decisions of the company;
• personal data of customers;
• access to CRM, mail and cloud services.

For an attacker, a smartphone can become a shortcut to corporate information.

The main risks of mobile devices

The most frequent problems arise not because of "complicated hacking", but because of weak settings and lack of control.

Typical risks:

• weak password or lack of biometrics;
• lack of two-factor authentication;
• dangerous applications;
• excessive permissions for programs;
• synchronization of sensitive data to the cloud;
• connecting to public Wi-Fi;
• phishing links in messengers;
• lack of an action plan in case of device loss.

Mobile security starts with proper device and account configuration.

Account protection

The first level of protection is accounts: Apple ID, Google, corporate mail, messengers, CRM, banking services.

What you need to configure:

• strong password;
• two-factor authentication;
• backup access codes;
• checking connected devices;
• control of active sessions;
• separate accounts for work and personal use.

It is especially important to regularly check which devices have access to your account and delete unknown or old sessions.

Secure messengers and communications

Messengers have become the main channel of business communication. But not every messenger is equally secure, and even a secure app can be misconfigured.

What should be considered:

• whether end-to-end encryption is used;
• whether disappearing messages are enabled;
• whether contact keys are checked;
• whether access to message history is restricted;
• whether the data is synchronized to the cloud;
• whether the device itself is protected.

For confidential conversations, it is important not only to "choose a messenger", but also to set the rules for its use correctly.

Control applications and permissions

Many apps have access to contacts, geolocation, camera, microphone, files, and messages. Some of these permissions may not be necessary for the application to work.

Companies worth checking out:

• what applications are installed on the devices;
• what permissions they have;
• whether there are suspicious configuration profiles;
• whether unknown VPNs or certificates are used;
• programs from unreliable sources are not installed.

Fewer unnecessary applications means a smaller attack surface.

VPN, Wi-Fi and traffic protection

Public Wi-Fi networks in hotels, cafes, airports or co-working spaces can be dangerous. If the traffic is not secured, there is a risk of the connection being intercepted or tampered with.

For mobile security, it is important to:

• use a verified VPN;
• do not connect to random Wi-Fi networks;
• disable automatic connection to open networks;
• use the mobile Internet for sensitive operations;
• do not open important services through unreliable networks.

A VPN does not solve all problems, but it significantly reduces the risks when working outside the office.

What to do in case of loss or suspected compromise

The company should have a simple scenario of actions in case of smartphone loss or suspicious activity.

First steps:

1. Lock the device remotely.
2. Sign out of corporate accounts.
3. Change passwords for critical services.
4. Check active sessions.
5. Notify the responsible person in the company.
6. Check access logs.
7. If necessary, erase the data from the device.

The main thing is not to wait. In mobile incidents, speed of response is critical.

A practical checklist for business

To reduce the risk of information leakage through smartphones, companies should implement a basic set of rules.

Minimum checklist:

• password or biometrics on all devices;
• MFA for mail, CRM and cloud services;
• separate work and personal accounts;
• control of access to corporate data;
• VPN for working outside the office;
• regular checking of applications and permissions;
• protection of messengers;
• backup plan in case of device loss;
• instructions for managers and teams.

These steps do not require complex infrastructure, but significantly increase the level of protection.

Conclusion

A manager's smartphone is a full-fledged part of the corporate infrastructure. Messages, documents, accesses, financial decisions and strategic information pass through it.

If a company does not control mobile security, it leaves open one of the most important channels of risk. The protection of smartphones, messengers and mobile accounts should be as systematic as the protection of servers, networks and web applications.