The importance of wiping devices before upgrading

Inside the enterprise: Smartphone users are being encouraged to wipe their handsets before selling them on. Businesses should follow suit.

The average person keeps their mobile phone for two years. And manufacturers are releasing new handsets, and especially smartphones, more and more often.

According to smartphone maker HTC back in 2007 the average shelf life of a phone was three years. Now it is just six months.

This is leading to a growing pile of unloved and obsolescent phones on desks or in cupboards. But as we become more environmentally and economically conscious, more of us are selling or trading in our old devices.

Unfortunately, that green awareness or financial savvy is not going hand in hand with improved awareness of the security and privacy risks posed by the data held on phones.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

In a YouGov poll, funded by mobile security company Blackbelt, 41 per cent of Britons have recycled or sold a handset, but only half performed a factory reset of the device before selling it or giving it away. Over a quarter did not even remove the SIM card.

Even relatively innocuous information, such as a phone's address book, could be very damaging in the wrong hands.

Given the way both business and personal smartphones are being used to store company information, or access resources from email to business intelligence, these are statistics that should worry IT managers.

Even relatively innocuous information, such as a phone's address book, could be very damaging in the wrong hands.

Add tablets into the mix, and the picture is even more worrying: with their larger screens, and greater memory capacities, tablets can hold even more sensitive data.

Even so Blackbelt's Ken Garner claims even a factory reset is not guaranteed to wipe all data from a modern phone.

Advertisement - Article continues below

The process may prevent a buyer in the second-hand store from accessing your address book or photo library, but it will not stop a determined hacker from recovering data from the device's flash memory.

Ironically, a technique used to prolong the lifespan of the phone called wear leveling makes it harder for users to erase data permanently.

For businesses, this raises the very real prospect of data leakage. Relying on users to wipe their phones before they sell them is not enough.

Instead, IT managers should use both the remote wiping functions in their mobile device management software to "clean" phones, and consider using either a special data erasure application, or a certified, secure recycling company to dispose of mobile devices.

Advertisement
Advertisement - Article continues below

This might be more expensive than simply trading in the phones, but the security benefits should compensate for the additional cost or lack of resale revenue.

But what about employees' own devices? The simple, and simplistic, answer is to ensure that sensitive data is not stored on them in the first place. Failing that, businesses need to consider using sandbox technology, or virtual desktop environments, to keep business data separate.

Advertisement - Article continues below

Either that, or provide staff with company-issued smartphones, that the business manages and disposes of. It might come at a price, but it is cheaper than a fine from the Information Commissioner.

Stephen Pritchard is contributing editor at IT Pro.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Most Popular

Visit/policy-legislation/data-governance/354496/brexit-security-talks-under-threat-after-uk-accused-of
data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020
Visit/policy-legislation/data-protection/354492/currys-pc-world-parent-firm-hit-with-ps500k-fine-over
data protection

Currys PC World parent firm hit with £500k fine over historic data breach

9 Jan 2020
Visit/security/ransomware/354483/travelex-disruption-caused-by-devastating-ransomware-attack
ransomware

Travelex disruption caused by devastating ransomware attack

8 Jan 2020