Howard Pinto, Vodafone UK head of security:

As the use of smartphones increases, so does their business potential; better workflow efficiency, better customer satisfaction, not to mention productivity gains and reduced real estate costs. Gartner predicts they’ll become the preferred mobile working device, overtaking the laptop, within three years.

But as organisations issue their workforce with smartphones, it is vital security is not overlooked. People lose phones all the time; phone users are 15 times more likely to lose a smartphone than a laptop (Symantec Survey 2009). In addition, smartphones do not operate on one standard platform, so it is important that security for these devices addresses the varying security requirements of all platforms.

Arguably any organisation would never give employees a laptop without being confident it is fit for purpose and secure, but smartphone security is still often neglected.

To help SMEs mitigate the growing risk of data leaks and digital threats, here are our top five tips to consider when designing the smartphone security strategy: A holistic approach is best. Businesses need to consider their existing security policy and what company information the policy seeks to protect when looking at how to secure their business networks, data and devices.This approach will help to prevent malware attacking corporate systems and the possibility of information leakage which could compromise corporate data.

Mike Jones, Symantec principal product marketing manager for security:

The growth in smartphones effectively means that more and more business users have the ability to carry around a substantial proportion of the usually office-bound information in their pockets. If this got into the wrong hands it could be hugely damaging. Therefore businesses of all sizes need to ensure that highly valuable data stored on the device cannot be accessed or intercepted by a third party.

It’s inevitable that with more smartphones on the market, there will be greater scope for data disasters, but simple common sense and a few straightforward measures can go a long way in mitigating the risks.

All companies should do the following: Ensure passcode lock is turned on so that a PIN number has to be entered to access the device; Enable ‘auto lock’ so that if the device is not used for a period of time a PIN number will be needed to use the device; Enable encryption measures (such as VPN links or secure sockets layer (SSL) technology) so that email is protected between the device and server; Turn on the ‘fraud warning’ within the browser settings (if available) to guard against being inadvertently sent to poisoned web sites. These can compromise both the device and the user.

Anthony Keyworth, Orange director of product marketing:

One of the most simple and effective ways in which a SME is able to protect their mobile data is through a hosted device management service. This enables businesses to remotely push out security measures across all of their employee devices.

The measures include the ability to remotely lock or wipe a device of sensitive company information should it be lost or stolen, as well as remotely enforcing password policies. The system also has the capacity to raise the alarm to IT managers should an unauthorised application or other piece of software be downloaded onto a device.

In addition, having a hosted device management solution allows IT departments to keep their costs down and their productivity up, by managing the activity of mobile phones in their fleets. For example, they might choose to lock Bluetooth, games or camera functionality.

Device management as a service holds particular benefits for remote and flexible workers. This is because the service offers functionality such as being able to remotely enforce company security policies, push out new security patches, and even remotely diagnose faults to ensure employees out on the road have fully operating mobiles, without having to return to the office.

Bob Sweetlove, HSC business manager:

Much of the smartphone growth can be attributed to consumer users using mainstream consumer internet accounts, but this is probably a valid issue and there must be a lot of concerned IT managers around the world pulling their hair out wondering how they can control all the mobile computing devices in the hands of their company’s employees.

They will often err on the side of caution and not permit company email to be pushed to private employee smartphones. They have had to deal with this issue with laptops for a few years, with a few high profile data losses from stolen notebooks being reported, but typically there are more employees walking around with company mobiles than laptops.

In the larger business community, solutions like BlackBerry BES provide significant functionality to central administrators who can control settings and lock down content and devices very effectively.

However, in the smaller business community where there is typically no employed IT manager, there is a real risk. Outsourcing may be an answer to some businesses with cloud computing solutions that also provide tools to protect data on smartphones and in effect provide an outsourced IT manager. Some of the responsibility lies with the provider of the IT and mobility solution to the small business communities.

Keith Horsted, Gteq channel development director:

There are applications that can be downloaded onto smartphones that will allow you to control the data on the device and protect them against viruses, as well as tracking the device if it is stolen.

I would argue that having a handset stolen or lost is not the worst thing that can happen to a company in terms of mobile data security. The reason for this somewhat controversial statement is quite simply that there are applications that allow your conversations to be monitored and texts matched against your address book and viewed on line (such as flexispy), so where do we draw the line?

Like most security issue the weakest link is the human element; there is no mitigation against someone leaving their phone unattended or inadvertently sending information to the wrong person. Obviously there needs to be a balance between offering a useful service and locking it down so tightly that it becomes a business prevention system and that is entirely up to company involved.

Security is often cited as the reason why Blackberry is used in preference to the Windows Mobile option. This is still the case and Blackberry’s IT policies are very powerful (if used), although Microsoft would argue that they too have the ability to ‘fry’ a device if it is lost or stolen.