07:10 PM
Connect Directly

How To Safely Retire Mobile Devices

Once employees bring their new iPads, Androids, to work after Christmas, their older mobile devices must be decommissioned to protect company data

One company destroyed an old server it had replaced by dousing it in Thermite and setting it ablaze in the company's parking lot.

"We lit it on fire and watched it [get destroyed]," says Tyler Shields, who witnessed the extreme data-wiping incident at one of his former employers. "That's one effective way to do it, certainly."

But unless your company's smartphones or tablets are used by the President of the United States or contain classified or highly sensitive information, pyrotechnics aren't necessary to ensure that older mobile devices don't leak data, says Shields, a senior analyst for security and risk management at Forrester Research.

Just how to properly purge employees' older smartphones and tablets when they return to work after Christmas with their new devices is a major holiday headache for IT and security teams. The number of employee-owned smartphones and tablets continues to skyrocket: The devices will number more than 1 billion by 2018, according to Juniper Research.

"Most people are working on their second or third generation of smartphone or tablet, so they're going to be disposing of them [in lieu of new ones]," says David Lingenfelter, information security officer at mobile device management firm Fiberlink. "A majority of them keep them, and 58 percent are going to keep them inactive. That's not bad, but that typically means they're being passed on to their children, and they will do something with them."

Lingenfelter says a Harris survey commissioned by Fiberlink last year found that 68 percent of the workforce does not professionally wipe or destroy their devices.

[With employees bringing their smartphones and tablets into the workplace, companies need to work to limit the threat posed by mobile applications. See 5 Steps To Managing Mobile Vulnerabilities .]

Here are some basic rules of thumb for users recycling or disposing of a smartphone or tablet:

Activate the factory wipe feature.
Before you hand down that tablet to your grade schooler, wipe it using, for example, the "factory data reset" function on an Android or the "Reset" function on an iPhone or iPad. That wipes all data and any apps you added from the device, which returns to its out-of-the-box unregistered setting.

"The little things you don't necessarily think of when you're passing the device on to your children -- children like to click on things, and they may make a mistake and adjust your finances" if you don't wipe the tablet, for instance, Lingenfelter says. "Go back to factory defaults, so the kids can set it up [for] themselves and your personal and corporate information is gone."

Sometimes going through the wipe process twice makes sense to ensure the device is clean, he says.

Don't forget to remove the SD card.
This is a common oversight: A user wipes the phone properly, but leaves the SD card in place, which may be storing data. The factory reset doesn't touch the card, security experts say. This is an issue with many Android devices. "You have to remember to take the card out," Lingenfelter says.

Some Android users configure their apps to save the SD card first, notes Forrester's Shields. "Pull the card and replace it with a new one. Then, A, you've got a backup copy of the data, and, B, you don't have to worry about any secure wipe technologies," he says.

And any SIM card also should be pulled out when you deactivate a phone, Lingenfelter says. "A lot of SIMs can keep a copy of your contact list," he says.

School your employees on your organization's decommissioning procedures.
Even when mobile device management (MDM) technology is in place, things can go awry when mobile devices are retired. "Once [the device] is disconnected from MDM, all is safe and secure is not always the case," Shields says. "People may be lulled into a false sense of security. The device now yours is not always 100 percent secure."

Organizations should consider a default factory reset wipe whenever a user or his or her device leaves the organization. "Then you make sure there are no fragments slipped outside the network," he says.

And be sure employees are educated on the procedures for retiring or recycling a personal mobile device. "A lot of companies now implement MDM, with containerization, where all enterprise software and data stays in one section [of the device] and is not able to be contacted by personal software or leaked out by Dropbox" or another app, says Lingenfelter.

Users should notify IT when they bring in their new Christmas iPads, for example. "If they are going to use it for work, you have to make sure they take the proper steps," he says.

But keep in mind that even the best decommissioning practices can be bypassed by clever hacks. "At the end of the day, you're never going to guarantee complete security when you're selling your phone. There are all sorts of extremely advanced attacks," Forrester's Shields says. "If you're paranoid about it, don't sell it. Destroy it."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-10-24
adsetgroups in Centrify Server Suite 2008 through 2014.1 and Centrify DirectControl 3.x through 4.2.0 on Linux and UNIX allows local users to read arbitrary files with root privileges by leveraging improperly protected setuid functionality.

Published: 2014-10-24
The Remote Controls feature on Samsung mobile devices does not validate the source of lock-code data received over a network, which makes it easier for remote attackers to cause a denial of service (screen locking with an arbitrary code) by triggering unexpected Find My Mobile network traffic.

Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.