What Should Employees Do Right Away When a Work Device is Lost or Stolen?

Posted June 28, 2022

Endpoint security has changed dramatically with the rise of mobile technology. It used to be that computer workstations were the main devices used in a business. They didn’t often go missing, because of their size, and the fact that they usually remained in the same building all the time.

But today’s office is flexible, hybrid, and mobile. In fact, mobile devices now make up about 60% of the endpoints in a typical company and do about 80% of the workload. This may sound surprising, but just think of how often employees opt to read email via their phones and access business apps from tablets and laptops.

This move to mobile device reliance means that data security needs have also changed. Companies now must consider the fact that it’s much more common for a work device to be lost or stolen.

When this happens, it can lead to multiple security nightmares. These include:

Data on the device is stolen
The hacker is able to access company accounts through a persistent login on the device
Access to company cloud storage
A breach that leads to a compliance violation

Healthcare company Lifespan had to pay a HIPAA penalty of $1,040,000 due to a stolen laptop that had unencrypted access to tens of thousands of patient health records.

It’s important to put a device use policy in place that includes what employees should do in the event that a work device is lost or stolen. Here are the steps you should include for employees to take immediately when their work device goes missing.

Report the Device Missing

The faster a company knows that a device is missing, the faster it can spring into action to protect data and accounts the device has access to.

Even if an employee thinks they may have left a smartphone behind at a restaurant and be on the way to retrieve it, it should still be reported as soon as it’s missing.

Use Remote Lock and/or Wipe Options

Most mobile devices and laptops will have the ability to enable remote security that can lock and wipe a device. While experienced hackers can get past device locks eventually, locking the device immediately can provide the necessary time to cut that device off from company systems.

Wiping a device remotely can also be done, but if you don’t have a backup, this means all data will be gone. So, if an employee has a fairly good feeling that the device is safe and just misplaced, lock the device. However, if it was lost in a busy place, like an airport (common pickpocketing location), it’s best to go ahead and wipe the device to remove data because there is a slim chance of getting it back.

70 million smartphones are lost every year, but only 7 percent of them are recovered.

It’s important to lock the device right away because smart thieves will turn on airplane mode to disable the internet connection needed to conduct these remote activities.

Be Careful with “Find My Device” Features

Most mobile devices will also include a “find my device” feature. This can be very helpful if a device goes missing in your home or office and you know it’s on the premises somewhere.

However, it can be dangerous to track down your device in unfamiliar territory. You don’t want to stumble into the den of a fencing operation or end up in a bad part of town.

Logout & Remove the Device from Cloud App Access

Employees should use a browser from another device to log into business apps and go to the settings that show authorized devices. From there, they should immediately log the device out of the system and then, if possible, remove the device’s access to the app.

Companies with endpoint device managers (like Intune in Microsoft 365 Business Premium) can use the features of that system to instantly revoke access for the device to all company assets.

Don’t Forget Cloud Storage!

One of the first cloud apps you want to log the device out of is cloud storage systems. Devices are often syncing with these automatically, making it easy for a device thief to upload a malware or ransomware file and infect a company’s entire cloud storage system.

Look for approved or authorized devices in the cloud account settings and remove authorization for the missing device.