The device is the perimeter
A smartphone today stores email, contacts, calendars, document vaults, and often the second factor for every system your firm relies on. Losing control of the device means losing control of the data. The legacy advice from 2016 still holds: the phone is the perimeter. What has changed is the volume of regulated data that moves through it and the sophistication of the threats that target it.
Keep the stack current
Operating system and application updates deliver security patches for vulnerabilities that are already being exploited. Enable automatic updates for the OS and for every app you keep. Delete applications you have not opened in ninety days. Unused apps expand the attack surface, often run background location tracking, and are the last to receive patches. A lean device is a defensible device.
Require strong authentication
Biometric unlock (Face ID, fingerprint) is convenient and strong against casual access. Pair it with a device passcode that is at least six digits, ideally alphanumeric. Configure the device to require the passcode after restart and after a short idle timeout. Disable lock-screen notifications that reveal message previews or calendar details. If the device supports it, enable lockdown mode or the equivalent hardened profile when you travel.
Control location and sharing
Location services feed useful features and feed data brokers. Review every app's location permission and set it to "While Using" or "Never" unless continuous location is essential. Audit social media privacy settings before you travel. Posting real-time location or vacation photos signals that your home or office is unattended and can expose client-adjacent metadata. Share photos after you return.
Back up before you move
An encrypted cloud backup (iCloud, Google One, or your firm's approved solution) and a local encrypted backup to a trusted computer give you two recovery paths. Verify the backup completes before you leave. If the device is lost, stolen, or wiped by a border agent, you restore to a replacement device in minutes rather than reconstructing practice data from memory.
Treat every network as hostile
Public Wi-Fi in airports, hotels, and cafes is convenient and untrusted. Attackers can spoof SSIDs, intercept unencrypted traffic, and capture credentials. The safest default is cellular data. If you must use Wi-Fi, connect only to networks that require WPA3 or at minimum WPA2-Enterprise authentication, and immediately launch your firm's approved VPN. Configure the VPN to block all traffic if the tunnel drops (kill switch). Do not transmit client data, enter passwords, or approve MFA prompts on an untrusted network without the VPN active.
Disable radios you are not using
Wi-Fi and Bluetooth radios broadcast probe requests that can be fingerprinted to track your movement. Turn them off when you are not actively connected. Airplane mode with selective re-enable of cellular is a clean way to ensure only the radio you intend is active. This also preserves battery for the day.
Enable remote find and wipe
Apple's Find My and Google's Find My Device work only if they are enabled before the device disappears. Turn them on. Verify that remote erase is configured and that you can trigger it from a second trusted device or web console. If your firm uses an MDM solution, confirm that the MDM remote wipe policy is active and tested. A device that can be wiped remotely is a device that cannot leak client data.
Border crossings and device searches
At many borders, authorities may demand device access. Power the device off before you reach the checkpoint; this forces the passcode requirement and disables biometric unlock. Carry only the data you need for the trip. Use a travel profile or a separate device with a minimal dataset if your practice permits. Know your firm's policy on compelled decryption and have the contact for outside counsel ready.
Physical custody habits
Keep the device on your person, not in a checked bag or a hotel safe. Use a privacy screen in public spaces. Never leave the device unattended while unlocked. A USB data blocker (charge-only adapter) prevents juice-jacking when you must use a public charging port. These are low-effort habits that defeat high-impact attacks.
Incident response in the field
If the device is lost or stolen, trigger remote wipe immediately. Rotate every credential that was stored or accessible on the device: email, VPN, password manager, MFA tokens. Notify your firm's security contact and, if client data may have been exposed, follow your breach notification obligations. Document the timeline. Speed limits exposure.
A checklist you can pack
- OS and apps updated
- Unused apps removed
- Biometric plus alphanumeric passcode enabled
- Lock-screen notifications hidden
- Location permissions minimized
- Social media set to private
- Encrypted backup verified
- VPN installed and kill switch tested
- Wi-Fi and Bluetooth off by default
- Find My and remote wipe enabled
- Travel dataset minimized
- USB data blocker in bag
- Incident contact card in wallet
Each item is a control. Together they form a posture that travels with you.