What are the best mobile device management policies and procedures to prevent malware?

Es necesario primero establecer un nivel adecuado de seguridad, esto es esencial si no tienes presupuesto para una solución MDM, lo más básico es utilizar una contraseña segura, aplicar cifrado en el dispositivo y memoria microsd en caso de tener instalada una, procura no utilizar varias cuentas al mismo tiempo en el mismo dispositivo, mantén activas las actualizaciones del dispositivo y de las aplicaciones que utilizas, y aplica el doble factor de autenticación en en las aplicaciones que te lo permitan

If the devices are company owned (i.e., not BYOD), consider implementing a "white list" set of apps that are the only ones allowable to be downloaded. This will prevent a potential risk of a malicious risk being downloaded from a third party infecting the device with malware and/or compromising company data.

Generally, biometric authentication on mobile devices is considered at least as secure as passwords or pins, and often more secure than those methods. Of the two, mobile phone fingerprint scanners tend to outperform facial recognition. Hence, adding policies via MDM that support and encourage the use of biometric authentication can help improve the security of devices among your user community.

A strong password need not be longer than twelve characters. What makes a password strong is a combination of special characters, numbers and different cases. It may be challenging to recall complex passwords with this set of instructions so consider chunking to increase memorability. Chunking passwords into three or four character segments might be easier to remember. Consider using a special character such as a hyphen to delimit the chunk. Turning "password1234" into "pas-swo-rd1-234". Next let's use substitution of special characters to increase the strength. So a=@ and a=$, and perhaps o=0 p@s-$w0-rd1-234 And finally capitalize a character. p@s-$w0-rD1-234 This is a much stronger password. Try it with your own special word.

A strong password is easy to remember, but difficult to hack/steal. Avoid writing passwords down, but if you must, keep them in a secure location that is only visible by you and cannot be accessed by others.

Requiring strong passwords, and multifactor authentication is a good way to mitigate threats. Also, by requiring approved installs only and limiting the install of applications can be a very valuable tool to use in an effort to stop threats.

Data backup is mandatory but never forget that it is also important to regularly test the data restoration procedure, do it !

Education should be performed in conjunction with a clearly defined set of usage policies that everyone is expected to adhere to, depending on the source and ownership of the devices. If the devices are owned by the company, consider limiting the apps that users can install on their phones, for instance by establishing a white list of apps as the only ones the user can download, or providing the phone with a pre installed suite and disabling additional installations. If the devices are owned by the employee (i.e., BYOD), establish a strict security policy (i.e., zero trust) by which devices can access company apps and data.

To reduce the risk of mobile devices getting infected with malware one of the most effective way is to use a VPN based solution with SSL inspection to scan all network traffic for malicious content and block the traffic at the inbound data path. Combined with an effective local malware/virus scanner and biometrics for authentication the risk of an infection is reduced. Many MDM solution help with deploying such tools and policies at scale and ensure long term protection by keeping the signatures and defensive frameworks up to date.