Without proper security, mobile devices are easy targets for worms, viruses, and so-called robot ("bot") networks. Hackers increasingly use bot networks to launch massive attacks against eCommerce websites--potentially targeting one's online tuition payment or fundraising/financial development systems. How can one defend his mobile systems against such threats? This article outlines five basic steps for achieving an effective mobile security program, namely: (1) What's Your Policy?; (2) Plug Information Leaks; (3) Find the Magic Touch; (4) Master Identity Management; and (5) Fire Your Vendors.