In-depth

Enterprise security shoot-out: iPad vs. Android

Davey Winder investigates the relative IT sec pros and cons of iOS and Android tablets…

The tablet wars are being fought by two sides at the minute: the iPad vs. every Android device.

According to the Good Technology Device Activations Report Q3 2011, the number of Android tablet activations seen by the company remain "in the realm of a rounding error" compared with the continuing dominance of the iPad within the realm of the enterprise.

The iPad actually accounted for 96 per cent of all tablet activations during the quarter, with Android mopping up a measly four per cent. If you incorporate smartphones into the equation then the overall dominance of Apple drops, but only to 70 per cent.

This leaves IT Pro wondering if, from a purely security-focused perspective, the enterprise is choosing the right platform. Here's 10 points businesses need to look at when comparing the safety of iOS and Android.

1. Trustworthy ecosystem considerations

The iPad comes with a very positive security plus in that it has a trustworthy application ecosystem in iOS. The walled garden approach taken by Apple with the App Store means there is less chance of a rogue app getting to market when compared to the more open-door submission process for Android apps.

iOS wins out for having a secure application sandbox which, unlike Android, prevents apps from being able to intercept SMS messages.

Eldan Ben-Haim, VP for R&D at Trusteer, points out that applications on iOS are subject to a no-brainer permissions system which imposes "preset security policy dictating what they may or may not do on the device." Few security choices are deferred to device users.

Android users, meanwhile, are faced with "a plethora of permissions, the security implications of which are not always obvious," Ben-Haim said. However, Android's less restrictive nature does mean there are more third-party security tools offering real-time malware protections.

But iOS wins out for having a secure application sandbox which, unlike Android, prevents apps from being able to intercept SMS messages or replace the platform default browser, for example, and thus reduces the attack surface of installed applications.

2. Alien Android invasion threat

IT threat mitigation specialists Cryptzone warn that running Android apps on iPads via the Dalvik virtual machine from the Android OS opens the doors of the enterprise to extreme risk. On-device security measures will likely no longer protect them from malware introduced in ported Android apps.

The Dalvik port creates a software wrapper around the Android apps, tweaked to handle Android I/Os on iOS. This also creates a very real risk of black hat hackers taking the opportunity to circumvent the Apple walled garden when it comes to app distribution, and with it the opportunity to introduce Trojans and the like.

3. Too many Android variants

The success of Android as a platform is, partly, down to the fact that it's not tied to any particular device manufacturer. This is also a distinct security disadvantage as far as the enterprise is concerned. Effectively, it introduces too much inconsistency into the data protection mix.

"The wide variety of the number of Android tablets and the Android version they are running could be a cause for concern," said Andrew Wild, CSO at Qualys. "While some versions of the Android tablet are capable of running full encryption, not all versions are, which could mean that some tablets are not encrypted, potentially putting the data at risk. The bottom line of this is that I'm not sure we can consider all Android tablets the same."

4. Full disk encryption options

Although the full disk encryption mode is not switched on by default, at least it does come as standard with iOS and can be configured using mobile device management software to protect corporate data on a business' iPad.

As already mentioned, Android exists on a wide variety of device hardware from myriad vendors. This means that you are leaving OS updates to the mercy of the hardware manufacturer or network provider, the end result of which is a real mishmash of Android OS versions out there.

"This means many devices are several versions behind and potentially missing key features," warns Sophos product specialist Chris Pace. "For example only versions of Android 3.0 and above have full disk encryption."

Featured Resources

The definitive guide to warehouse efficiency

Get your free guide to creating efficiencies in the warehouse

Free download

The total economic impact™ of Datto

Cost savings and business benefits of using Datto Integrated Solutions

Download now

Three-step guide to modern customer experience

Support the critical role CX plays in your business

Free download

Ransomware report

The global state of the channel

Download now

Recommended

Indiana notifies 750,000 after COVID-19 tracing data accessed
data breaches

Indiana notifies 750,000 after COVID-19 tracing data accessed

18 Aug 2021
Pearson fined $1 million for downplaying severity of 2018 breach
data breaches

Pearson fined $1 million for downplaying severity of 2018 breach

17 Aug 2021
“Great resignation” sparks concern over insider data leaks
data protection

“Great resignation” sparks concern over insider data leaks

13 Aug 2021
Data breach exposes millions of seniors' data
big data

Data breach exposes millions of seniors' data

9 Aug 2021

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

17 Sep 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

17 Sep 2021