In-depth

Enterprise security shoot-out: iPad vs. Android

Davey Winder investigates the relative IT sec pros and cons of iOS and Android tablets…

The tablet wars are being fought by two sides at the minute: the iPad vs. every Android device.

According to the Good Technology Device Activations Report Q3 2011, the number of Android tablet activations seen by the company remain "in the realm of a rounding error" compared with the continuing dominance of the iPad within the realm of the enterprise.

The iPad actually accounted for 96 per cent of all tablet activations during the quarter, with Android mopping up a measly four per cent. If you incorporate smartphones into the equation then the overall dominance of Apple drops, but only to 70 per cent.

This leaves IT Pro wondering if, from a purely security-focused perspective, the enterprise is choosing the right platform. Here's 10 points businesses need to look at when comparing the safety of iOS and Android.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

1. Trustworthy ecosystem considerations

The iPad comes with a very positive security plus in that it has a trustworthy application ecosystem in iOS. The walled garden approach taken by Apple with the App Store means there is less chance of a rogue app getting to market when compared to the more open-door submission process for Android apps.

iOS wins out for having a secure application sandbox which, unlike Android, prevents apps from being able to intercept SMS messages.

Eldan Ben-Haim, VP for R&D at Trusteer, points out that applications on iOS are subject to a no-brainer permissions system which imposes "preset security policy dictating what they may or may not do on the device." Few security choices are deferred to device users.

Android users, meanwhile, are faced with "a plethora of permissions, the security implications of which are not always obvious," Ben-Haim said. However, Android's less restrictive nature does mean there are more third-party security tools offering real-time malware protections.

But iOS wins out for having a secure application sandbox which, unlike Android, prevents apps from being able to intercept SMS messages or replace the platform default browser, for example, and thus reduces the attack surface of installed applications.

Advertisement - Article continues below

2. Alien Android invasion threat

IT threat mitigation specialists Cryptzone warn that running Android apps on iPads via the Dalvik virtual machine from the Android OS opens the doors of the enterprise to extreme risk. On-device security measures will likely no longer protect them from malware introduced in ported Android apps.

The Dalvik port creates a software wrapper around the Android apps, tweaked to handle Android I/Os on iOS. This also creates a very real risk of black hat hackers taking the opportunity to circumvent the Apple walled garden when it comes to app distribution, and with it the opportunity to introduce Trojans and the like.

3. Too many Android variants

Advertisement
Advertisement - Article continues below

The success of Android as a platform is, partly, down to the fact that it's not tied to any particular device manufacturer. This is also a distinct security disadvantage as far as the enterprise is concerned. Effectively, it introduces too much inconsistency into the data protection mix.

"The wide variety of the number of Android tablets and the Android version they are running could be a cause for concern," said Andrew Wild, CSO at Qualys. "While some versions of the Android tablet are capable of running full encryption, not all versions are, which could mean that some tablets are not encrypted, potentially putting the data at risk. The bottom line of this is that I'm not sure we can consider all Android tablets the same."

Advertisement - Article continues below

4. Full disk encryption options

Although the full disk encryption mode is not switched on by default, at least it does come as standard with iOS and can be configured using mobile device management software to protect corporate data on a business' iPad.

As already mentioned, Android exists on a wide variety of device hardware from myriad vendors. This means that you are leaving OS updates to the mercy of the hardware manufacturer or network provider, the end result of which is a real mishmash of Android OS versions out there.

"This means many devices are several versions behind and potentially missing key features," warns Sophos product specialist Chris Pace. "For example only versions of Android 3.0 and above have full disk encryption."

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Most Popular

Visit/policy-legislation/data-governance/354496/brexit-security-talks-under-threat-after-uk-accused-of
data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
Visit/security/cyber-security/354468/if-not-passwords-then-what
cyber security

If not passwords then what?

8 Jan 2020
Visit/policy-legislation/31772/gdpr-and-brexit-how-will-one-affect-the-other
Policy & legislation

GDPR and Brexit: How will one affect the other?

9 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020