Mobile

2/7/2017
02:00 PM
Satish Shetty
Satish Shetty
Commentary
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail vvv
100%
0%

Enterprise Android Vs iOS: Which is More Secure?

The answer is not as simple as you think. A mobile security expert parses the pros and cons.

Both iOS and Android come with features that are designed to further secure enterprise applications over and above the security level of standard consumer apps. Both operating systems offer some way of segmenting enterprise data from user profile data, in effect, creating a secure container to install enterprise apps and store enterprise data. Furthermore, network transports can be secured on both platforms using technologies such as data encryption, app-specific VPN tunnels, and even some form of direct boot mode, where the device stops being a general purpose mobile device and instead becomes a dedicated device for accessing specific enterprise apps. These features are described in detail on the Android and iOS Web pages.

Both operating systems have also been found to contain pretty serious security vulnerabilities in the past. Both are vulnerable to malware attacks, although iOS less so than Android. And both are prone to exposure from potentially dangerous security vulnerabilities due to the installation of third-party apps.

Each OS also has its own share of documented security issues. For example, Android has/had problems with the Stagefright vulnerability, and Apple has struggled multiple times with loopholes that allowed apps to execute standard library code directly, bypassing security restrictions. Currently, these vulnerabilities have been patched with up-to-date versions of both operating systems, but this does not mean that similar vulnerabilities will not be found in the future. Here are lists of Android vulnerabilities and iOS vulnerabilities from CVE Details. As of January 2017, iOS has had a total of 984 vulnerabilities whereas Android has had a total of 746. 

Open Source Vs. Closed Source: Not A Big Deal
In theory, the open-source nature of the Google Android project does make it more vulnerable to security issues. In reality, this is not the case. The same open-source mindset that has led to rapid development and improvement of Android, also means that when new vulnerabilities are uncovered, they are fixed very rapidly. On the other hand, the closed-source development of iOS should make it more secure and, in many ways, it does. But it also means that security vulnerabilities are fixed in a hierarchical manner, often taking longer to push a fix to market than Android.

The widest security difference between iOS and Google Android is the way these operating systems are deployed and updated. Android suffers from the significantly adverse effects of fragmentation, which means that there are potentially dozens of versions of the operating system in use at any time, even within a single enterprise. Android-equipped devices ship with a specific version of Android. Whether these devices receive future updates to Android is not a foregone conclusion. Some do, many don’t. Those that don’t are left running an older version. This means that security vulnerabilities need to be patched across a wide range of OS versions and devices. In the chart below, you can see that, as of January 2017, the latest Android version 7.1 has only 0.62% coverage in the business category.

As far as iOS goes, the closed-source approach to development and the aggressive way that Apple tends to protect its proprietary technology can hinder data forensics experts in their efforts to diagnose security breaches. Apple is notoriously unhelpful when it comes to opening up parts of their OS to outsiders. And the locked nature of Apple devices adds to this problem. Apple controls the underlying device infrastructure and will not relinquish this control. For example, iOS blocks apps from reading phone number, device UDID etc. from the device. In Android, app developers can programatically query all the device information, including the phone number.

The same philosophy is channeled through to the app vetting process for the Apple App store. In comparison with Android apps, iOS apps go through a stringent and thorough process before the app is approved and available for the general userbase to download. Google doesn’t thoroughly test Android apps before they go live onto the Google Play Store. Consider this recent example: a simple Android photo app named Meitu requires authorization to access location, phone status and identity, and a host of sensitive cellular functionality that has absolutely nothing to do with photo editing.

So Which Is More Secure?
Quite frankly, the answer to this question can change day by day. If a major security vulnerability is discovered, such as the aforementioned Stagefright, then that OS becomes incredibly insecure until the vulnerability is fixed. But in a perfect world where no current vulnerabilities exist, then both are equally secure.

The choice boils down to this: If you are comfortable allowing a monolithic company drive the security of your enterprise mobile apps, then iOS might be the most secure for you. (Not to mention Apple's thorough app vetting process that blocks most of the malicious apps before they even show up on the Apple App Store.) But if you would rather put your trust in a more rapid, open-source development lifecycle in the belief that this is the best way to ensure that vulnerabilities are fixed quickly, Google Android might be the better option. 

Related Content:

 

Satish Shetty is CEO and founder of Codeproof Technologies, an enterprise mobile security software company. Shetty has more than 20 years of security and enterprise software development experience. A recognized leader in the mobile device management space, Shetty also has ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
vikram909060
50%
50%
vikram909060,
User Rank: Apprentice
8/13/2017 | 6:38:59 AM
Ios more sure then Android
Yes this is what most discussion topic about Android and iOS. One ( Android ) is easy to use and second is hard to use ( iOs ) but when it comes to secure so stopping everything to be used is not solution as what ios prefer. I use rooted Android . I am using this Android TV Box https://www.entertainmentbox.com/product/ebox-t8-v-tv-box-2017-internet-streaming-box-version-5/ which is fully rooted with Android firmware and same allowed me to use anything available without ads issue etc. But the risk of virus etc is there is anything you try for which you are not sure can infect system file and this issue is not on ios platform as you cannot do anything lol.
sgh3tti
50%
50%
sgh3tti,
User Rank: Apprentice
7/20/2017 | 1:28:39 AM
Samaung addressing fragmentation issues
Some of the issues with Android fragmentation regarding security have been addressed by Samsung, and possibly other manufacturers within the Android community.

They now wrap up security updates into a standalone update, away from the whole OS update. They're able to push these out at any time without the need for telco approval.
Microsoft, Mastercard Aim to Change Identity Management
Kelly Sheridan, Staff Editor, Dark Reading,  12/3/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Starwood Breach Reaction Focuses on 4-Year Dwell
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I guess this answers the question: who's watching the watchers?
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10008
PUBLISHED: 2018-12-10
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended...
CVE-2018-10008
PUBLISHED: 2018-12-10
An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace br...
CVE-2018-10008
PUBLISHED: 2018-12-10
A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jen...
CVE-2018-10008
PUBLISHED: 2018-12-10
A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
CVE-2018-10008
PUBLISHED: 2018-12-10
A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy san...