Both iOS and Android come with features that are designed to further secure enterprise applications over and above the security level of standard consumer apps. Both operating systems offer some way of segmenting enterprise data from user profile data. In effect, creating a secure container to install enterprise apps and store enterprise data. Furthermore, network transports can be secured on both platforms using technologies such as data encryption, app-specific VPN tunnels and even some form of direct boot mode, where the device stops being a general purpose mobile device and instead becomes a dedicated device for accessing specific enterprise apps. These features are described in detail on the Android and iOS Web pages.
Both operating systems have also been found to contain pretty serious security vulnerabilities in the past. Both are vulnerable to malware attacks, although iOS less so than Android. And both are prone to exposure from potentially dangerous security vulnerabilities due to the installation of third party apps.
Each OS also has its own share of documented security issues. For example, Android has/had problems with the Stagefright vulnerability, and Apple has struggled multiple times with loopholes that allowed apps to execute standard library code directly, bypassing security restrictions. Currently, these vulnerabilities have been patched with up to date versions of both operating systems, but this does not mean that similar vulnerabilities will not be found in the future. You can see the list of Android vulnerabilities here from CVE. Similarly iOS vulnerabilities are available here. As of January 2017, iOS has had total of 984 vulnerabilities whereas Android has had total of 746. Below is a comparison chart by various types of vulnerabilities.
Open Source vs Closed Source: Not A Big Deal
In theory, the open source nature of the Google Android project does make it more vulnerable to security issues. In reality, this is not the case. The same open source mindset that has led to rapid development and improvement of Android, also means that when new vulnerabilities are uncovered, they are fixed very rapidly. On the other hand, the closed source development of iOS should make it more secure and in many ways, it does. But it also means that security vulnerabilities are fixed in a hierarchical manner, often taking longer to push a fix to market than Android.
Major Security Differences
The widest security difference between iOS and Google Android is the way these operating systems are deployed and updated. Android suffers from the significantly adverse effects of fragmentation, which means that there are potentially dozens of versions of the operating system in use at any time, even within a single enterprise. Android-equipped devices ship with a specific version of Android. Whether these devices receive future updates to Android is not a foregone conclusion. Some do, many don’t. Those that don’t are left running an older version. This means that security vulnerabilities need to be patched across a wide range of OS versions and devices. In the chart below, you can see that, as of January 2017, the latest Android version 7.1 has only 0.62% coverage in the business category.
As far as iOS goes, the closed source approach to development and the aggressive way that Apple tends to protect its proprietary technology can hinder data forensics experts in their efforts to diagnose security breaches. Apple is notoriously unhelpful when it comes to opening up parts of their OS to outsiders. And the locked nature of Apple devices adds to this problem. Apple controls the underlying device infrastructure and will not relinquish this control. For example, iOS blocks apps from reading phone number, device UDID etc from the device. In Android, App developers can programmatically query all the device information including the phone number.
The same philosophy is channeled through to the app vetting process for the Apple App store. In comparison with Android apps, iOS apps go through a stringent and thorough process before the app is approved and available for the general userbase to download. Google doesn’t thoroughly test Android apps before they go live onto the Google Play Store. Consider this recent example a simple Android photo app named Meitu requires authorization to access location, phone status and identity, and a host of sensitive cellular functionality that has absolutely nothing to do anything with photo editing.
So Which is More Secure?
Quite frankly, the answer to this question can change day by day. If a major security vulnerability is discovered, such as the aforementioned Stagefright, then that OS becomes incredibly insecure until the vulnerability is fixed. But in a perfect world where no current vulnerabilities exist, then both are equally secure. The choice boils down to this: If you are comfortable allowing a monolithic company drive the security of your enterprise mobile apps, then iOS might be the most secure for you. (Not to mention Apple’s thorough app vetting process that blocks most of the malicious apps before they even show-up on the Apple AppStore.) But if you would rather put your trust in a more rapid, open source development lifecycle, in the belief that this is the best way to ensure that vulnerabilities are fixed quickly, Google Android might be the better option.
This article was written by Codeproof CEO Satish Shetty and originally published in the Dark Reading blog (link is here)
