Enterprise security shoot-out: iPad vs. Android

The tablet wars are being fought by two sides at the minute: the iPad vs. every Android device.

According to the Good Technology Device Activations Report Q3 2011, the number of Android tablet activations seen by the company remain "in the realm of a rounding error" compared with the continuing dominance of the iPad within the realm of the enterprise.

The iPad actually accounted for 96 per cent of all tablet activations during the quarter, with Android mopping up a measly four per cent. If you incorporate smartphones into the equation then the overall dominance of Apple drops, but only to 70 per cent.

This leaves IT Pro wondering if, from a purely security-focused perspective, the enterprise is choosing the right platform. Here's 10 points businesses need to look at when comparing the safety of iOS and Android.

1. Trustworthy ecosystem considerations

The iPad comes with a very positive security plus in that it has a trustworthy application ecosystem in iOS. The walled garden approach taken by Apple with the App Store means there is less chance of a rogue app getting to market when compared to the more open-door submission process for Android apps.

iOS wins out for having a secure application sandbox which, unlike Android, prevents apps from being able to intercept SMS messages.

Eldan Ben-Haim, VP for R&D at Trusteer, points out that applications on iOS are subject to a no-brainer permissions system which imposes "preset security policy dictating what they may or may not do on the device." Few security choices are deferred to device users.

Android users, meanwhile, are faced with "a plethora of permissions, the security implications of which are not always obvious," Ben-Haim said. However, Android's less restrictive nature does mean there are more third-party security tools offering real-time malware protections.

But iOS wins out for having a secure application sandbox which, unlike Android, prevents apps from being able to intercept SMS messages or replace the platform default browser, for example, and thus reduces the attack surface of installed applications.

2. Alien Android invasion threat

IT threat mitigation specialists Cryptzone warn that running Android apps on iPads via the Dalvik virtual machine from the Android OS opens the doors of the enterprise to extreme risk. On-device security measures will likely no longer protect them from malware introduced in ported Android apps.

The Dalvik port creates a software wrapper around the Android apps, tweaked to handle Android I/Os on iOS. This also creates a very real risk of black hat hackers taking the opportunity to circumvent the Apple walled garden when it comes to app distribution, and with it the opportunity to introduce Trojans and the like.

3. Too many Android variants

The success of Android as a platform is, partly, down to the fact that it's not tied to any particular device manufacturer. This is also a distinct security disadvantage as far as the enterprise is concerned. Effectively, it introduces too much inconsistency into the data protection mix.

"The wide variety of the number of Android tablets and the Android version they are running could be a cause for concern," said Andrew Wild, CSO at Qualys. "While some versions of the Android tablet are capable of running full encryption, not all versions are, which could mean that some tablets are not encrypted, potentially putting the data at risk. The bottom line of this is that I'm not sure we can consider all Android tablets the same."

4. Full disk encryption options

Although the full disk encryption mode is not switched on by default, at least it does come as standard with iOS and can be configured using mobile device management software to protect corporate data on a business' iPad.

As already mentioned, Android exists on a wide variety of device hardware from myriad vendors. This means that you are leaving OS updates to the mercy of the hardware manufacturer or network provider, the end result of which is a real mishmash of Android OS versions out there.

"This means many devices are several versions behind and potentially missing key features," warns Sophos product specialist Chris Pace. "For example only versions of Android 3.0 and above have full disk encryption."