Security Analysis of Smartphone Platforms

posted in #Mobile & Cloud on the 6.05.2014

Current smartphones have significant data-processing capabilities and are increasingly being used to process critical corporate data. For this reason, common smartphone platforms have  been supplemented with many security features in recent years, which were initially not present as the primary sales target was the private user. The current versions of Android, iOS, Windows Mobile and Blackberry support a large number of security features that are suitable for use in enterprise environments and for handling security-critical data. Examples of these features include the integration of encryption systems, management interfaces that allow policies to be defined for these devices, or secure key material and password storage. The aim of the attached A-SIT study is to provide a basis for assessing the suitability of a smartphone platform for use in the enterprise.

Specifically, the following points will be examined in more detail:

  • Basic security properties
  • Access control
  • Encryption
  • Software sources
  • Update situation
  • Mobile device management interfaces
  • Bring-your-own-device capabilities

The following presentation is intended to show the differences between the individual platforms. For more detailed explanations and a detailed analysis of the individual platforms, please refer to the full version of the study (available in German) below.

Tabelle Sicheheitsfunktionen

Since the encryption system is an essential component with respect to protecting sensitive data and cryptographic keys, the corresponding components of the platforms iOS and Android have been subjected to a detailed analysis.

Downloads

File Description File size
pdf Study (DE) Version 1.3.4 of 24.5.2016 (German only)
1 MB
pdf Paper Android Encryption Systems, PRISMS 2014
322 KB
pdf Paper iOS Encryption Systems – Deploying iOS Devices in Security-Critical Environments, SECRYPT 2013
554 KB