- Jan 8, 2011
- 22,361
Related post: Please stop saying 'it depends'! - NCSC Site
Returning to the main question: Which smartphone is the most secure?
One of the reasons we do threat modelling is to understand what we mean by 'Is it secure enough?'. By understanding the capabilities and motivation of our attackers, we implicitly set some requirements on our devices and the procedures we use to mitigate those threats.
What we’ve found is pretty interesting; from a security perspective there's not much to choose between any of the most common smartphone platforms, as long as they're kept up-to-date and well managed (when considering the typical sort of attackers we care about in government).
To put it another way, you’re unlikely to find a bad guy that can successfully attack one up-to-date and well-managed smartphone platform, but not the others.
That doesn’t mean we’ve solved device security – far from it.
It’s true that iOS has some clever exploit mitigation technologies. But it’s also true that Samsung has developed some rather neat integrity and separation technologies to keep work data separate from personal malware.
Android has Android for Work, which is a great feature for managing mixed-use devices in an enterprise. But if you want high-granularity enterprise controls you'll probably want to use Windows.
So next time you see an article that says 'X is more secure than Y', think 'So what?'. As long as the device is secure enough for you, that’s what matters.
Source posted above.
What are your views on this, do you agree with the above pointers?
- kept up-to-date and well-managed
- exploit mitigation in iOS
- integrity and separation technology in Samsung (Android)
- windows for enterprise
"as long as it's secure for you".
One of the things that I (and many other cyber security people) do far too often is answer perfectly reasonable questions with the words 'Well, it depends...'
Why can't we provide a simple answer to a simple question?
Why can't we provide a simple answer to a simple question?
One of the reasons we do threat modelling is to understand what we mean by 'Is it secure enough?'. By understanding the capabilities and motivation of our attackers, we implicitly set some requirements on our devices and the procedures we use to mitigate those threats.
What we’ve found is pretty interesting; from a security perspective there's not much to choose between any of the most common smartphone platforms, as long as they're kept up-to-date and well managed (when considering the typical sort of attackers we care about in government).
To put it another way, you’re unlikely to find a bad guy that can successfully attack one up-to-date and well-managed smartphone platform, but not the others.
That doesn’t mean we’ve solved device security – far from it.
It’s true that iOS has some clever exploit mitigation technologies. But it’s also true that Samsung has developed some rather neat integrity and separation technologies to keep work data separate from personal malware.
Android has Android for Work, which is a great feature for managing mixed-use devices in an enterprise. But if you want high-granularity enterprise controls you'll probably want to use Windows.
So next time you see an article that says 'X is more secure than Y', think 'So what?'. As long as the device is secure enough for you, that’s what matters.
Source posted above.
What are your views on this, do you agree with the above pointers?
- kept up-to-date and well-managed
- exploit mitigation in iOS
- integrity and separation technology in Samsung (Android)
- windows for enterprise
"as long as it's secure for you".
