At CTIA, Samsung announced its SAFE program, designed to make its Android smartphones more acceptable to IT organizations and provide a better alternative to BlackBerry, which has historically been viewed as the most secure of the volume platforms for business.
However, I think Samsung must have missed a meeting because it seems to have completely ignored what is primarily making Android unacceptably unsecure. Android remains the only mobile platform that is being actively blocked by IT executives due to security problems. Samsung has also had unique security problems associated with the unique ARM processor it uses and, as a result, it may actually be the least secure of the Android vendors.
Generally, it is a near-complete lack of focus on security by Google, Android’s parent. Most of the reported problems currently have to do with apps that seem legitimate but contain malware that can capture keystrokes, transfer files or bot the phone. The incidence of malware on Android, according to Kaspersky (one of the leading anti-virus companies) tripled in one quarter last year and 2013 has been dubbed the “Year of Mobile Malware” by BitDefender, referring mostly to Android, and it was pointed out that a whopping 41 percent of Android phones were infected by the end of last year and that this number would increase substantially by the end of 2013. That is one out of two phones, and likely increasing to over two out of three by the year’s end.
So it is the files, or in Samsung’s case, some unique problems with its processor that make the Android phones unsecure. Let’s now look at Samsung SAFE.
Samsung SAFE has at its core an MDM (Mobile Device Management) component, allowing the firm to take control of the phone. Details about this component are sparse, but IT should be able to brick the phone if locked and assure applications are running on the phone and are up to date. It has an encryption component for better protecting the files; it has a VPN component, which allows the phone to drill through firewalls; and it has email hooks that better tie into Exchange.
Unless a white list is implemented, which is very unusual for Phones, tablets or PCs, the MDM component can’t address the problem of malware apps the user installs. Given that many of these apps look legitimate, the phone could be rooted only if the phone is barred from installing any app not approved, and if approved apps are tested to make sure they haven’t been compromised. This would address the security issue and users typically will not accept this kind of restriction on their PCs, let alone their phones.
Encryption does protect the files on the phone if they are all encrypted, but encryption is commonly turned off on phones because it robs performance and if there is a keylogger installed, the IDs and passwords needed to gain access to the native files on the host servers would be exposed. This is exacerbated by the use of a VPN, which, if compromised, would bypass the corporate perimeter security, potentially allowing a remote attacker to tunnel through it and give them unprecedented access to anything the user had authority to view. Think of the CEO’s phone and you have everything from intellectual to SEC exposures in one device.
Better connection to corporate email is nice, but that is really more interoperability than security. In short, given the source of the exposure (malware-infested apps) and unique Samsung hardware, only one component addresses part of this and it does so very poorly.
BlackBerry, because of its business focus, was designed to be secure. It has a fully curated app store making it far more difficult for the malware to get onto the device in the first place. It is a full hardware/software custom implementation, which allows BlackBerry to assure the components work together to create a more secure whole. Because the platform isn’t as popular, it is also attacked far less often than other OS types. And BlackBerry 10 is already FIPS-certified.
BlackBerry was designed with MDM in mind; it isn’t an overlay, and the process has been created and vetted over a decade of being tied to IT policies. The new BlackBerry 10 platform allows for two separate data repositories: one secured by the enterprise administrators and one open to users. This allows the corporate data to remain separate and secure should the user load something that compromises their own security and it supports the concept of Privacy by Design.
What is unique to BlackBerry is it ties its tablet into the phone ecosystem so that both can be centrally managed and the tablet apps can be sandboxed. Apps are monitored and if they behave strangely will create an alert, potentially preventing malware-based attacks like those that plague Android. There are specific features that can increase the security of email and place permissions on applications, preventing the installation of apps that might harm or compromise the phone or tablet.
In short, even though the BlackBerry is less likely to be attacked in the first place, it was designed at the outset to both be more secure and better able to defend against the threats that both Android and, to a far lesser extent, iOS are experiencing.
In the end, on reading the Samsung SAFE material, I felt that it simply hadn’t understood or simply couldn’t address the threats that the Android platform represented. The company really can’t be blamed; it isn’t its platform after all. However, neither Google nor Samsung have truly crossed over into becoming an enterprise-class vendor. BlackBerry had to become one last decade in order to sell its products to its primary business and government markets.
The result should be very apparent: BlackBerry is designed to protect business buyers and Android was designed to be a cheap iOS alternative focused on consumers. When it comes to security, the roots of these too offerings sharply distinguish them and no partial overlay like SAFE can fix the fundamental security problems with the related hardware and software.