Posted by Adrian Ludwig, Director, Android Security
Editor's note: Highlights and a few remaining questions from a previous security discussion. Find the recording of the "Android Security to the N-th Degree" discussion, which incorporated questions and comments from this post, here.
In April we shared our
Android Security 2015 Year in Review report and took a deeper dive into Android security with a live Hangout on Air to discuss the trends and hard data;
you can still view the recorded session.
Some interesting highlights from the report include data showing that Android runs more than 400 million automatic security scans per day on devices and this helped limit the number of potentially harmful apps (PHAs) installed to less than 0.15% of devices that only get apps from Google Play. Note that devices that install apps from outside of Google Play are around 10 times more likely to have a PHA. As a follow up, we’re taking some time today to answer a few of the remaining questions from our live Hangout in April.
Will you have a plan to release a security patch via an app, such as WebView, in Play Store instead of a security patch by the manufacturer?
We do think it's possible for more of the framework to be updated by Google directly — there’s some architectural work that we're doing to make this possible in a future release.
Are all Android versions encrypted?
Android has provided full disk encryption since Android 3.0. Users can enable it by going into settings and turning it on. For newer devices, encryption may be turned on by default. And starting with Android M, all new devices that meet a performance requirement (being capable of encrypting over 50MB/S using AES, or the Advanced Encryption Standard) must be encrypted by default. These requirements are described in more detail in the
Android Compatibility Definition Documentation (CDD).
Android N is introducing a new feature "Direct Boot" and a file based encryption mechanism that improves usability while maintaining encryption of user data.
Given that Android is making advancements towards the phones being used in enterprise [Android for Work], what are the security improvements that have been made specifically to make the phones more secure for enterprise? What are the security improvements that the team is working on that we will likely see in the near future?
Most of the security improvements that we make in Android have the dual purpose of protecting both enterprise and consumers, but there are some features that are more specific to enterprises. "Profiles," for example, were introduced to make it easy to separate work data from personal data. We've also added APIs so that application developers (including Mobile Device Management vendors or MDMs) can remotely query the state of the device — some more recent examples include the security patch level and adding an API in Google Play Services called SafetyNet.attest that allows an enterprise to confirm that a device is a compatible device.
Verify Apps. As far as I recall it was provided 4 years ago and improved in 2013 with background scanning. What's new now?
We're constantly making improvements to how we identify and protect users from potentially harmful apps. The
2015 year in review describes a number of changes, including the introduction of a technology we call the Anomaly Correlation Engine, advancements in Machine Learning, improvements to our System Integrity Checker, more effective user interface on security warnings and much more.
During next month’s Hangout on Air, we’ll answer your Android security questions and share information on what’s new for work in Android N.
To help kickstart some question ideas, here are just a few of the many new and improved work Android N security features that we’ll discuss:
- Always on VPN for secure data transmission
- Passcode enforcement options on individual work apps
- More granular policies and app permission management
- QR code provisioning to save time and money on device deployments
So, if like many, you’re wondering if Android could be the right mobile solution for your business,
register for our Android N Hangout on Air taking place on August 16 at 9:30am PT.
