READ: Mobile Device Managamanet (MDM) Policies (Best Practice Guide)

CITATION
FiberLink. (2012). Mobile Device Management (MDM) Policies (Best Practice Guide). In MaaS360 (Ed.), (pp. 1-14): Fiberlink.

Interesting paper, more of an informational and a sales pamphlet.  IT is good though as it clearly highlights what they consider mobile security issues all of which interesting they have solutions for.

Some interesting pieces:

• Best practices listed
• Know your industry's regualtions
• Require passcodes
• Enforce encryption
• Restrict device features as necessary
• Keep a watchful eye on apps
• Use TouchDown (their product which only works on Android) for setting up email
• Distribute settings over the air
• Warn first, then remediate policy violations
• Test your policies
• Monitor your devices
• Sales pitch: MaaS will watch over your devices both BYOD and company issued
• Setup as policies as to treat all users the same way (not practical in real world but makes for easier software development)
• Setup passcode expiration
• Sales pitch: with a few clicks you can make your passcode policy a reality
• Apple supports native encryption; Android does not necessarily and may need additional software
• Their recommendations: prevent any devices that cannot be encrypted from connecting to your corporate resources
• While it is a reasonable recommendation, they don't mention how to do this and further, how to block someone from doing this if they are coming in over the telephone network and not Wi-Fi
• Looking at some of their screenshots, one says: "Supported only on iOS 5 and higher"
• What if someone has iOS 4?  Can they bypass the security? 
• Some of their customers require the same apps so employees can collaborate together
• For remediating policy violations, they recommend that it be automated without IT having to learn of the problem and then take action
• This may be fine for small violations but not practical for very secure environments
• Create test scenarios with groups of test users prior to deployment

By: Nima Zahadat

READ: Android Remains Main Target For Mobile Malware Writers Despite iOS Having More Vulnerabilities Says Symantec

CITATION
Lomas, N. (2013). Android Remains Main Target For Mobile Malware Writers Depsite iOS Having More Vulnerabilities, Says Symantec (pp. 1-4): TechCrunch.
 
Interesting article and as Jack said, Apple's iOS is more secure by default.  The article mentions the different approaches of iOS verses Android as different ecosystem approaches: Apple's walled garden versus Android's open playground.

Symantec found 103 new threats targeting Android versus just one for iOS in 2012.  This seems to be caused by Android allowing downloads from third party app locations which iOS does not allow unless the phone is jail broken.  Symantec does point out that rogue software has made it to the Google store in the past as legitimate however.

The Android threats are most common in Eastern Europe and China which utilize the Android platform much more than Apple's iOS.

Another issue is the variety of Android vendors.  While Android is in version 4.x, the vast majority (90% according to Symantec) utilize older versions which are less secure.

...while the [mobile] threat is still small (compared to desktops and LANs), it is now more than doubling year-on-year.


McAfee reported 36,699 pieces of mobile malware, 95% of which cropped up in 2012.  Symantex explains the huge difference as McAfee reporting all the variants of a threat as opposed to just the new threats.

Still another mobile security software provider NQ Mobile reported more than 65,000 distinct forms of mobile malware such as app repackaging, malicious URLs, and SMS phishing.

Security companies of course have a vested interest in hyping malware threats, since they are in the business of selling security, so it's worth taking the highest figures with a big pinch of salt.

By: Nima Zahadat