Android dominates smartphone usage throughout the world — in every region except North America and Oceania. Thus, businesses in many regions are likely to support and issue Android devices to employees as their mainstay mobile devices. Even in areas where Apple’s iPhone dominates or is comparable in market share, businesses are likely to support or issue Android devices at least as a secondary option.
Google has a certification called Android Enterprise Recommended that focuses on enterprise concerns around performance, device management, bulk device enrollment, and security update commitments. Google publishes a tool to help IT see which devices meet that certification in various regions, as well as explore supported Android versions and end dates for security updates.
But as Computerworld columnist JR Raphael has shown, the Google enterprise compliance checker is not kept up to date, so it cannot be relied on by itself. It’s also not clear that Google is enforcing compliance after products get certified. Bottom line: Android Enterprise Recommended is a starting point for narrowing your options, not a definitive filter.
Apple tightly controls the iPhone and its iOS operating system, which gives IT strong assurance about software updates, security patches, device capabilities, and manageability. By contrast, the Android world is highly diverse, with dozens of manufacturers using Google’s Android platform but offering varying levels of quality and support, and in many cases few or inconsistent OS and security updates. The use of Android thus requires more effort by IT in selecting and supporting mobile devices.
For that reason, iPhones are more likely to be the official business platforms (what are called corporate-liable devices) for devices that enterprises buy for their employees, even in regions where Android dominates. But it is typical for companies to let employees use their personal devices for work (what are called employee-liable devices or bring-your-own devices [BYOD]), providing access at least to work email and calendars, and often to web-based services.
So how does IT choose which Android devices to buy and/or support for its users? This article gets you started.
Recommendations for best Android devices in business
For knowledge workers and general-purpose busines usage, there’s just one Android manufacturer with global device availability and enterprise-class (even military-grade) security, plus multiyear software and security updates after purchase: Samsung. That makes Samsung the best (and often only) choice for corporate-liable Android devices in every region. Its enterprise-grade models (what Samsung calls Android Secured by Knox) include the Galaxy S, Galaxy A5x, Galaxy A3x, Note, XCover, Z Flip3, and Z Fold3 series. For these models, security updates are promised for five years after initial release; Samsung publishes the security lifespans for its enterprise-grade devices, which vary by device.
But Samsung devices do have issues to be aware of, including the use of Samsung’s proprietary interface and its proprietary apps (though you can still use the standard Google apps), both of which can require extra IT support for those more familiar with Google-standard Android devices. Columnist Raphael also objects to some of Samsung’s practices around privacy and advertising. Still, no other Android manufacturer offers the combination of security and availability that Samsung does.
Google’s Pixel 6 series and new Pixel 7 series are similarly secure, but without the proprietary UI and apps. Google too promises five years of security updates after initial release. However, the Pixel 6 series is available in just a dozen countries: Australia, Canada, France, Germany, Ireland, Italy, Japan, Singapore, Spain, Taiwan, United Kingdom, and United States. The Pixel 7 series is available in the same countries plus Denmark, India, the Netherlands, Norway, and Sweden.
Motorola’s enterprise-class Android devices, such as the Edge 30 Fusion and Ultra models, are similarly secure. They’re available in 65 countries, including most of Europe, much of Latin America, Australia, New Zealand, India, China, Taiwan, Hong Kong, South Korea, Japan, Thailand, the Philippines, Malaysia, Saudi Arabia, the UAE, Canada, the US, and the UK. Where Motorola falls a bit short is in update support: It commits to just three years for security updates and to just one major Android OS version update.
In most countries, these recommended devices are often too pricey for rank-and-file employees and for their businesses to buy for users other than executives or those handling very sensitive information. Fortunately, there’s a set of Android vendors that offer a range of inexpensive and moderately priced phones that provide good quality and adequate security: Nokia, OnePlus, Oppo, Sony, and Xiaomi. Samsung also has several moderately priced phones with adequate security, and Motorola has its Moto G and Edge Neo models. As shown later in this article, these vendors’ prevalence varies significantly across and within regions.
Why these recommendations? And what other options does IT have or may get user pressure to support? The sections that follow explore the essential factors: security, updatability, device capabilities of concern to business use, and vendor availability in various regions of the globe. There’s also a section on special-purpose front-line Android devices.
Security considerations for Android devices
In the early days of Android, security was a major IT concern. Research in Motion’s BlackBerry had set high standards in the 1990s and early 2000s for mobile security, whereas the early Android (and iOS) devices fell far short of IT expectations. Apple and then Samsung moved to make mobile security at least as good as BlackBerry’s in the early 2010s, and Google followed suit a few years later by making encryption standard in Android and then making container-based separation of work and personal data and apps a standard part of 2015’s Android 5.0 Lollipop OS. By 2017, the Android platform had strong security capabilities. More sophisticated capabilities became available through both hardware and software extensions, such as Samsung’s Knox platform in 2013 for its enterprise devices and Google’s Android for Work (later renamed Android Enterprise) for the rest of the Android world. Android Enterprise support became a standard feature in 2018’s Android 9.0 Pie.
Today, IT can count on all Android devices having the basic level of security needed. But some users — such as high-level executives who deal in sensitive corporate data, or operations staff managing critical infrastructure or supply chains — need more security. And that affects your enterprise Android device options.
There are three security levels to consider, and many organizations will need more than one in place:
Basic security: This level is appropriate on personal devices permitted to access basic corporate systems like email.
The basic security level provides device encryption, password enforcement, remote lock and wipe, and sandboxed execution of security functions.
All current Android devices support this level, with even just a basic management tool like Google Workspace or Microsoft 365 in place.
Moderate security: This level is appropriate for when IT requires or allows personal devices to be used for corporate access and apps, as well as for corporate-issued devices allowed to also be used for personal purposes.
The moderate security level provides the basic level plus separation of work data and apps from personal data and apps via containers, via a unified endpoint management (UEM) platform that supports Google’s Android Enterprise platform or, only for Samsung devices, Samsung Knox. Tip: Compare the leading UEM platforms’ capabilities in Computerworld’s guide.
All current Android devices with at least 3MB of RAM support work/personal separation, but some UEM platforms may require that the devices run newer versions of Android than are deployed at your organization.
Advanced security: This level is appropriate for executives, human resources professionals, finance professionals, and anyone dealing with critical data and systems access such as in government, defense/military, finance, healthcare, and critical infrastructure like utilities, energy, and transport.
The advanced security level provides the moderate level plus chip-based security enabled to reduce unauthorized access by spies and hackers, as well as compliance with the US’s recent Common Criteria security standard.
Chip-level security detects hacks to the operating system, firmware, memory, and other core systems, and locks down or shuts down the device as a result, via Android’s Keystore service. Such hardware-level security is not an Android Enterprise Recommended requirement, but it is essential for military-grade security.
Only a few devices use chip-level security to protect system integrity: Samsung’s Android Secured by Knox phones use Arm’s TrustZone chip for its Trusted Boot, Google’s Pixel series uses its own Titan-M chip for its Trusted Execution Environment (TEE), and Motorola says all its Android devices use Arm’s TrustZone chip for its Strongbox. (Apple’s iPhones have this capability too via the Secure Enclave.) The other Android vendors did not respond to my inquiries about their security capabilities but appear not to support hardware-based security, based on their websites’ specification data.
Common Criteria imposes specific security approaches that the US government thus knows it can rely on across devices. Although also not an Android Enterprise Recommended requirement, Common Criteria is a good advanced-security standard for IT to use anywhere in the world.
Android models from multiple vendors comply with Common Criteria: a few from Google, Huawei, Motorola, Oppo, Samsung, and Sony, as well as some front-line specialty devices from Honeywell and Zebra Technologies. (Filter by “Mobility” in the Common Criteria web tool to get the current list.) Apple’s iPhone also complies.
Government security certification for Android
IT organizations may want to look to government certifications to determine their Android device selections for sensitive uses. When Apple and Samsung both gained US Defense Department, UK Government Communications Headquarters (GCHQ), and Australian Signals Directorate approval for use of their enterprise-class devices in the mid-2010s, it was huge news — breaking BlackBerry’s longstanding monopoly on government approval.
Today, such announcements are rare, and governments instead focus on ensuring that approved UEM platforms are in place to manage the widely used iPhones and Android phones. But recently the US Department of Defense has approved several Samsung phones and some front-line Android devices from Honeywell and Zebra Technologies for sensitive uses, as it moves to using the Common Criteria standard. And the Australia Signals Directorate has approved several Samsung phones recently as well.
The troubling security questions around Huawei’s Android devices
IT will not find Huawei devices in Google’s Android Enterprise Recommended database. Google removed them in 2019 after public allegations from the US government that Huawei devices were spying on users via backdoors on behalf of the Chinese government. These concerns are not new: In 2012, I was having drinks with several US intelligence officials and defense contractors at an off-the-record conference of CIOs where they raised the same fears about Huawei, ZTE, and other Chinese computer and telecom manufacturers. Back then (under the Obama administration), US intelligence officials were quietly warning corporate CIOs about Huawei’s massive spying operations across its whole technology stack.
Those fears about Huawei’s alleged being a conduit for spying are no longer quiet, with both the Trump and Biden administrations since speaking publicly. Multiple other governments have also made the same accusations, which Huawei denies.
Because Huawei devices are popular in several markets — China, of course, but also in many parts of Africa, Europe, the Middle East, and South America — concerned IT departments may want to use management tools to deny Huawei and other distrusted devices access to their resources. Be sure to check whether your management tool can block access based on device vendor. According to their websites, UEM platforms that can block devices by vendor include BlackBerry UEM, Microsoft Intune, and VMware Workspace One.
Security and OS update assurances for Android devices
IT typically wants assurances that devices will get security updates and OS updates for several years, to reduce the risk of being hacked via old devices that haven’t kept up their defenses. Google’s Android Enterprise Recommended certification requires only one future OS upgrade. For security updates, it has no minimum, requiring only that vendors publish their update commitments on their websites — and that information can be hard to find.
In my survey of Android vendor sites, three to five years is typical for Android security update commitments on business-class devices, and one to three future Android OS versions is typical for OS updates. (By contrast, Apple typically provides seven years of security updates and five years of iOS updates.) The stingiest Android vendors in terms of OS updates are Motorola, Oppo, and Xiaomi, which commit to just one major Android upgrade for their enterprise-class models. Google and Samsung have the best update commitments.
Vendors’ published update commitments for business-class Android devices include:
- Google: five years of security updates, three years of OS upgrades
- Motorola: three years of security updates, one year of OS upgrades
- Nokia: three years of security updates, two years of OS upgrades
- OnePlus: four years of security updates, three major OS upgrades
- Oppo: three years of security updates, one year of OS upgrades
- Realme: three years of security updates, two major OS upgrades
- Samsung: “at least” four years of security updates, three “generations” of OS upgrades
- Vivo: three years of security updates, three years of OS upgrades
- Xiaomi: three years of security updates, one major OS upgrade
I could not find update information at the Huawei, Infinix, Itel, and Tecno sites, and the companies did not respond to my requests for information.
For certified devices, you can also use Google’s Android Enterprise Recommended tool to narrow down by what date various vendors’ specific models’ security updates will end. Just keep in mind that the tool may not have recent models. I also recommend you verify whether vendors do what they promise by getting some older devices and seeing how recent the available security updates are: Have they kept up the promised duration?
Finally, keep in mind that cellular carriers can override, slow, or block updates in many countries, overriding whatever promises the device vendor has made. For example, Google notes on its Pixel page that Pixel phones bought directly from Google often get updates sooner than those bought through a carrier. That carrier control is a longstanding reality, well pre-dating modern mobile devices, with only Apple able to have fully wrested control over updates from the carriers.
Source by www.computerworld.com
