+SYS.3.2.4 Android
---+SYS.3.2.4.G1. Disabling Security Features
---+SYS.3.2.4.G2. Malware for the Android Operating System
---+SYS.3.2.4.G3. Lack of Updates for the Android Operating System
---+SYS.3.2.4.G4. Risks Posed by User Accounts (Google Accounts) for Google Services
---+SYS.3.2.4.G5. Pre-Installed apps and Integrated Functions on Android-Based Devices
---+SYS.3.2.4.A2 Disabling Developer Options (S)
---+SYS.3.2.4.A3 Using Multi-User and Guest Mode (S)
---+SYS.3.2.4.A5 Advanced Security Settings (S)

SYS.3.2.4 Android

Introduction

Google's Android operating system is commonly used on smartphones and tablets. Since version 4, Android has been gradually implementing protections for business use. For example, functions that enable organisations to administrate Android devices have been integrated. The number of administration policies supported by Android also increases with every new version, and there are manufacturer-specific expansions that enable additional policies.

Objective

The objective of this module is to provide information on typical threats related to Android and to show how Android-based devices can be used securely in organisations. Moreover, security policies can be created on the basis of the requirements stated in the module.

Scoping and Modelling

Module SYS.3.2.4 Android must be applied to all smartphones and tablets running the Google Android operating system that are used for business purposes.

This module includes basic specifications which must be observed and fulfilled when operating Android-based devices. General and comprehensive requirements for the operation of smartphones and tablets are not part of this module; they are covered in module SYS.3.2.1 General Smartphones and Tablets and must also be implemented for the use of Android-based devices. The requirements for the central administration of Android devices using an MDM system are also not part of this module. They are covered in module SYS.3.2.2 Mobile Device Management (MDM).

Useful Resources

No further information is available for module SYS.3.2.4 Android.

1. Vue d’ensemble

SYS.3.2.4.A2 Disabling Developer Options (S)

The developer options SHOULD be disabled on all Android-based devices.
SYS.3.2.4.A3 Using Multi-User and Guest Mode (S)

Whether a device may be shared with other persons SHOULD be regulated. Whether multi-user or guest mode must be used for this purpose SHOULD be specified. Users on Android-based devices SHOULD be natural persons.
SYS.3.2.4.A5 Advanced Security Settings (S)

Only the approved security apps SHOULD be entered as device administrators or “Trust Agents”. This SHOULD be checked regularly.

Furthermore, only authorised apps SHOULD be able to access usage data and notifications.

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

Exigences

3. Réglementations associées

Réglementations

Tickets liés

Liens
includes SYS.3.2.4.G1. Disabling Security Features
includes SYS.3.2.4.G2. Malware for the Android Operating System
includes SYS.3.2.4.G3. Lack of Updates for the Android Operating System
includes SYS.3.2.4.G4. Risks Posed by User Accounts (Google Accounts) for Google Services
includes SYS.3.2.4.G5. Pre-Installed apps and Integrated Functions on Android-Based Devices