Motorola's Security Expertise Could Help Google's AndroidMotorola's Security Expertise Could Help Google's Android

Lookout Mobile Security Protects Android Smartphones

In case you missed this week's bombshell, Google wants to buy Motorola Mobility for $12.5 billion. While Google's master plan for its Motorola acquisition remains a closely guarded secret, the company has been portraying it as a patent-related business opportunity.

Interestingly, however, Motorola's smartphones have great rapport with businesses. "Of all the major OEMs, Motorola has been one of the most focused on bringing Android into the workplace," said David Richardson, lead Android engineer at smartphone security firm Lookout, in a blog post. In other words, Google's Motorola acquisition may also be a strategy for landing more business customers.

But to succeed, Android will arguably have to address some current security shortcomings. Here, then, is how Google might use the Motorola deal to boost Android's security:

Master Monoculture

Unlike Apple's walled garden approach to iOS and its vetting of AppStore offerings, "anything can go" on an Android phone--and does. "To date, iOS has more security features available and is generally considered more secure than Android by corporate IT and security folks," said Andrew Hoog, chief investigative officer for digital forensics and security company viaForensics, via email. Accordingly, Google could turn to Motorola to find new "synergies between hardware and software," he said.

But there's a caveat: While iOS may have the better security reputation, iOS 3 and iOS 4 encryption, as well as the keychain security database, have been cracked. "So, while Apple security is more polished and mature than Android security, it still does not provide sufficient protection," said Hoog.

Address Data Security

When it comes to security, said Hoog, Google should start with data security and device management. "For example, we've tested the enforcement of policy set by the centralized administrator and on many Android devices, the results are simply inconsistent. Encryption is another must-have for businesses to feel more comfortable about their sensitive data store on the device," he said.

"Google has the foundation to support these features effectively but there is considerable work which needs to be done. Most companies are not looking for military-grade security," he said. "They will accept a reasonable implementation of security and device management. Once Android addresses these shortcomings, I believe companies will be more open to Android as a business platform."

Manage Devices

The Motorola deal would give Google immediate access to better mobile device management capabilities. "Motorola recently purchased 3LM, a security company focused on making Android enterprise-friendly by providing mobile device management, encryption and other features important to mobile security," said Hoog. Expect Google to incorporate some of this software into Android.

Harden Handsets

"Thinking a bit out of the box," said Hoog, a Google-Motorola combination could take a trusted computing approach, along the lines of a "hardened hardware component [that works] in conjunction with software to increase the security of the system." Notably, the Pentagon "essentially requires all computers to have a [Trusted Computing] module, which is certainly a vote of confidence."

Similarly, Google could create handsets that curtail what an Android smartphone can do. "Enterprises have special needs, such as the ability to control what applications should be available on a device--whitelist or blacklist--and to distribute internal apps to devices and to purchase bulk app licenses," said Lookout's Richardson, via email. Then again, with not just 3LM, but also Droid Pro, Good Corporate Synch, and MotoBlur, he said, Google would already own many of the tools it needs.

Guessing Over Google

With the above possibilities in mind, will Google use the Motorola acquisition to enhance Android security? "Google is a large, sophisticated organizations and they have new, aggressive leadership at the helm," said Hoog at viaForensics. "I'm fairly confident Google has several strategies already in the works to maximize the value of the Motorola acquisition and carefully balanced to not conflict directly with the other manufacturers." At a full-day virtual event, information and Dark Reading editors will talk with security experts about the causes and mistakes that lead to security breaches, both from the technology perspective and from the people perspective. It happens Aug. 25. Register now.