Endpoint Protection · Topic 7 of 9
Mobile Platform Guidelines for Android and iOS
Apply mobile security guidelines with the Android and iOS security models, app permissions, Play Protect, Find My, updates and the risks of rooting.
- 4 min
- Screen lock, encryption, updates, official stores and remote wipe apply to both platforms.
- Android: sandbox, Play Protect, work profile, unknown sources off.
- iOS: App Store review, Secure Enclave, Data Protection, Activation Lock, Lockdown Mode.
What it is
Android and iOS have built in protections, and the defender's work is to switch them on, keep them current and manage them centrally. This page covers general mobile guidelines and then the specific features and tools of each platform.
How it works
General guidelines for any mobile platform
- Set a strong screen lock (long PIN or password, or biometrics with a PIN fallback) with auto lock.
- Keep the OS and apps updated, and replace devices that no longer get updates.
- Install apps only from the official store, and review the permissions an app asks for.
- Use device encryption (enabled by default on modern devices once a lock is set).
- Use a VPN on untrusted networks, avoid public Wi-Fi for sensitive work and turn off Bluetooth and Wi-Fi when not needed.
- Do not jailbreak or root the device.
- Beware of phishing links and unexpected messages, and never scan unknown QR codes carelessly.
- Enable remote find, lock and erase.
- Back up data and use multifactor authentication for accounts.
- Install a mobile threat defense app on managed devices where the policy demands it.
Android security guidelines and tools
Android is based on Linux. Each app runs in its own application sandbox under a unique user ID, and access to the camera, location and contacts requires permissions that the user grants.
| Feature or tool | Purpose |
|---|---|
| Google Play Protect | Scans apps from Google Play and other sources for harmful behavior |
| Verified Boot | Checks the integrity of boot software |
| File based encryption | Encrypts user data on the device |
| Find Hub (formerly Find My Device) | Locate, lock and erase a lost phone |
| Security patch level | Monthly security updates. Check Settings for the patch date. |
| Android Enterprise work profile | Separates work apps and data from personal ones |
| Permission manager | Review and revoke permissions, with one time and while in use options |
Guidelines: turn off install from unknown sources, because sideloading is a common route for malware. Disable developer options and USB debugging when not in use, use a screen lock, review app permissions, and update both Android and Play services. Rooting removes the sandbox protections and should be blocked on managed devices.
iOS security guidelines and tools
iOS is a closed ecosystem. Apps come from the App Store after review, run in a sandbox and must be code signed.
| Feature or tool | Purpose |
|---|---|
| Secure Enclave | Separate hardware processor that protects keys and biometric data |
| Face ID and Touch ID | Biometric unlock backed by a passcode |
| Data Protection | File encryption tied to the passcode |
| Find My and Activation Lock | Locate, lock or erase the device, and block reuse by a thief |
| Lockdown Mode | Optional extreme protection for users at high risk of targeted attack |
| Supervised mode and MDM | Gives organizations stronger management of company owned devices |
| Managed Apple Account, managed apps | Separate work data on managed devices |
| iOS updates | Delivered directly by Apple to supported devices |
Guidelines: set a six digit or longer passcode (alphanumeric is stronger), turn on automatic updates and Find My, use the built in permission prompts for location, camera and microphone, and avoid jailbreaking. Enterprises enroll devices in an MDM, and use supervision for corporate devices.
A key difference: iOS updates reach all supported devices quickly because Apple controls both hardware and software. On Android, patch delivery depends on the device maker and carrier, so enterprises often prefer devices with long update commitments.
A worked example
A company lets staff use Android and iPhone devices. The MDM requires a six digit passcode, encryption and the latest OS minor version. On Android a work profile holds corporate apps, and sideloading is blocked. On supervised iPhones, only managed apps may open work documents. A jailbroken or rooted device is reported noncompliant and loses access to email.
How the exam asks about this
- "Which Android setting should be turned off to reduce malware risk from sideloaded apps?" → Install from unknown sources.
- "Which iOS feature prevents a thief from reactivating a lost iPhone?" → Activation Lock (part of Find My).
- "Which Google service scans installed apps for harmful behavior?" → Google Play Protect.
What to remember for the exam
- Screen lock, encryption, updates, official stores and remote wipe apply to both platforms.
- Android: sandbox, Play Protect, work profile, unknown sources off.
- iOS: App Store review, Secure Enclave, Data Protection, Activation Lock, Lockdown Mode.
- Rooting and jailbreaking break the security model.
- MDM or UEM enforces policy at scale.
Biometrics are convenient but not secret. Always pair them with a strong passcode, since the passcode is the fallback.
Common mistakes
Believing iOS cannot be attacked. It is more closed, but phishing, malicious profiles and unpatched flaws still occur.
Believing every Android app from Play is safe. Play Protect reduces risk, yet permissions should still be reviewed.
Leaving old devices in service. Phones without security updates are permanent vulnerabilities.
Check yourself
Why is sideloading risky on Android?
Apps from outside the official store bypass store checks and are a common route for malware.
What does the Secure Enclave protect?
Encryption keys and biometric data, in a separate hardware processor.
What does a work profile do?
It separates corporate apps and data from personal ones so IT can manage or wipe only the work side.
Topic 7 of 9 in Endpoint Protection
Test yourself on Endpoint Protection
The full EC-Council 312-38 question bank has 800 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.