Security in the Android ecosystem is awful

There's just no other word to describe it. In large part, the blame for that can be placed at the feet of Google.  Although they have succeeded in creating a wildly successful platform, their management of OEM devices (in particular, security updates for them) have been virtually nonexistent.

This has led to a situation where many device manufacturers don't bother to push critical updates at all.  It costs money to do so, and until now, there hasn't been a downside for failing to.  That, however, is about to change.

Manufacturer updates to become frequent

Recently, Google announced some big changes coming to their OEM agreements that would require Android device manufacturers to roll out security updates on a regular basis.

The company offered few details when the announcement was made, but since that time, an unverified copy of the new contract was leaked and obtained by The Verge.  It sheds some additional light on what's coming.

Specifically, the new agreement requires OEMs to regularly schedule updates for any device launched after January 31, 2018, if that device has been activated by more than 100,000 users.  OEMs will be required to provide security updates for a minimum of two years.

In addition to that, they must make updates that address security vulnerabilities available to their customers no more than 90 days after the patch is released.  Taken together these two pieces of information point to the fact that OEMs will be required to issue quarterly updates to their customers, at a minimum.

Our perspective

It's a good move and one that's long overdue.  When this new agreement becomes official corporate policy, it will have an almost immediate, profound impact on security in the Android ecosystem.  While it's far from a perfect solution, it represents a very good beginning.


The author

Thanks for reading this short post. For more tips on thriving with small business technology, check out the other blog posts at DWPia Blogs. I am also available at dwpia on LinkedIn, at dwpia on Facebook, and @dwpia on Twitter.

Cybersecurity Expert, Small Business Technology Consultant, Managed Services Provider, Managed IT Support

Denis S Wilson

I am President and Principal Consultant for DWP Information Architects: specializing in managed IT support for smaller healthcare practices, clinics, insurance companies, law firms, and construction companies in Ventura County and San Fernando Valley. And have created cost-effective IT solutions, for over 20 years, specializing in cybersecurity and regulatory compliance.

I am also a published author and speaker, working extensively with organizations that include: the State of California, the Federal Bureau of Investigation (FBI), the Small Business Administration (SBA), SCORE, Women's Business Centers, and Small Business Development Centers. As well as providing small business technology education programs through business and professional associations.

Contact me if you would like me to speak at your meeting.

Meanwhile, check out this report

Executive Report: 10 Hidden IT Risks That Might Threaten Your Business