back to article For pity's sake, enterprises, upgrade your mobile OS - report

Nine out of 10 enterprise mobile devices are using out-of-date operating systems, according to a new study, with upgrade issues increasing users' exposure to breaches, Duo Security warns. The analysis of more than one million actual iOS and Android mobile devices users in enterprises revealed that running updates is still hit …

  1. msknight

    Part of the problem...

    ...is the history of updates. Users have had so many years now of stuff foisted on them that makes things worse, not better. No wonder no one wants to update anything.

    The 1 in 20 with no screen password, well, are there third party alternatives in place like face lock, or something; and people think that's enough and that a "pain" pin isn't needed? I view figures like these with scepticism as things are never straightforward in the tech world.

    But manufacturers have to put some of this blame on their own doorstep. If it ain't broke, don't fix it... and don't let the manufacturer have a chance to break it further with their bloatware, nagging applications, more notifications and stuff that, basically, makes people's lives worse.

    1. Dan 55 Silver badge

      Re: Part of the problem...

      Changes to the UI just because it's cooler.

      For instance I just don't see Lollipop's floating random-coloured special round button put randomly somewhere on the screen. They're not part of a menu, a toolbar, or a list. They don't match the rest of the UI. At the beginning after updating to Lollipop I was be staring at a screen for a minute before I realised that the special button thing is the thing I have to press.

      Perhaps it's just me. Obviously I've got used to contacts and messages but any new app always gets me in the same way, although now I can get the staring at the screen bit down to 15 seconds if I'm lucky.

      So I'm not surprised that others don't update.

      That's my little rant over.

      1. getHandle

        Re: UI design

        Agreed! Skeuomorphic design might be terribly old-fashioned in this age of material design, but at least it was obvious where you were supposed to damn-well tap!

        1. TeeCee Gold badge
          Paris Hilton

          Re: UI design

          The big problem with skeuomorphism is that it constrains designers to variations on a theme.

          These days they can get all the way up their own arses and dream up new paradigms to diversificate user experiences in a post-modernistic world to their hearts' content.

          This way they can win awards. Design awards tend toward the "Turner prize" type, so anything practical, sensible or easy to use is a total loser.

    2. Tom 13

      Re: Part of the problem...

      Don't forget the User is God and Tech don't know shit attitude from some of the vendors. With no way to push updates to the devices it's a nightmare to update them. And that's assuming there's a viable update available for the device.

  2. jzl

    BlackBerry?

    All the large enterprises I've worked at have a stable of mobile devices overwhelmingly consisting of ancient BlackBerry "Curve" handsets.

    1. Captain Scarlet

      Re: BlackBerry?

      I seem to remember we were still reliant on the operator to do over the air updates, I can't remember BES (pre 8.x) having the ability to push them ourselves.

    2. Anonymous Coward
      Anonymous Coward

      Re: BlackBerry?

      "All the large enterprises I've worked at have a stable of mobile devices overwhelmingly consisting of ancient BlackBerry "Curve" handsets."

      Those type of shops seem to be largely moving to Windows Phone / Lumia handsets these days - presumably as they care enough about security to be using Blackberry in the first place.

      Last figure I saw was that Microsoft have about 30% of the new SME device deployments in the UK.

  3. 2460 Something

    But there surely is a large percentage of users who's mobile phone manufacturer have not actually released the updates. Without rooting their handset they cannot then proceed to actually get it patched. Which would account for the larger percentage of Android users who are running older versions.

    1. Blitheringeejit
      WTF?

      @2460 Something

      You're right, of course - but who among us would dream of deploying a Windows box in our organisation without "rooting" it?

    2. Doctor Syntax Silver badge

      "a large percentage of users who's mobile phone manufacturer have not actually released the updates"

      The whole thing reads like a thinly disguised attempt to flog new phones on the basis that you'll never get an update on your old one.

      1. allthecoolshortnamesweretaken

        "The whole thing reads like a thinly disguised attempt to flog new phones on the basis that you'll never get an update on your old one.2

        Yesss! Buy new shiny things! It's the solution for everything!

    3. SteveK

      Not just the phone manufacturer, in many cases the manufacturer has released updates but the phone software has been tweaked by the mobile operator and only fetches updates from them - but once you're locked into a contract and that phone model has been superseded, there's no profit in them repackaging the manufacturer's updates and merging back in their own "value" added tat and branding, testing and developing fixes if it doesn't work.

      Personally I think phone operators should be required to provide unmodified phones that will go and install the manufacturer updates, and not inject their own applications which probably are not highly security tested. Or required to provide timely updates (within 1 week of the upstream release, say) to their customers for at least the length of the contract, preferably 3 years, even if a newer shinier model comes out. You don't give the customer a new phone 6 months into their 24 month contract so support the one you gave them at the start.

      1. Dan 55 Silver badge

        Operator apps should just be normal Play Store apps and if they become incompatible with newer Android versions then they just don't get installed.

    4. Paul Crawford Silver badge

      It is high time that the cost of vulnerabilities was put on the manufacturer of the phone (or carrier, if bloatware). Basically, for say 5 years after purchase it has to be supported, and if not patched in a timely manner (say 30 days from notification) they are liable for the costs.

      Yes, it would put up the costs of phones slightly, but then we would have a damn sight less trouble over all from them and lower cost than the current "you need a new phone gov" option.

      1. Gnosis_Carmot

        "It is high time that the cost of vulnerabilities was put on the manufacturer of the phone (or carrier, if bloatware)"

        Since it is the carrier deciding whether or not to update the handset it would have to be joint responsibility for everything except the carrier bloatware, meaning Samsung puts out the update and Verizon would be required to distribute it even if it buggers their (Verizon) bloatware.

      2. Tom 13

        Re: they are liable for the costs.

        Even that wouldn't do it. If it isn't patched in a timely manner, they have to provide free cell service (including data charges) from the time expiration of the 30 days until they get it patched.

    5. Tom 13

      Re: a large percentage of users

      Not iOS. Since Apple have total control, so long as the hardware supports it, it's ready to roll when they release it. I don't care for much about Apple, but that part they do reasonably well. Apple's primary issue is the one I referenced above: no central management mechanism for their phones.

  4. Anonymous Coward
    Anonymous Coward

    That the price you pay!

    Consumer grade phones demanded by users because they're 'kewl' but with no support and maintainance in the enterprise. Who knew?

    1. Anonymous Coward
      Anonymous Coward

      Re: That the price you pay!

      Care to suggest one that's better?

      Apple? Nope, they knobble handsets more than a few generations old.

      Android based? Well I'm still waiting for my update to Android 5, and I did ask the manufacturer nicely.

      Windows based? How's Windows RT doing these days?

      Blackberry? The Playbook really did sell well didn't it?

      Windows Mobile/CE? Say what now?!

      Java2 Micro Edition? Don't swear at me!

  5. Anonymous Coward
    Meh

    Looks at Windows phone,

    All unwanted Operator apps removed easily...check.

    Latest update applied....check

    Option to install preview builds direct from MS...check

    Looks at Samsung Android....massively out of date...check

    Stuck with operator bloat....check

    Stuck with this OS unless root phone and hope 3rd party one works...check.

  6. Anonymous Coward
    Anonymous Coward

    Apple

    With an old apple device you can't update because they've removed support for it in their update.*

    The fix? Buy a new one.

    F***ers

    [* generalisation but still true. I know people who have been bitten.]

    1. TeeCee Gold badge
      Facepalm

      Re: Apple

      While I really hate to back Apple up here, I'll bet a stack of cash a foot thick that it got updates for at least twice as long as an Android device bought at the same time did....

    2. Anonymous Coward
      Anonymous Coward

      Re: Apple

      How old of an Apple device are you talking about? Apple delivered the last update for the 3gs (introduced in summer 2009) in spring of 2014 - that's nearly five years. The current release iOS 9.x is supported back to the 4S which was introduced in fall 2011, so that is 4 1/2 years and counting. How long are they supposed to support it in your mind? Apple is doing better than any of the competition in providing updates for phones/tablets.

      PCs can't be updated forever either - Linux distributions are slowly phasing out support for 32 bit hardware, Microsoft will do the same with Windows before long. The lifetime of a PC may be longer than a phone but still isn't infinite.

  7. Sleep deprived
    Headmaster

    One in 20 of Android devices have no password on their lock screen

    I use an unlock pattern on my Nexus 4, but with the dots always appearing at the same screen location, the smear on the glass shouldn't be too hard to follow. Should I patent randomly-located pattern dots?

  8. joed

    DuoSecurity should concentrate on providing their services instead of gathering data on their users. MS syndrome?

  9. nuxnix

    The latest released version of Android was 6.0.1 in December 2015 not 5.1 as stated in the article which of course highlights the delay in getting this software out beyond Google Branded devices. My test devices, a Nexus 7 2013 and Nexus 9 updated over the air but all my other Android devices languish on whatever the manufacturer deems the last supported version even though Cyanogen can often offer later releases which seem to work just fine.

    What is incomprehensible to me is Blackberry releasing their first Android device on Android 5.1.1 AFTER Android 6.0 was available. Such a major market shift needed to be totally current to have any kind of chance. I just could not imagine Apple releasing a new iOS and then afterwards saying 'here's a new phone with the older iOS'. This release timing probably doesnt seem to matter to people buying in shops. But it affects the device lifetime which is lessened because of it and contributes to Android Landfill.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like