Encryption

Encryption is the process of converting data into a coded format that can only be read by authorized parties with the proper decryption key. Managed devices typically enforce full-disk encryption to protect sensitive corporate data in the event of device loss, theft, or decommissioning.

Encryption Methods

Android supports several encryption methods including full-disk encryption (encrypts all data on the device), file-based encryption (encrypts individual files), and application-level encryption (encryption within specific apps). Modern Android devices typically use file-based encryption for improved performance.

Device-Level Encryption

Full-disk encryption protects all data stored on the device by automatically encrypting data when written and decrypting it when accessed by authorized users. If a device is stolen or lost, encryption prevents unauthorized access to corporate data.

App-Level Encryption

Beyond device encryption, applications can implement additional encryption for particularly sensitive data. For example, email apps encrypt sensitive credentials, and file management apps encrypt document contents.

Encryption Policies

MDM policies typically require devices to have encryption enabled. Administrators can configure encryption requirements as part of compliance policies, ensuring all devices meet encryption standards. Non-compliant devices can be restricted until encryption is enabled.

Performance Considerations

Modern encryption has minimal performance impact on devices. However, organizations should ensure devices have sufficient processing power for encryption-related operations. Hardware acceleration is available on most modern Android devices.

Encryption Keys

Android stores encryption keys securely using hardware security features when available. The organization does not directly manage encryption keys on employee devices; Android and the device manufacturer handle key management. For BYOD, this means the organization never has access to personal data, even if the device is lost.

Compliance and Regulations

Many regulations (HIPAA, GDPR, PCI-DSS) require encryption of sensitive data. MDM platforms can enforce encryption as part of compliance policies to meet regulatory requirements.