Every Android release includes dozens of security enhancements to protect users. Here are some of the major security enhancements available in Android 7.0:

• File-based encryption. Encrypting at the file level, instead of encrypting the entire storage area as a single unit, better isolates and protects individual users and profiles (such as personal and work) on a device.
• Direct Boot. Enabled by file-based encryption, Direct Boot allows certain apps such as alarm clock and accessibility features to run when device is powered on but not unlocked.
• Verified Boot. Verified Boot is now strictly enforced to prevent compromised devices from booting; it supports error correction to improve reliability against non-malicious data corruption.
• SELinux. Updated SELinux configuration and increased seccomp coverage further locks down the application sandbox and reduces attack surface.
• Library load-order randomization and improved ASLR. Increased randomness makes some code-reuse attacks less reliable.
• Kernel hardening. Added additional memory protection for newer kernels by marking portions of kernel memory as read-only, restricting kernel access to userspace addresses and further reducing the existing attack surface.
• APK signature scheme v2. Introduced a whole-file signature scheme that improves verification speed and strengthens integrity guarantees.
• Trusted CA store. To make it easier for apps to control access to their secure network traffic, user-installed certificate authorities and those installed through Device Admin APIs are no longer trusted by default for apps targeting API Level 24+. Additionally, all new Android devices must ship with the same trusted CA store.
• Network Security Config. Configure network security and TLS through a declarative configuration file.