Apple iOS 8 Interim Security Configuration Guide

U_Apple_iOS_8_V1R1_Manual-xccdf.xml

This ISCG contains technical security controls required for the use of Apple iOS 8 devices (iPhone and iPad) in the DoD environment. Comments or proposed revisions to this document should be sent via email to the following address: [email protected]
Details

Version / Release: V1R1

Published: 2014-09-16

Updated At: 2018-09-23 02:02:05

Actions

Download

Filter

Vuln Rule Version CCI Severity Title Description
SV-68483r1_rule AIOS-01-080004 CCI-000205 MEDIUM Apple iOS must enforce a minimum password length of 6 or more characters. Password strength is a measure of the effectiveness of a password in resisting guessing and brute-force attacks. The ability to crack a password is a function of how many attempts an adversary is permitted, how quickly an adversary can do each attempt, and the size of the password space. The longer the minimum length of the password is, the larger the password space. Having a too-short minimum password length significantly reduces password strength, increasing the chance of password compromise and resulting device and data compromise. SFR ID: FMT_SMF.1.1 #01
SV-68485r1_rule AIOS-01-080005 CCI-000043 LOW Apple iOS must prohibit more than 10 consecutive failed authentication attempts. Users must not be able to override the system policy on the maximum number of consecutive failed authentication attempts because this could allow them to raise the maximum, thus giving adversaries more chances to guess/brute-force passwords, which increases the risk of the mobile device being compromised. Therefore, only administrators should have the authority to set consecutive failed authentication attempt policies. SFR ID: FMT_SMF.1.1 #02
SV-68487r1_rule AIOS-01-080006 CCI-000366 HIGH Apple iOS must require a valid password be successfully entered before the mobile device data is unencrypted. Encryption is only effective if the decryption procedure is protected. If an adversary can easily access the private key (either directly or through a software application), sensitive DoD data is likely to be disclosed. Password protection is one method to reduce the likelihood of such an occurrence. SFR ID: FMT_SMF.1.1 #42
SV-68489r1_rule AIOS-01-080007 CCI-000366 MEDIUM Apple iOS must not allow the device unlock password to contain more than two sequential or repeating characters (e.g., 456, aaa). Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute-force attack. Passwords with sequential or repeating numbers or alphabetic characters (e.g., 456, 987, 222, abc, ddd) are considered easier to crack than random patterns. Therefore, disallowing sequential or repeating numbers or alphabetic characters makes it more difficult for an adversary to discover the password. SFR ID: FMT_SMF.1.1 #42
SV-68491r1_rule AIOS-02-080001 CCI-000366 MEDIUM Apple iOS must not allow screen capture. By allowing the screen capture function, a user has the ability to capture a screen containing sensitive information and then transfer it to an application not authorized to store or process that type of information. For example, the unauthorized app may automatically perform cloud backup to non-DoD servers. If a screen capture containing sensitive information were copied to a location with inadequate protection, there would be a risk that an adversary could obtain it. Disabling the screen capture function will mitigate the risk of leaking sensitive information. SFR ID: FMT_SMF.1.1 #42
SV-68493r1_rule AIOS-02-080002 CCI-000366 MEDIUM Apple iOS must not allow use of iCloud backup. A cloud backup feature may gather a user's information, such as PII, or sensitive documents. With this feature enabled, sensitive information will be backed up to the manufacturer's servers and database. This data is stored at a location that has unauthorized employees accessing this data. This data is stored on a server that has a location unknown to the DoD. Disabling this feature mitigates the risk of a backup feature that stores sensitive data on a server that has the ability to be located in a country other than the United States. SFR ID: FMT_SMF.1.1 #42
SV-68495r1_rule AIOS-02-080003 CCI-000366 MEDIUM Apple iOS must not allow use of iCloud document and data synchronization. A cloud document syncing feature may gather user's information, such as PII, or sensitive documents. With this feature enabled, sensitive information will be backed up to the manufacturer's servers and database. This data is stored at a location that has unauthorized employees accessing this data. This data is stored on a server that has a location unknown to the DoD. Disabling this feature mitigates the risk of a backup feature that stores sensitive data on a server that has the ability to be located in a country other than the United States. SFR ID: FMT_SMF.1.1 #42
SV-68497r1_rule AIOS-02-080004 CCI-000366 MEDIUM Apple iOS must not allow use of the iCloud Keychain. The iCloud Keychain is an iOS function that will store users' account names and passwords in iCloud, then synchronize this data between the users' Macs, iPhones, and iPads. An adversary may use any of the stored iCloud keychain passwords after unlocking one of the synchronized devices. If a user is synchronizing devices, the user must protect all of the devices to prevent unauthorized use of the passcodes. Moreover, the keychain being transmitted through the cloud opens the possibility that a well-resourced, sophisticated adversary could compromise the cloud-transmitted keychain. Not allowing the iCloud Keychain feature mitigates the risk of the encrypted set of passwords being compromised when transmitted through the cloud or synchronized across multiple devices. SFR ID: FMT_SMF.1.1 #42
SV-68499r1_rule AIOS-02-080005 CCI-000366 MEDIUM Apple iOS must not allow use of My Photo Stream. When My Photo Stream is enabled, sensitive photos will be automatically uploaded to Apple-specified servers and available on other iOS devices associated with the same Apple ID, provided that the other device also has My Photo Stream enabled. This potentially places sensitive photos on a server outside of DoD's control and potentially makes them available to non-DoD devices. Disabling My Photo Stream mitigates this risk. SFR ID: FMT_SMF.1.1 #42
SV-68501r1_rule AIOS-02-080006 CCI-000366 MEDIUM Apple iOS must not allow use of iCloud Photo Sharing (also known as Shared Photo Streams). When iCloud Photo Sharing is enabled, sensitive photos will be automatically uploaded to Apple-specified servers and available on the IOS devices of other users who have accepted invitations to participate in iCloud Photo Sharing. This potentially places sensitive photos on a server outside of DoD's control and potentially makes them available to non-DoD users and devices. Disabling iCloud Photo Sharing mitigates this risk. SFR ID: FMT_SMF.1.1 #42
SV-68503r1_rule AIOS-02-080007 CCI-000366 LOW Apple iOS must not allow diagnostic data to be sent to an organization other than DoD. The sending of diagnostic data back to the manufacturer is prohibited in the DoD. Sending this data to an organization other than DoD is termed a “phone-home” vulnerability. This setting may enable the device manufacturer to gather sensitive location data or other information about the user’s practices. This data will be sent to the manufacturer's servers and database. This data is stored at a location that has unauthorized employees accessing this data. By disabling this feature, the phone-home risk will be mitigated. SFR ID: FMT_SMF.1.1 #42
SV-68505r1_rule AIOS-02-080008 CCI-000366 LOW Apple iOS must limit Ad Tracking. Ad Tracking refers to the advertisers’ ability to categorize the device and spam the user with ads that are most relevant to the user’s preferences. By not “Force limiting ad tracking”, advertising companies are able to gather information about the user and device’s browsing habits. If “Limit Ad Tracking” is not limited, a database of browsing habits of DoD devices can be gathered and stored under no supervision of the DoD. By limiting ad tracking, this setting does not completely mitigate the risk, but it limits the amount of information gathering. SFR ID: FMT_SMF.1.1 #42
SV-68507r1_rule AIOS-02-080009 CCI-000366 MEDIUM Apple iOS must not display notifications when the device is locked. If the mobile operating system were to display notifications or calendar information on the lock screen, an adversary may be able to gather sensitive data without needing to unlock the device. This adversary may use this gathered intelligence to plan future attacks and possibly a physical attack. By disabling notifications on the lock screen, this prevents sensitive data from being displayed openly on the device’s lock screen. SFR ID: FMT_SMF.1.1 #42
SV-68509r1_rule AIOS-02-080010 CCI-000366 MEDIUM Apple iOS must not display calendar information when the device is locked. If the mobile operating system were to display notifications or calendar information on the lock screen, an adversary may be able to gather sensitive data without needing to unlock the device. This adversary may use this gathered intelligence to plan future attacks and possibly a physical attack. By disabling notifications on the lock screen, this prevents sensitive data from being displayed openly on the device’s lock screen. SFR ID: FMT_SMF.1.1 #42
SV-68511r1_rule AIOS-02-080011 CCI-000366 MEDIUM Apple iOS must not allow use of Siri when the device is locked. On iOS devices, users can access the device's contact database or calendar to obtain phone numbers and other information using a human voice even when the mobile device is locked. Often this information is personally identifiable information (PII), which is considered sensitive. It could also be used by an adversary to profile the user or engage in social engineering to obtain further information from other unsuspecting users. Disabling access to the contact database and calendar in these situations mitigates the risk of this attack. The AO may waive this requirement with written notice if the operational environment requires this capability. SFR ID: FMT_SMF.1.1 #42
SV-68513r1_rule AIOS-02-080012 CCI-000366 MEDIUM Apple iOS must not allow voice dialing when the device is locked. On iOS devices, users can access the device's contact database or calendar to obtain phone numbers and other information using a human voice even when the mobile device is locked. Often this information is personally identifiable information (PII), which is considered sensitive. It could also be used by an adversary to profile the user or engage in social engineering to obtain further information from other unsuspecting users. Disabling access to the contact database and calendar in these situations mitigates the risk of this attack. SFR ID: FMT_SMF.1.1 #42
SV-68515r1_rule AIOS-02-080013 CCI-000366 HIGH Apple iOS must not allow the device to be unlocked using a fingerprint. Touch ID is a fingerprint reader that has been installed on some models of iOS devices. This fingerprint reader can be used to authenticate the user in order to unlock the mobile device. At this time, no biometric reader has been approved for DoD use on mobile devices. This technology would allow unauthorized users to have access to DoD-sensitive data if compromised. By not permitting the use of Touch ID, users are forced to use passcodes that meet DoD passcode requirements. SFR ID: FMT_SMF.1.1 #42
SV-68517r1_rule AIOS-02-080014 CCI-000366 MEDIUM Apple iOS must not allow non-DoD applications to access DoD data. Managed apps have been approved for the handling of DoD-sensitive information. Unmanaged apps are provided for productivity and morale purposes but are not approved to handle DoD-sensitive information. Examples of unmanaged apps include apps for news services, travel guides, maps, and social networking. If a document were to be viewed in a managed app and the user had the ability to open this same document in an unmanaged app, this could lead to the compromise of sensitive DoD data. In some cases, the unmanaged apps are connected to cloud backup or social networks that would permit dissemination of DoD-sensitive information to unauthorized individuals. Not allowing data to be opened within unmanaged apps mitigates the risk of compromising sensitive data. SFR ID: FMT_SMF.1.1 #42
SV-68519r1_rule AIOS-02-080015 CCI-000366 LOW Apple iOS must not allow DoD applications to access non-DoD data. Managed apps have been approved for the handling of DoD-sensitive information. Unmanaged apps are provided for productivity and morale purposes but are not approved to handle DoD-sensitive information. Examples of unmanaged apps include apps for news services, travel guides, maps, and social networking. If a document containing malware (e.g., macros performing malicious functions) were obtained from an untrusted source and then ported to a managed app, it might eventually reach other DoD computing systems vulnerable to the malware. Preventing managed apps from opening documents from unmanaged apps greatly mitigates this risk. SFR ID: FMT_SMF.1.1 #42
SV-68521r1_rule AIOS-02-080016 CCI-000366 LOW Apple iOS must not allow automatic completion of Safari browser passcodes. The AutoFill functionality in the Safari web browser allows the user to complete a form that contains sensitive information, such as PII, without previous knowledge of the information. By allowing the use of the AutoFill functionality, an adversary who learns a user's iOS device passcode, or who otherwise is able to unlock the device, may be able to further breach other systems by relying on the AutoFill feature to provide information unknown to the adversary. By disabling the AutoFill functionality, the risk of an adversary gaining further information about the device's user or comprising other systems is significantly mitigated. SFR ID: FMT_SMF.1.1 #42
SV-68523r1_rule AIOS-02-080017 CCI-000366 HIGH Apple iOS must encrypt iTunes backups. When syncing an iOS device to a computer running iTunes, iTunes will prompt the user to back up the iOS device. If the performed backup is not encrypted, this could lead to the unauthorized disclosure of DoD-sensitive information if non-DoD personnel are able to access that machine. By forcing the backup to be encrypted, this greatly mitigates the risk of compromising sensitive data. iTunes backup and USB connections to computers are not authorized, but this control provides defense-in-depth for cases in which a user violates policy either intentionally or inadvertently. SFR ID: FMT_SMF.1.1 #42
SV-68525r1_rule AIOS-02-080101 CCI-000366 MEDIUM Apple iOS must not allow backup of enterprise books. Enterprise books may contain DoD-sensitive information. When enterprise books are backed up, they are vulnerable to attacks on the backup systems and media. Disabling the backup capability mitigates this risk. If such books are lost, accidentally deleted, or corrupted for any reason, they can be easily retrieved from the original source. SFR ID: FMT_SMF.1.1 #42
SV-68527r1_rule AIOS-02-080102 CCI-000366 LOW Apple iOS must not allow use of Handoff. Handoff permits a user of an iOS device to transition user activities from one device to another. Handoff passes sufficient information between the devices to describe the activity, but app data synchronization associated with the activity is handled though iCloud, which should be disabled on a compliant iOS device. If a user associates both DoD and personal devices to the same Apple ID, the user may improperly reveal information about the nature of the user's activities on an unprotected device. Disabling Handoff mitigates this risk. SFR ID: FMT_SMF.1.1 #42
SV-68529r1_rule AIOS-02-080103 CCI-000366 MEDIUM Apple iOS must not allow managed applications to store data in iCloud. Storing data with a non-DoD cloud provider may leave the data vulnerable to breach. Disabling non-DoD cloud services mitigates this risk. SFR ID: FMT_SMF.1.1 #42
SV-68531r1_rule AIOS-02-080104 CCI-000366 LOW Apple iOS must require the user to enter a password when connecting to an AirPlay-enabled device for the first time. When a user is allowed to use AirPlay without a password, there is the potential that it may mistakenly associate the iOS device with an AirPlay-enabled device other than the one intended (i.e., by choosing the wrong one from the AirPlay list displayed). This creates the potential that someone in control of a mistakenly-associated device may obtain DoD-sensitive information without authorization. Requiring a password before such an association mitigates this risk. Passwords do not require any administration, nor must they comply with any complexity requirements. SFR ID: FMT_SMF.1.1 #42
SV-68533r1_rule AIOS-03-080101 CCI-000366 MEDIUM Apple iOS must use SSL for Exchange Active Sync. Exchange email messages are a form of data in transit and thus are vulnerable to eavesdropping and man-in-the-middle attacks. Secure Sockets Layer (SSL), also referred to as Transport Layer Security (TLS), provides encryption and authentication services that mitigate the risk of breach. SFR ID: FMT_SMF.1.1 #42
SV-68535r1_rule AIOS-03-080102 CCI-000366 MEDIUM Apple iOS must not allow messages in an Active Sync Exchange account to be forwarded or moved to other accounts in the iOS Mail app. The iOS Mail app can be configured to support multiple email accounts concurrently. These email accounts are likely to involve content of varying degrees of sensitivity (e.g., both personal and enterprise messages). To prevent the unauthorized and undetected forwarding or moving of messages from one account to another, Mail ActiveSync Exchange accounts can be configured to block such behavior. While users may still send a message from the Exchange account to another account, these transactions must involve an Exchange server, enabling audit records of the transaction, filtering of mail content, and subsequent forensic analysis. SFR ID: FMT_SMF.1.1 #42
SV-68537r1_rule AIOS-05-080001 CCI-000366 MEDIUM Apple iOS must have Airdrop disabled. An Airdrop feature is a way to send contact information or photos to other users with this same feature enabled. This feature enables a possible attack vector for adversaries to exploit. Once the attacker has gained access to the information broadcast by this feature, he/she may distribute this sensitive information very quickly and without DoD’s control or awareness. By disabling this feature, the risk of mass data exfiltration will be mitigated. SFR ID: FMT_SMF.1.1 #42
SV-68539r1_rule AIOS-05-080101 CCI-000366 MEDIUM Apple iOS must not have any Family Members in Family Sharing. Apple's Family Sharing service allows iOS users to create a Family Group whose members have several shared capabilities, including the ability to lock, wipe, play a sound on, or locate the iOS devices of other members. Each member of the group must be invited to the group and accept that invitation. A DoD user's iOS device may be inadvertently or maliciously wiped by another member of their Family Group. This poses a risk that the user could be without a mobile device for a period of time or lose sensitive information that has not been backed up to other storage media. Configuring iOS devices so that their associated Apple IDs are not members of Family Groups mitigates this risk. SFR ID: FMT_SMF.1.1 #42
SV-68541r1_rule AIOS-05-080102 CCI-000366 MEDIUM Apple iOS must not share location data through iCloud. Sharing of location data is an OPSEC risk because it potentially allows an adversary to determine a DoD user's location and movements and patterns in those movements over time. An adversary could use this information to target the user or to gather intelligence on the user's likely activities. Using commercial cloud services to store and handle location data could leave the data vulnerable to breach, particularly by sophisticated adversaries. Disabling the use of such services mitigates this risk. SFR ID: FMT_SMF.1.1 #42
SV-68543r1_rule AIOS-06-080001 CCI-000048 LOW The Apple iOS app used to support the DoD notice and consent banner must display the DoD notice and consent banner exactly as specified at start-up device unlock. To ensure notice of and consent to the terms of the DoD standard user agreement, the iOS device must contain an app that displays the DoD notice and consent banner. To best ensure the investigative and prosecutorial purposes of notice and consent are met, the wording of the banner must be exactly as specified. Deviations from the wording have the potential to hinder DoD's ability to monitor or search the device. Additional information is found in DoD Instruction 8500.01. SFR ID: FMT_SMF.1.1 #42
SV-68545r1_rule AIOS-06-080002 CCI-000050 LOW The Apple iOS app used to support the DoD notice and consent banner must retain the notice and consent banner on the screen until the user executes a positive action to manifest agreement by selecting a box indicating acceptance. To ensure notice of and consent to the terms of the DoD standard user agreement, an iOS app must display a consent banner. Additionally, the app must prevent further activity in the application unless and until the user executes a positive action to manifest agreement, such as by tapping an acceptance button in the app. By preventing access to the system until the user accepts the conditions, legal requirements are met to protect the DoD and to remind users the device is designed and implemented for business use. Additional information is found in DoD Instruction 8500.01. SFR ID: FMT_SMF.1.1 #42
SV-68547r1_rule AIOS-06-080003 CCI-000050 LOW The Apple iOS app used to support the DoD notice and consent banner must either prevent access to a frequently used service or notify another device that acceptance of the user agreement has occurred. If a user is able to deny either that he or she has used the app or that he or she provided the requisite consent within the app, then the app will not properly support the investigative and prosecutorial purposes of notice and consent. Without notice and consent, a user may be able to thwart otherwise authorized searches and seizures of the device. If the app is tied to a frequently used service, then use of that service indicates that the consent message has been accepted. If the app is not tied to a frequently used service, then it must notify an external device of consent transactions to enable DoD to determine which users have not periodically accepted the consent statement. Additional information is found in DoD Instruction 8500.01. SFR ID: FMT_SMF.1.1 #42
SV-68549r1_rule AIOS-10-080101 CCI-000366 MEDIUM Apple iOS must employ mobile device management services to centrally manage security-relevant configuration and policy settings. Security-related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of mobile device management (MDM) allows an organization to assign values to security-related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large-scale environment relative to an environment in which each device must be configured separately. SFR ID: FMT_SMF.1.1 #42
SV-68551r1_rule AIOS-10-080102 CCI-000366 MEDIUM Apple iOS must remove managed applications upon unenrollment from MDM. When a device is unenrolled from MDM, it is possible to relax the security policies that the MDM had implemented on the device. This may cause apps and data to be more vulnerable than they were prior to enrollment. Removing managed apps (and consequently the data they maintain) upon unenrollment mitigates this risk because on appropriately configured iOS devices, DoD-sensitive information exists only within managed apps. SFR ID: FMT_SMF_EXT.1
SV-68553r1_rule AIOS-10-080103 CCI-000366 MEDIUM Apple iOS must not allow a user to remove iOS configuration profiles that enforce DoD security requirements. Configuration profiles define security policies on iOS devices. If a user is able to remove a configuration profile, the user can then change the configuration that had been enforced by that policy. Relaxing security policies may introduce vulnerabilities that the profiles had mitigated. Configuring a profile to never be removed mitigates this risk. SFR ID: FMT_SMF.1.1 #42
SV-68555r1_rule AIOS-01-080002 CCI-000057 MEDIUM Apple iOS must lock the display after 15 minutes (or less) of inactivity. The screen lock time-out must be set to a value that helps protect the device from unauthorized access. Having a too-long time-out would increase the window of opportunity for adversaries who gain physical access to the mobile device through loss, theft, etc. Such devices are much more likely to be in an unlocked state when acquired by an adversary, thus granting immediate access to the data on the mobile device. The maximum time-out period of 15 minutes has been selected to balance functionality and security; shorter time-out periods may be appropriate, depending on the risks posed to the mobile device. SFR ID: FMT_SMF.1.1 #02
SV-68557r1_rule AIOS-05-080103 CCI-000366 MEDIUM Apple iOS must not store Personally Identifiable Information (PII) in Medical ID in the Health app. Citing Government Accountability Office GAO Report 08-536's expression of the definitions of PII from Office of Management and Budget Memorandums 07-16 and 06-19, NIST Special Publication 800-122 states, "PII is any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information." The Medical ID in the Health app contains fields for the user's name, date of birth, and medical information, including medical conditions and allergies. It also enables a user to include an personally identifying photograph and list the user's weight, both of which are listed as potential PII in NIST SP 80-122. Avoiding use of the Medical ID mitigates the risk of improper PII disclosure. SFR ID: FMT_SMF.1.1 #42
SV-68559r1_rule AIOS-05-080104 CCI-000366 MEDIUM Apple iOS must not store any payment data in Apple Pay. Apple Pay is a mobile payment technology that enables users to make purchases with their iOS devices, provided that the vendor supports the required Near Field Communications (NFC) interface to Apple Pay. If the payment system is vulnerable to breach, a user's charge cards may be used for unauthorized payments, including charges to government-issued cards. Disabling or avoiding use of Apple Pay mitigates this risk. SFR ID: FMT_SMF.1.1 #42
SV-68561r1_rule AIOS-05-080105 CCI-000366 MEDIUM Apple iOS must not allow use of the Near Field Communications (NFC) radio. Several commercial implementations of NFC protocols are vulnerable to man-in-the-middle and replay attacks. If NFC-enabled iOS devices have similar vulnerabilities, this could enable an adversary to perform unauthorized transactions such as mobile payments. Disabling the NFC radio mitigates this risk. SFR ID: FMT_SMF.1.1 #42