The mobile operating system must not cache smart card or certificate store passwords used by the VPN client for more than two hours.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32697	WIR-MOS-iOS-034-06	SV-43043r1_rule	ECWN-1	Medium

Description
DoD data could be compromised if transmitted data is not secured with a compliant VPN. User authentication credentials (CAC PIN) may be compromised if a hacker credential cache is not wiped on a periodic basis.

STIG	Date
Apple iOS6 Security Technical Implementation Guide	2014-10-07

Details

Check Text ( C-41059r3_chk )
This check is not applicable if the installed VPN client is not used for remote access to DoD networks. Note: Use of a VPN to access DoD email on a mobile device is not required. Interview the IAO and/or site wireless device administrator and inspect a sample (3-4) of site devices. Review VPN client specification sheets. Verify the VPN client is inactive session timeout has been set to 2 hours or less, if this parameter is configurable. If the specification sheets do not provide evidence of this capability, authenticate the VPN, wait two hours, and verify the system prompts the user for fresh credentials. Mark as a finding if the timeout period is not set as required.

Check Text ( C-41059r3_chk )

This check is not applicable if the installed VPN client is not used for remote access to DoD networks. Note: Use of a VPN to access DoD email on a mobile device is not required.
Interview the IAO and/or site wireless device administrator and inspect a sample (3-4) of site devices. Review VPN client specification sheets. Verify the VPN client is inactive session timeout has been set to 2 hours or less, if this parameter is configurable. If the specification sheets do not provide evidence of this capability, authenticate the VPN, wait two hours, and verify the system prompts the user for fresh credentials.

Mark as a finding if the timeout period is not set as required.

Fix Text (F-36595r2_fix)
Configure the VPN client to timeout an inactive session of 2 hours or less.