Access to online application purchases must be disabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-25755	WIR-MOS-iOS-G-023	SV-32021r1_rule	DCCB-1 DCCB-2	Low

Description
Strong configuration management of all applications installed on DoD devise is required to ensure the security baseline of the system is maintained. Otherwise, sensitive DoD data could be compromised.

STIG	Date
Apple iOS 4 (Good Mobility Suite) Interim Security Configuration Guide (ISCG)	2011-11-07

Details

Check Text ( C-32247r1_chk )
This is a Good security policy set check. Recommend that all checks related to Good security policy set rules be reviewed using the following procedure. 1. Make a list of all Good security policy sets assigned to smartphone user accounts on the Good server using the following procedure: -Have the SA identify any non ISCG-compliant policy sets and ISCG-compliant policy sets on the server. --Log into the Good Mobile Control console. --Click on the Policies tab. --View all policy sets on the server. -Note: STIG-compliant policy sets should be identified as such in the policy title. Examples are as follows: ISCG_iOS_Policy_Set, STIG_WM6-5_Policy_Set, or STIG_Android_Policy_Set. It is recommended that all non-STIG/ISCG policy sets be deleted. 2. Select each policy set users are assigned to, and in turn, verify the required settings are in the policy set. -Note: If there is a finding, note the name of the non ISCG-compliant policy set in the Findings Details section in VMS/Component Provided Tracking Database. -Launch the Good Mobile Control Web console and click on the Policies tab. -Select the policy set for the iOS devices and click on iPhone Configuration on the left side. When reviewing the ISCG_Policy_Set, complete the following: -Click the Restrictions tab. -Verify “Allow In-App Purchases” is unchecked. Mark as a finding if not set as required.

Check Text ( C-32247r1_chk )

This is a Good security policy set check. Recommend that all checks related to Good security policy set rules be reviewed using the following procedure.

1. Make a list of all Good security policy sets assigned to smartphone user accounts on the Good server using the following procedure:

-Have the SA identify any non ISCG-compliant policy sets and ISCG-compliant policy sets on the server.
--Log into the Good Mobile Control console.
--Click on the Policies tab.
--View all policy sets on the server.

-Note: STIG-compliant policy sets should be identified as such in the policy title. Examples are as follows: ISCG_iOS_Policy_Set, STIG_WM6-5_Policy_Set, or STIG_Android_Policy_Set. It is recommended that all non-STIG/ISCG policy sets be deleted.

2. Select each policy set users are assigned to, and in turn, verify the required settings are in the policy set.

-Note: If there is a finding, note the name of the non ISCG-compliant policy set in the Findings Details section in VMS/Component Provided Tracking Database.

-Launch the Good Mobile Control Web console and click on the Policies tab.
-Select the policy set for the iOS devices and click on iPhone Configuration on the left side.

When reviewing the ISCG_Policy_Set, complete the following:
-Click the Restrictions tab.
-Verify “Allow In-App Purchases” is unchecked.

Mark as a finding if not set as required.

Fix Text (F-28612r1_fix)
Disable access to online application purchases.