| V-32716 | High | The mobile operating system must employ a DoD approved anti-virus application or otherwise prevent a malware application from installing and executing.
| In order to minimize potential negative impact to the organization that can be caused by malicious code, it is imperative that malicious code is identified and eradicated. Malicious code includes... |
| V-32698 | High | MDM, MAM, and integrity validation agent(s) must be installed and operate at all times on the mobile OS device.
| The MDM, MAM, and integrity scanning agents all perform various security management functions on the iOS devices (some products integrate all three functions into one agent). If these agents are... |
| V-32699 | High | The mobile operating system must not permit a user to disable or modify the security policy or enforcement mechanisms on the device.
| The integrity of the security policy and enforcement mechanisms is critical to the IA posture of the operating system. If a user can modify a device's security policy or enforcement mechanisms,... |
| V-32700 | High | The mobile operating system must provide mutual authentication between the provisioning server and the provisioned device during a trusted over-the-air (OTA) provisioning session.
| When dealing with access restrictions pertaining to change control, it should be noted that any changes to the hardware, software, and/or firmware components of the information system can... |
| V-32705 | High | The mobile operating system PKI certificate store must encrypt contents using AES encryption (AES 128 bit encryption key length is the minimum requirement; AES 256 desired).
| If an adversary can access the key store, it may be able to use the keys to perform a variety of unauthorized transactions. It may also be able to modify public keys in a way that it can trick... |
| V-32713 | Medium | The mobile operating system must require a valid password be successfully entered before the mobile device data is unencrypted.
| Encryption is only effective if the decryption procedure is protected. If an adversary can easily access the private key (either directly or through a software application), then sensitive DoD... |
| V-32712 | Medium | The mobile operating system must encrypt all data on the mobile device using AES encryption (AES 128 bit encryption key length is the minimum requirement; AES 256 desired).
| If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly,... |
| V-32711 | Medium | The mobile operating system must prevent a user from using a browser that does not direct its traffic to a DoD proxy server.
| Proxy servers can inspect traffic for malware and other signs of a security attack. Allowing a mobile device to access the public Internet without proxy server inspection forgoes the protection... |
| V-32695 | Medium | Allow Diagnostic Data to be Sent to Apple must be disabled.
| Sensitive DoD information could be compromised if this setting is not implemented. DoD mobile device diagnostic data could be considered sensitive data and should not be sent to Apple and reside... |
| V-32715 | Medium | The mobile operating system must re-encrypt all device data when the device is locked.
| If data is not encrypted upon the lock of the device, there is the potential for an adversary to remove non-volatile memory from the device and read it directly using tools for that purpose. This... |
| V-25007 | Medium | Mobile devices must be configured to require a password/passcode for device unlock.
| Sensitive DoD data could be compromised if a device unlock passcode is not set up on a DoD iOS device.
|
| V-25011 | Medium | Passcode maximum failed attempts must be set to required value. | A hacker with unlimited attempts can determine the password of an iOS device within a few minutes using password hacking tools, which could lead to unauthorized access to the iOS device and... |
| V-27635 | Medium | Remote full device wipe must be enabled. | Sensitive DoD data could be compromised if mobile OS device data could not be wiped when directed by the system administrator. |
| V-25013 | Medium | Users must enable iOS application download.
| Application download must be enabled so iOS updates can be installed over-the-air (OTA) and security updates will be installed as soon as possible. This is a key feature of the security baseline... |
| V-32697 | Medium | All wireless PDA client VPN authentication credential cache timeout must be set to 2 hours or less.
| DoD data could be compromised if transmitted data is not secured with a compliant VPN. User authentication credentials (CAC PIN) may be compromised if a hacker credential cache is not wiped on a... |
| V-32696 | Medium | All wireless PDA client VPNs must timeout an inactive session after a set period of inactivity.
| The data on a DoD iOS device most likely contains sensitive DoD information, therefore, when device data is backed up to a local, approved laptop, the data should be encrypted to prevent... |
| V-25015 | Medium | Mobile device screen capture must not be allowed.
| Sensitive data, including FOUO data displayed on the screen, could be saved in unsecure memory on the device.
|
| V-25016 | Medium | The device minimum password/passcode length must be set. | Sensitive DoD data could be compromised if a device unlock password/passcode is not set to required length on a DoD smartphones. |
| V-25017 | Medium | Apple iOS Auto-Lock must be set. | Sensitive DoD data could be compromised if the iOS device does not automatically lock after a set period of inactivity. |
| V-25010 | Medium | The mobile device must be set to lock the device after a set period of user inactivity. | Sensitive DoD data could be compromised if the smartphone does not automatically lock after 15 minutes of inactivity. |
| V-32693 | Medium | Allow Photo Stream must be disabled.
| The iCloud feature (and associated iCloud setting in iOS) stores iOS device data on Apple controlled servers. Sensitive DoD data saved on the iOS device could be compromised when it is stored on... |
| V-32690 | Medium | Allow iCloud Backup must be disabled.
| The iCloud feature (and associated iCloud setting in iOS) stores iOS device data on Apple controlled servers. Sensitive DoD data saved on the iOS device could be compromised when it is stored on... |
| V-32691 | Medium | Allow Document Syncing must be disabled.
| The iCloud feature (and associated iCloud setting in iOS) stores iOS device data on Apple controlled servers. Sensitive DoD data saved on the iOS device could be compromised when it is stored on... |
| V-25006 | Medium | iOS devices must be configured to require a password to remove the iOS configuration profile, if a configuration profile is used.
| Sensitive DoD data could be compromised if a security profile is not installed on DoD iPhone/iPad/iPod Touch devices. The profile should only be removed by the system administrator. |
| V-32701 | Medium | The mobile operating system must protect the confidentiality of the provisioning data downloaded to the handheld device during a trusted over-the-air (OTA) provisioning session.
| Provisioning data may be sensitive and therefore must be adequately protected. An adversary within the general proximity of the mobile device can eavesdrop on OTA transactions, making them... |
| V-32702 | Medium | The mobile operating system must protect the integrity of the provisioning data downloaded to the handheld device during a trusted over-the-air (OTA) provisioning session.
| Provisioning data may be sensitive and therefore must be adequately protected. It may be possible for an adversary within the general proximity of the mobile device to hijack provisioning... |
| V-32704 | Medium | The mobile operating system must encrypt all data in transit using AES encryption when communicating with DoD information resources (128-bit key length is the minimum requirement; 256-bit desired).
| If data traffic is sent unencrypted, an adversary may be able to read it to obtain sensitive information. AES encryption with 128-bit (or longer) keys mitigates the risk of unauthorized... |
| V-32706 | Medium | The cryptographic module supporting encryption of data in transit (including email and attachments) must be FIPS 140-2 validated.
| The most common vulnerabilities with cryptographic modules are those associated with poor implementation. FIPS 140 validation provides assurance that the relevant cryptography has been... |
| V-32707 | Medium | The cryptographic module supporting encryption of data at rest must be FIPS 140-2 validated.
| The most common vulnerabilities with cryptographic modules are those associated with poor implementation. FIPS 140 validation provides assurance that the relevant cryptography has been... |
| V-32708 | Medium | The cryptographic module supporting encryption of the certificate store must be FIPS 140-2 validated.
| The most common vulnerabilities with cryptographic modules are those associated with poor implementation. FIPS 140 validation provides assurance that the relevant cryptography has been... |
| V-25012 | Medium | Access to public application stores must be disabled. | Strong configuration management of all applications installed on DoD device is required to ensure the security baseline of the system is maintained. Otherwise, sensitive DoD data could be compromised. |
| V-19899 | Medium | All wireless PDA client VPNs must have split tunneling disabled. | DoD data could be compromised if transmitted data is not secured with a compliant VPN. Split tunneling could allow connections from non-secure Internet sites to access data on the DoD network. |
| V-19898 | Medium | All wireless PDA clients used for remote access to DoD networks must have a VPN supporting CAC authentication. | DoD data could be compromised if transmitted data is not secured with a compliant VPN. |
| V-19897 | Medium | All wireless PDA clients used for remote access to DoD networks must have a VPN supporting AES encryption. | DoD data could be compromised if transmitted data is not secured with a compliant VPN. |
| V-32686 | Medium | iOS Siri application must be disabled.
| The Siri application connects to Apple servers and stores information about the device and user inquiries on those servers. The use of Siri could lead to the compromise of sensitive DoD information.
|
| V-32689 | Medium | Adding Game Center Friends must be disabled.
| The game function connects to Apple servers and allows the transfer of device data to other iOS devices. The use of the game function could lead to the compromise of sensitive DoD information.
|
| V-32688 | Medium | iOS Multiplayer Gaming must be disabled.
| The game function connects to Apple servers and allows the transfer of device data to other iOS devices. The use of the game function could lead to the compromise of sensitive DoD information. |
| V-25022 | Medium | All mobile devices must display the required banner during device unlock/logon.
| DoD CIO memo requires all PDAs, BlackBerrys, and smartphones to have a consent banner displayed during logon/device unlock to ensure users understand their responsibilities to safeguard DoD data. |
| V-25003 | Medium | Mobile devices must have required operating system software version installed.
| Unapproved OS versions do not support required security features. |
| V-24983 | Medium | S/MIME must be installed on mobile device, so users can sign/encrypt email | S/MIME provides the capability for users to send and receive S/MIME email messages from wireless email devices. S/MIME and digital signatures provide assurance the message is authentic and is... |
| V-18627 | Medium | The VPN client on wireless clients (PDAs, smartphones) used for remote access to DoD networks must be FIPS 140-2 validated. | DoD data could be compromised if transmitted data is not secured with a compliant VPN. FIPS validation provides a level of assurance that the encryption of the device has been securely implemented. |
| V-25033 | Low | iOS Safari must be disabled.
| The Safari browser does not support FIPS 140-2 validated encryption and CAC authentication to DoD web sites. FIPS validation provides a level of assurance that encrypted sensitive data will not... |
| V-25018 | Low | The smartphone passcode history setting must be set. | The passcode would be more susceptible to compromise if the user can select frequently used passcodes. |
| V-25092 | Low | The iOS device Wi-Fi setting Ask to Join Networks must be set to On at all times (User Based Enforcement (UBE)).
| The risk of a DoD mobile device being attacked via a rogue Wi-Fi access point is higher than for a rogue cellular access point. Therefore, the mobile device should be configured so it does not... |
| V-32703 | Low | The mobile operating system must support the capability for the system administrator to disable over-the-air (OTA) provisioning.
| In some environments, the risk of OTA provisioning may outweigh any convenience benefit it offers. In such cases, the administrator should have the ability to disable OTA provisioning to ensure... |
| V-25020 | Low | The mobile device Wi-Fi radio must be disabled as the default setting and is enabled only when Wi-Fi connectivity is required.
| The Wi-Fi radio can be used by a hacker to connect to the smartphone without the knowledge of the user. Sensitive DoD data could be exposed and the hacker could use the device to attack the enclave. |
| V-25756 | Low | Encrypted smartphone backups must be enabled. | The act of connecting an iOS device to a PC can put it at risk of attack if the PC is compromised. The iOS device should sync to a minimum number of approved machines. It should not sync to... |
| V-25755 | Low | Access to online application purchases must be disabled. | Strong configuration management of all applications installed on DoD devise is required to ensure the security baseline of the system is maintained. Otherwise, sensitive DoD data could be compromised. |
| V-25009 | Low | Maximum passcode age must be set. | Sensitive DoD data could be compromised if a strong device unlock passcode is not set up on a DoD iPOS device and the passcode is not changed periodically.
|
| V-24982 | Low | Smart Card Readers (SCRs) used with smartphones must have required software version installed. | Required security features are not available in earlier software versions. In addition, there may be known vulnerabilities in earlier versions. |
| V-25014 | Low | Mobile device cameras must be used only if documented approval is in the site physical security policy.
| This is an operational security issue. DoD sensitive information could be compromised if cameras are allowed in areas not authorized by the site physical security plan. |
| V-24985 | Low | The browser must direct all traffic to a DoD Internet proxy gateway.
| When using the DoD Internet proxy for iOS device Internet connections, enclave Internet security controls will filter and monitor iOS device Internet connections and reduce the risk that malware... |
| V-24984 | Low | If mobile device email auto signatures are used, the signature message must not disclose the email originated from a smartphone (e.g., Sent From My Wireless Handheld).
| The disclaimer message may give information which may key an attacker in on the device. |
