The mobile operating system must encrypt all data on the mobile device using AES encryption.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32712	WIR-MOS-iOS-65-12	SV-43058r1_rule	DCNR-1	Medium

Description
If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. AES encryption with appropriate key lengths provides assurance that the cryptography is adequate.

Description

If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. AES encryption with appropriate key lengths provides assurance that the cryptography is adequate.

STIG	Date
Apple iOS 6 Interim Security Configuration Guide (ISCG)	2013-01-17

Details

Check Text ( C-41073r3_chk )
Review a sample of site managed devices (3-4), interview the IAO, and review product documentation. Verify the site uses a security container application to store all data saved to the device and the container uses AES encryption. This includes all data generated by applications on the device and all data downloaded from the browser or VPN client (if used). In most cases, the browser and VPN client will have to be installed inside the security container or integrated with the container in some way for this to occur. Determine how the site has ensured all data generated by applications or downloaded from the browser or VPN client is stored in the security container application. Mark as a finding if all DoD data stored on site managed devices is not saved inside a security container that uses AES encryption.

Check Text ( C-41073r3_chk )

Review a sample of site managed devices (3-4), interview the IAO, and review product documentation.

Verify the site uses a security container application to store all data saved to the device and the container uses AES encryption. This includes all data generated by applications on the device and all data downloaded from the browser or VPN client (if used). In most cases, the browser and VPN client will have to be installed inside the security container or integrated with the container in some way for this to occur.

Determine how the site has ensured all data generated by applications or downloaded from the browser or VPN client is stored in the security container application.

Mark as a finding if all DoD data stored on site managed devices is not saved inside a security container that uses AES encryption.

Fix Text (F-36608r1_fix)
Configure the operating system to encrypt all data on the mobile device using AES encryption.