| V-54277 | High | Apple iOS must encrypt iTunes backups. | When syncing an iOS device to a computer running iTunes, iTunes will prompt the user to back up the iOS device. If the performed backup is not encrypted, this could lead to the unauthorized... |
| V-54241 | High | Apple iOS must require a valid password be successfully entered before the mobile device data is unencrypted. | Encryption is only effective if the decryption procedure is protected. If an adversary can easily access the private key (either directly or through a software application), sensitive DoD data is... |
| V-54269 | High | Apple iOS must not allow the device to be unlocked using a fingerprint. | Touch ID is a fingerprint reader that has been installed on some models of iOS devices. This fingerprint reader can be used to authenticate the user in order to unlock the mobile device. At this... |
| V-54249 | Medium | Apple iOS must not allow use of iCloud document and data synchronization. | A cloud document syncing feature may gather user's information, such as PII, or sensitive documents. With this feature enabled, sensitive information will be backed up to the manufacturer's... |
| V-54295 | Medium | Apple iOS must not share location data through iCloud. | Sharing of location data is an OPSEC risk because it potentially allows an adversary to determine a DoD user's location and movements and patterns in those movements over time. An adversary could... |
| V-54293 | Medium | Apple iOS must not have any Family Members in Family Sharing. | Apple's Family Sharing service allows iOS users to create a Family Group whose members have several shared capabilities, including the ability to lock, wipe, play a sound on, or locate the iOS... |
| V-54291 | Medium | Apple iOS must have Airdrop disabled. | An Airdrop feature is a way to send contact information or photos to other users with this same feature enabled. This feature enables a possible attack vector for adversaries to exploit. Once the... |
| V-54253 | Medium | Apple iOS must not allow use of My Photo Stream. | When My Photo Stream is enabled, sensitive photos will be automatically uploaded to Apple-specified servers and available on other iOS devices associated with the same Apple ID, provided that the... |
| V-54251 | Medium | Apple iOS must not allow use of the iCloud Keychain. | The iCloud Keychain is an iOS function that will store users' account names and passwords in iCloud, then synchronize this data between the users' Macs, iPhones, and iPads. An adversary may use... |
| V-54255 | Medium | Apple iOS must not allow use of iCloud Photo Sharing (also known as Shared Photo Streams). | When iCloud Photo Sharing is enabled, sensitive photos will be automatically uploaded to Apple-specified servers and available on the IOS devices of other users who have accepted invitations to... |
| V-54279 | Medium | Apple iOS must not allow backup of enterprise books. | Enterprise books may contain DoD-sensitive information. When enterprise books are backed up, they are vulnerable to attacks on the backup systems and media. Disabling the backup capability... |
| V-54237 | Medium | Apple iOS must enforce a minimum password length of 6 or more characters. | Password strength is a measure of the effectiveness of a password in resisting guessing and brute-force attacks. The ability to crack a password is a function of how many attempts an adversary is... |
| V-54313 | Medium | Apple iOS must not store any payment data in Apple Pay. | Apple Pay is a mobile payment technology that enables users to make purchases with their iOS devices, provided that the vendor supports the required Near Field Communications (NFC) interface to... |
| V-54271 | Medium | Apple iOS must not allow non-DoD applications to access DoD data. | Managed apps have been approved for the handling of DoD-sensitive information. Unmanaged apps are provided for productivity and morale purposes but are not approved to handle DoD-sensitive... |
| V-54311 | Medium | Apple iOS must not store Personally Identifiable Information (PII) in Medical ID in the Health app. | Citing Government Accountability Office GAO Report 08-536's expression of the definitions of PII from Office of Management and Budget Memorandums 07-16 and 06-19, NIST Special Publication 800-122... |
| V-54315 | Medium | Apple iOS must not allow use of the Near Field Communications (NFC) radio. | Several commercial implementations of NFC protocols are vulnerable to man-in-the-middle and replay attacks. If NFC-enabled iOS devices have similar vulnerabilities, this could enable an adversary... |
| V-54245 | Medium | Apple iOS must not allow screen capture. | By allowing the screen capture function, a user has the ability to capture a screen containing sensitive information and then transfer it to an application not authorized to store or process that... |
| V-54289 | Medium | Apple iOS must not allow messages in an Active Sync Exchange account to be forwarded or moved to other accounts in the iOS Mail app. | The iOS Mail app can be configured to support multiple email accounts concurrently. These email accounts are likely to involve content of varying degrees of sensitivity (e.g., both personal and... |
| V-54247 | Medium | Apple iOS must not allow use of iCloud backup. | A cloud backup feature may gather a user's information, such as PII, or sensitive documents. With this feature enabled, sensitive information will be backed up to the manufacturer's servers and... |
| V-54243 | Medium | Apple iOS must not allow the device unlock password to contain more than two sequential or repeating characters (e.g., 456, aaa). | Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute-force attack. Passwords with sequential or repeating numbers or alphabetic... |
| V-54283 | Medium | Apple iOS must not allow managed applications to store data in iCloud. | Storing data with a non-DoD cloud provider may leave the data vulnerable to breach. Disabling non-DoD cloud services mitigates this risk.
SFR ID: FMT_SMF.1.1 #42 |
| V-54287 | Medium | Apple iOS must use SSL for Exchange Active Sync. | Exchange email messages are a form of data in transit and thus are vulnerable to eavesdropping and man-in-the-middle attacks. Secure Sockets Layer (SSL), also referred to as Transport Layer... |
| V-54309 | Medium | Apple iOS must lock the display after 15 minutes (or less) of inactivity. | The screen lock time-out must be set to a value that helps protect the device from unauthorized access. Having a too-long time-out would increase the window of opportunity for adversaries who gain... |
| V-54263 | Medium | Apple iOS must not display calendar information when the device is locked. | If the mobile operating system were to display notifications or calendar information on the lock screen, an adversary may be able to gather sensitive data without needing to unlock the device.... |
| V-54261 | Medium | Apple iOS must not display notifications when the device is locked. | If the mobile operating system were to display notifications or calendar information on the lock screen, an adversary may be able to gather sensitive data without needing to unlock the device.... |
| V-54303 | Medium | Apple iOS must employ mobile device management services to centrally manage security-relevant configuration and policy settings. | Security-related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| V-54267 | Medium | Apple iOS must not allow voice dialing when the device is locked. | On iOS devices, users can access the device's contact database or calendar to obtain phone numbers and other information using a human voice even when the mobile device is locked. Often this... |
| V-54305 | Medium | Apple iOS must remove managed applications upon unenrollment from MDM. | When a device is unenrolled from MDM, it is possible to relax the security policies that the MDM had implemented on the device. This may cause apps and data to be more vulnerable than they were... |
| V-54265 | Medium | Apple iOS must not allow use of Siri when the device is locked. | On iOS devices, users can access the device's contact database or calendar to obtain phone numbers and other information using a human voice even when the mobile device is locked. Often this... |
| V-54307 | Medium | Apple iOS must not allow a user to remove iOS configuration profiles that enforce DoD security requirements. | Configuration profiles define security policies on iOS devices. If a user is able to remove a configuration profile, the user can then change the configuration that had been enforced by that... |
| V-54297 | Low | The Apple iOS app used to support the DoD notice and consent banner must display the DoD notice and consent banner exactly as specified at start-up device unlock. | To ensure notice of and consent to the terms of the DoD standard user agreement, the iOS device must contain an app that displays the DoD notice and consent banner. To best ensure the... |
| V-54299 | Low | The Apple iOS app used to support the DoD notice and consent banner must retain the notice and consent banner on the screen until the user executes a positive action to manifest agreement by selecting a box indicating acceptance. | To ensure notice of and consent to the terms of the DoD standard user agreement, an iOS app must display a consent banner. Additionally, the app must prevent further activity in the application... |
| V-54257 | Low | Apple iOS must not allow diagnostic data to be sent to an organization other than DoD. | The sending of diagnostic data back to the manufacturer is prohibited in the DoD. Sending this data to an organization other than DoD is termed a “phone-home” vulnerability. This setting may... |
| V-54259 | Low | Apple iOS must limit Ad Tracking. | Ad Tracking refers to the advertisers’ ability to categorize the device and spam the user with ads that are most relevant to the user’s preferences. By not “Force limiting ad tracking”,... |
| V-54273 | Low | Apple iOS must not allow DoD applications to access non-DoD data. | Managed apps have been approved for the handling of DoD-sensitive information. Unmanaged apps are provided for productivity and morale purposes but are not approved to handle DoD-sensitive... |
| V-54275 | Low | Apple iOS must not allow automatic completion of Safari browser passcodes. | The AutoFill functionality in the Safari web browser allows the user to complete a form that contains sensitive information, such as PII, without previous knowledge of the information. By allowing... |
| V-54281 | Low | Apple iOS must not allow use of Handoff. | Handoff permits a user of an iOS device to transition user activities from one device to another. Handoff passes sufficient information between the devices to describe the activity, but app data... |
| V-54285 | Low | Apple iOS must require the user to enter a password when connecting to an AirPlay-enabled device for the first time. | When a user is allowed to use AirPlay without a password, there is the potential that it may mistakenly associate the iOS device with an AirPlay-enabled device other than the one intended (i.e.,... |
| V-54239 | Low | Apple iOS must prohibit more than 10 consecutive failed authentication attempts. | Users must not be able to override the system policy on the maximum number of consecutive failed authentication attempts because this could allow them to raise the maximum, thus giving adversaries... |
| V-54301 | Low | The Apple iOS app used to support the DoD notice and consent banner must either prevent access to a frequently used service or notify another device that acceptance of the user agreement has occurred. | If a user is able to deny either that he or she has used the app or that he or she provided the requisite consent within the app, then the app will not properly support the investigative and... |
