What changed in Apple iOS/iPadOS 18 STIG V2R4V2R4 changes

Check text

Review the list of unmanaged apps installed on the iPhone and iPad and determine if any unmanaged third-party VPN clients are installed. If so, verify the VPN app is not configured with a DODDoW network (work) VPN profile. This validation procedure is performed on the iOS device only. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap the "VPN and Device Management" line and determine if any "Personal VPN" exists. 4. If not, the requirement has been met. 5. If there are personal VPNs, open each VPN app. Review the list of VPN profiles configured on the VPN client. 6. Verify no DODDoW network VPN profiles are configured on the VPN client. If any third-party unmanaged VPN apps are installed (personal VPN) and they have a DODDoW network VPN profile configured on the client, this is a finding. Note: This setting cannot be managed by the MDM administrator and is a User-Based Enforcement (UBE) requirement.

Fix text

If a third-party unmanaged VPN app is installed on the iOS 18 device, do not configure the VPN app with a DODoW network VPN profile.

Discussion

The system administrator must have the capability to configure VPN access to meet organization-specific policies based on mission needs. Otherwise, a user could inadvertently or maliciously set up a VPN and connect to a network that poses unacceptable risk to DODDoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DODDoW sensitive information. SFRID: FMT_SMF.1.1 #3

V-267937 in V2R4

Discussion

If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DODDoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DODDoW sensitive information. SFRID: FMT_MOF_EXT.1.2 #40

V-267958 in V2R4

Discussion

If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DODDoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DODDoW sensitive information. SFRID: FMT_MOF_EXT.1.2 #40

V-267959 in V2R4

Discussion

If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DODDoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DODDoW sensitive information. SFRID: FMT_MOF_EXT.1.2 #40

V-267960 in V2R4

Discussion

If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DODDoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DODDoW sensitive information. SFRID: FMT_MOF_EXT.1.2 #40

V-267961 in V2R4

Discussion

If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DODDoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DODDoW sensitive information. SFRID: FMT_MOF_EXT.1.2 #40

V-267962 in V2R4

Fix text

Install a configuration profile to prevent DODoW applications from storing data in iCloud.

Discussion

If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DODDoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DODDoW sensitive information. SFRID: FMT_MOF_EXT.1.2 #40

V-267963 in V2R4

Fix text

Install a configuration profile to prevent backup of enterprise books that could contain DODoW sensitive information.

Discussion

If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DODDoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DODDoW sensitive information. SFRID: FMT_MOF_EXT.1.2 #40

V-267964 in V2R4

Title

Apple iOS/iPadOS 18 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DODDoW-approved commercial app repository, MDM server, mobile application store].

Discussion

Forcing all applications to be installed from authorized application repositories can prevent unauthorized and malicious applications from being installed and executed on mobile devices. Allowing such installations and executions could cause a compromise of DODDoW data accessible by these unauthorized/malicious applications. SFRID: FMT_SMF.1.1 #8

V-267993 in V2R4

Discussion

Requiring all authorized applications to be in an application allow list prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the allow list. Failure to configure an application allow list properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DODDoW data accessible by these applications. Applications with the listed characteristics have features that can cause the compromise of sensitive DODDoW data or have features with no known application in the DODDoW environment. Application note: The application allow list, in addition to controlling the installation of applications on the MD, must control user access/execution of all core and preinstalled applications, or the MD must provide an alternate method of restricting user access/execution to core and preinstalled applications. Core application: Any application integrated into the OS by the OS or MD vendors. Preinstalled application: Additional noncore applications included in the OS build by the OS vendor, MD vendor, or wireless carrier. SFRID: FMT_SMF.1.1 #8

V-267995 in V2R4

Title

The Apple iOS/iPadOS 18 allow list must be configured to not include applications with the following characteristics: - Backs up MD data to non-DODDoW cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DODDoW servers; - Allows synchronization of data or applications between devices associated with user; - Allows unencrypted (or encrypted but not FIPS 140-3 validated) data sharing with other MDs or printers; - Backs up its own data to a remote system; and - Uses artificial intelligence (AI), which processes data in the cloud (off device). Exception: Apple Intelligence Private Cloud Compute (PCC).

Check text

Verify no apps with the following prohibited characteristics are included in the configuration profile: - Backs up MD data to non-DODDoW cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DODDoW servers; - Allows synchronization of data or applications between devices associated with user; - Allows unencrypted (or encrypted but not FIPS 140-3 validated) data sharing with other MDs or printers; - Backs up its own data to a remote system; and - Uses AI, which processes data in the cloud (off device). Exception: Apple Intelligence Private Cloud Compute (PCC). This check procedure is performed on the Apple iOS/iPadOS management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the Apple iOS/iPadOS management tool, verify "Allow Listed App" (allowlistedAppBundleIDs) is configured and there are no apps with prohibited characteristics. If "Allow listed apps" is not configured and contains apps with prohibited characteristics, this is a finding.

Fix text

Install a configuration profile with an allow list of approved apps (allowlistedAppBundleIDs). Ensure the allow list does not include apps with the following characteristics: - Backs up MD data to non-DODDoW cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DODDoW servers; - Allows synchronization of data or applications between devices associated with user; - Allows unencrypted (or encrypted but not FIPS 140-3 validated) data sharing with other MDs or printers; - Backs up its own data to a remote system; and - Uses AI, which processes data in the cloud (off device). Exception: Apple Intelligence Private Cloud Compute (PCC).

Discussion

Requiring all authorized applications to be in an application allow list prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the allow list. Failure to configure an application allow list properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DODDoW data accessible by these applications. Applications with the listed characteristics have features that can cause the compromise of sensitive DODDoW data or have features with no known application in the DODDoW environment. Application note: The application allow list, in addition to controlling the installation of applications on the MD, must control user access/execution of all core and preinstalled applications, or the MD must provide an alternate method of restricting user access/execution to core and preinstalled applications. Core application: Any application integrated into the OS by the OS or MD vendors. Preinstalled application: Additional noncore applications included in the OS build by the OS vendor, MD vendor, or wireless carrier. SFRID: FMT_SMF.1.1 #8

V-267997 in V2R4

Title

Apple iOS/iPadOS 18 must be configured to display the DODoW advisory warning message at startup or each time the user unlocks the device.

Check text

The DODDoW warning banner can be displayed by either of the following methods (required text is found in the Vulnerability Discussion): 1. By placing the DODDoW warning banner text in the user agreement signed by each iPhone and iPad user. 2. By installing a Lock Screen Message payload with the required text (preferred method). Determine which method is used at the iOS device site and follow the appropriate validation procedure below. Validation Procedure for Method #1: Review the signed user agreements for several iOS device users and verify the agreement includes the required DODDoW warning banner text. Validation Procedure for Method #2: In the Apple iOS/iPadOS management tool, verify a Lock Screen Message payload has been installed on each managed device. The LockScreenFootnote string should include required text. If, for Method #1, the required warning banner text is not on all signed user agreements reviewed, or for Method #2, the DODDoW warning banner text is not set as the lock screen footnote, this is a finding.

Fix text

Configure the DODDoW warning banner by either of the following methods (required text is found in the Vulnerability Discussion): 1. By placing the DODDoW warning banner text in the user agreement signed by each iOS device user. 2. By installing a Lock Screen Message payload with the required text (preferred method).

Discussion

Before granting access to the system, the mobile operating system is required to display the DODDoW-approved system use notification message or banner that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Required banners help ensure that DODDoW can audit and monitor the activities of mobile device users without legal restriction. System use notification messages can be displayed when individuals first access or unlock the mobile device. The banner must be implemented as a "click-through" banner at device unlock (to the extent permitted by the operating system). A "click-through" banner prevents further activity on the information system unless and until the user executes a positive action to manifest agreement by clicking on a box indicating "OK". The approved DODDoW text must be used exactly as required in the Knowledge Service referenced in DODI 8500.01. For devices accommodating banners of 1300 characters, the banner text is: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. For devices with severe character limitations, the banner text is: I've read & consent to terms in IS user agreem't. The administrator must configure the banner text exactly as written without any changes. SFRID: FMT_SMF.1.1 #36

V-268007 in V2R4

Title

Apple iOS/iPadOS 18 must not allow non-DODoW applications to access DODoW data.

Fix text

Install a configuration profile to prevent non-DODoW applications from accessing DODoW data.

Discussion

App data sharing gives apps the ability to access the data of other apps for enhanced user functionality. However, sharing also poses a significant risk that unauthorized users or apps will obtain access to sensitive DODDoW information. To mitigate this risk, there are data sharing restrictions. If a user is allowed to make exceptions to the data sharing restriction policy, the user could enable unauthorized sharing of data, leaving it vulnerable to breach. Limiting the granting of exceptions to either the administrator or common application developer mitigates this risk. Copy/paste of data between applications in different application processes or groups of application processes is considered an exception to the access control policy; therefore, the administrator must be able to enable/disable the feature. Other exceptions include allowing any data or application sharing between process groups. SFRID: FMT_SMF.1.1 #42, FDP_ACF_EXT.1.2

V-268017 in V2R4

Discussion

Multiuser mode allows multiple users to share a mobile device by providing a degree of separation between user data. To date, no mobile device with multiuser mode features meets DODDoW requirements for access control, data separation, and nonrepudiation for user accounts. In addition, the MDFPP does not include design requirements for multiuser account services. Disabling multiuser mode mitigates the risk of not meeting DODDoW multiuser account security policies. SFRID: FMT_SMF.1.1 #47a

V-268018 in V2R4

Discussion

Ad hoc wireless client-to-client connections allow mobile devices to communicate with each other directly, circumventing network security policies and making the traffic invisible. This could allow the exposure of sensitive DODDoW data and increase the risk of downloading and installing malware on the DODDoW mobile device. SFRID: FMT_SMF_EXT.1.1/WLAN

V-268022 in V2R4

Discussion

Ad Tracking refers to the advertisers' ability to categorize the device and spam the user with ads that are most relevant to the user's preferences. By not "Force limiting ad tracking", advertising companies are able to gather information about the user and device's browsing habits. If "Limit Ad Tracking" is not limited, a database of browsing habits of DODDoW devices can be gathered and stored under no supervision of the DODDoW. Limiting ad tracking does not completely mitigate the risk but does limit the amount of information gathering. SFRID: FMT_SMF.1.1 #47

V-268026 in V2R4

Discussion

If iCloud backups are not encrypted, this could lead to the unauthorized disclosure of DODDoW sensitive information if non-DODDoW personnel are able to access that machine. Forcing the backup to be encrypted greatly mitigates the risk of compromising sensitive data. Work data iCloud backup and USB connections to computers are not authorized, but this control provides defense-in-depth for cases in which a user violates policy either intentionally or inadvertently. SFRID: FMT_SMF.1.1 #47

V-268028 in V2R4

Discussion

Handoff permits a user of an iPhone and iPad to transition user activities from one device to another. Handoff passes sufficient information between the devices to describe the activity, but app data synchronization associated with the activity is handled though iCloud, which should be disabled on a compliant iPhone and iPad. If a user associates both DODDoW and personal devices to the same Apple ID, the user may improperly reveal information about the nature of the user's activities on an unprotected device. Disabling Handoff mitigates this risk. SFRID: FMT_SMF.1.1 #47

V-268029 in V2R4

Discussion

iPhone widgets on Mac use Handoff. Handoff permits a user of an iPhone and iPad to transition user activities from one device to another. Handoff passes sufficient information between the devices to describe the activity, but app data synchronization associated with the activity is handled though iCloud, which should be disabled on a compliant iPhone and iPad. If a user associates both DODDoW and personal devices to the same Apple ID, the user may improperly reveal information about the nature of the user's activities on an unprotected device. Disabling Handoff mitigates this risk. SFRID: FMT_SMF.1.1 #47

V-268030 in V2R4

Discussion

When a user is allowed to use AirPlay without a password, it may mistakenly associate the iPhone and iPad with an AirPlay-enabled device other than the one intended (i.e., by choosing the wrong one from the AirPlay list displayed). This creates the potential for someone in control of a mistakenly associated device to obtain DODDoW sensitive information without authorization. Requiring a password before such an association mitigates this risk. Passwords do not require any administration and are not required to comply with any complexity requirements. SFRID: FMT_SMF.1.1 #40

V-268031 in V2R4

Discussion

MailDrop allows users to send large attachments (up to 5 GB) via iCloud. Storing data with a non-DODDoW cloud provider may leave the data vulnerable to breach. Disabling non-DODDoW cloud services mitigates this risk. SFRID: FMT_SMF.1.1 #47

V-268033 in V2R4

Discussion

AirDrop is a way to send contact information or photos to other users with AirDrop enabled. This feature enables a possible attack vector for adversaries to exploit. Once the attacker has gained access to the information broadcast by this feature, the attacker may distribute this sensitive information very quickly and without DODDoW's control or awareness. By disabling this feature, the risk of mass data exfiltration will be mitigated. Note: If the site uses Apple's optional Automatic Device Enrollment, this control is available as a supervised MDM control. SFRID: FMT_SMF.1.1 #47

V-268037 in V2R4

Discussion

Apple's Family Sharing service allows Apple iOS/iPadOS users to create a Family Group whose members have several shared capabilities, including the ability to lock, wipe, play a sound on, or locate the iPhone and iPads of other members. Each member of the group must be invited to the group and accept that invitation. A DODDoW user's iPhone and iPad may be inadvertently or maliciously wiped by another member of the Family Group. This poses a risk that the user could be without a mobile device for a period of time or lose sensitive information that has not been backed up to other storage media. Configuring iPhone and iPads so their associated Apple IDs are not members of Family Groups mitigates this risk. Note: If the site uses Apple's optional Automatic Device Enrollment, this control is available as a supervised MDM control. SFRID: FMT_SMF.1.1 #47

V-268038 in V2R4

Discussion

Sharing of location data is an operational security (OPSEC) risk because it potentially allows an adversary to determine a DODDoW user's location, movements, and patterns in those movements over time. An adversary could use this information to target the user or gather intelligence on the user's likely activities. Using commercial cloud services to store and handle location data could leave the data vulnerable to breach, particularly by sophisticated adversaries. Disabling the use of such services mitigates this risk. SFRID: FMT_SMF.1.1 #47

V-268039 in V2R4

Discussion

Because Apple Watch is a personal device, it is key that any sensitive DODDoW data displayed on the Apple Watch cannot be viewed when the watch is not in the immediate possession of the user. This control ensures the Apple Watch screen locks when the user takes the watch off, thereby protecting sensitive DODDoW data from possible exposure. SFRID: FMT_SMF.1.1 #47

V-268040 in V2R4

Fix text

Have all iPhone and iPad users complete training on the following topics. Users must acknowledge receipt of training via a signed User Agreement or similar written record. Training topics: - Operational security concerns introduced by unmanaged applications, including applications using global positioning system (GPS) tracking. - Must ensure no DODDoW data is saved in an unmanaged app or transmitted from a personal app (for example, from personal email). - If the Purebred key management app is used, users are responsible for maintaining positive control of their credentialed device at all times. The DODDoW PKI certificate policy requires subscribers to maintain positive control of the devices that contain private keys and report any loss of control so the credentials can be revoked. Upon device retirement, turn in, or reassignment, ensure a factory data reset is performed prior to device handoff. Follow mobility service provider decommissioning procedures as applicable. - How to configure the following UBE controls (users must configure the control) and other controls on the iPhone and iPad: **Remove Family Sharing. **Disable Shared Location. **Disable Wi-Fi Assist. **Use AirPrint only with AO-approved printers and print servers (see the Multifunction Device and Network Printers STIG for requirements). **Turn off "Apps" under "Automatic Downloads" in the "iTunes & App Store" section of the Settings app on the iPhone and iPad. **Secure use of Calendar Alarm. **Do not configure a DODDoW network (work) VPN profile on any third-party unmanaged VPN app. **Disable iPhone and iPad radios using controls under "Settings" instead of "Control Center". - AO guidance on acceptable use and restrictions, if any, on downloading and installing personal apps and data (music, photos, etc.).

Discussion

The security posture on iOS devices requires the device user to configure several required policy rules on their device. User-Based Enforcement (UBE) is required for these controls. In addition, if the authorizing official (AO) has approved users' full access to the Apple App Store, users must receive training on risks. If a user is not aware of their responsibilities and does not comply with UBE requirements, the security posture of the iOS mobile device and DODDoW sensitive data may become compromised. SFRID: NA

V-268041 in V2R4

Check text

Review configuration settings to confirm a managed photos app is installed on the iOS device. This check procedure is performed on the iPhone and iPad. On the iPhone and iPad: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the DODDoW Configuration Profile from the Apple iOS/iPadOS management tool. 5. Tap "Apps". 6. Verify a photo capture and management app is listed. If a managed photo capture and management app is not installed on the iPhone and iPad, this is a finding.

V-268042 in V2R4

Discussion

Managed apps have been approved for the handling of DODDoW sensitive information. Unmanaged apps are provided for productivity and morale purposes but are not approved to handle DODDoW sensitive information. Examples of unmanaged apps include those for news services, travel guides, maps, and social networking. If a document were to be viewed in a managed app and the user had the ability to open this same document in an unmanaged app, this could lead to the compromise of sensitive DODDoW data. In some cases, the unmanaged apps are connected to cloud backup or social networks that would permit dissemination of DODDoW sensitive information to unauthorized individuals. Not allowing data to be opened within unmanaged apps mitigates the risk of compromising sensitive data. SFRID: FMT_SMF.1.1 #42, FDP_ACF_EXT.1.2

V-268045 in V2R4

Discussion

Managed apps have been approved for the handling of DODDoW sensitive information. Unmanaged apps are provided for productivity and morale purposes but are not approved to handle DODDoW sensitive information. Examples of unmanaged apps include those for news services, travel guides, maps, and social networking. If a document were to be viewed in a managed app and the user had the ability to open this same document in an unmanaged app, this could lead to the compromise of sensitive DODDoW data. In some cases, the unmanaged apps are connected to cloud backup or social networks that would permit dissemination of DODDoW sensitive information to unauthorized individuals. Not allowing data to be opened within unmanaged apps mitigates the risk of compromising sensitive data. SFRID: FMT_SMF.1.1 #42, FDP_ACF_EXT.1.2

V-268046 in V2R4

Discussion

AirDrop is a way to send contact information or photos to other users with this same feature enabled. This feature enables a possible attack vector for adversaries to exploit. Once the attacker has gained access to the information broadcast by this feature, the attacker may distribute this sensitive information very quickly and without DODDoW's control or awareness. By disabling this feature, the risk of mass data exfiltration will be mitigated. Note: If the site uses Apple's optional Automatic Device Enrollment, this control is available as a supervised MDM control. SFRID: FMT_SMF.1.1 #47

V-268047 in V2R4

Discussion

Sensitive DODoW information could be exposed if an unauthorized Apple Watch is paired to a DODoW iPhone. SFRID: FMT_SMF.1.1 #47

V-268048 in V2R4

Check text

Determine if the site AO has approved the use of Apple Watch with DODDoW-owned iPhones. Look for a document showing approval. If not approved, this requirement is not applicable. If approved, verify on the MDM server that the Apple Watch is being managed by the MDM. Have the MDM system administrator show that the Apple Watch is being managed by the MDM. If the AO has approved pairing an Apple Watch with a DODDoW-owned iPhone and the Apple Watch is not being managed by the site MDM server, this is a finding. Note: The iPhone paired to the Apple Watch must be supervised for the MDM to manage the Apple Watch.

Fix text

If the AO has not approved the use of Apple Watch with DODDoW-owned iPhones, this requirement is not applicable. If the AO has approved the use of Apple Watch with DODDoW-owned iPhones, enroll the Apple Watch in MDM management. Note: The iPhone paired to the Apple Watch must be supervised for the MDM to manage the Apple Watch.

Discussion

Authorizing official (AO) approval is required before an Apple Watch (DODDoW-owned or personally owned) can be paired with a DODDoW-owned iPhone to ensure the AO has evaluated the risk in having sensitive DODDoW data transferred to and stored on an Apple Watch in their operational environment. SFRID: FMT_SMF.1.1 #47

V-268049 in V2R4

Discussion

This control allows Apple device users to request passwords from nearby devices. This could lead to a compromise of the device password with an unauthorized person or device. DODDoW Apple device passwords must not be shared. SFRID: FMT_SMF.1.1 #47

V-268051 in V2R4

Discussion

This control allows one Apple device to be notified to share its password with a nearby device. This could lead to a compromise of the device password with an unauthorized person or device. DODDoW Apple device passwords must not be shared. SFRID: FMT_SMF.1.1 #47

V-268052 in V2R4

Discussion

This control allows sharing passwords between Apple devices using AirDrop. This could lead to a compromise of the device password with an unauthorized person or device. DODDoW Apple device passwords must not be shared. SFRID: FMT_SMF.1.1 #47

V-268053 in V2R4

Discussion

This control does not share a DODDoW user's location but encourages location sharing between DODDoW mobile device users, which can lead to operational security (OPSEC) risks. Sharing the location of a DODDoW mobile device is a violation of AIOS-17-011700. SFRID: FMT_SMF.1.1 #47

V-268054 in V2R4

Check text

Review configuration settings to confirm site-managed iOS/iPadOS devices are supervised. This check procedure is performed on both the Apple iOS/iPadOS management tool and the iPhone and iPad. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify all managed Apple devices are supervised (verification procedure will vary by MDM product). Note: If the Apple device is not managed by an MDM and supervision is set up via Apple Configurator, this procedure is not applicable. On the iPhone and iPad: 1. Open the Settings app. 2. Verify a message similar to the following appears on the screen: "This iPad is supervised by (name of site DODDoW mobile service provider)." If site-managed iOS/iPadOS devices are not supervised, this is a finding.

Fix text

Use one of the following methods to supervise iOS and iPadOS devices managed by the DODDoW mobile service provider. Method 1: - Register all current and new iOS and iPadOS devices in the DODDoW mobile service provider's Automated Device Management/Apple Business Manager (ABM) account. - Enable supervision of managed iOS/iPadOS devices in the MDM. Method 2: - Configure each iOS/iPadOS device using the Apple Configurator tool for Supervision. - This method is usually only appropriate when MDM management of the DODDoW Apple device is not appropriate or an older device cannot be registered in ABM.

Discussion

When an iOS/iPadOS is not supervised, the DODDoW mobile service provider cannot control when new iOS/iPadOS updates are installed on site-managed devices. Most updates should be installed immediately to mitigate new security vulnerabilities, while some sites need to test each update prior to installation to ensure critical missions are not adversely impacted by the update. Several password and data protection controls can be implemented only when an Apple device is supervised. SFRID: FMT_SMF.1.1 #47

V-268055 in V2R4

Title

Apple iOS/iPadOS 18 must disable "Allow USB drive access in Files app" if the authorizing official (AO) has not approved the use of DODDoW-approved USB storage drives with iOS/iPadOS devices.

Discussion

Unauthorized use of USB storage drives could lead to the introduction of malware or unauthorized software into the DODDoW IT infrastructure and compromise of sensitive DODDoW information and systems. SFRID: FMT_SMF.1.1 #47

V-268056 in V2R4

Fix text

Install a configuration profile to disable sending diagnostic data to an organization other than DODoW.

Discussion

Many software systems automatically send diagnostic data to the manufacturer or a third-party. This data enables the developers to understand real-world field behavior and improve the product based on that information. Unfortunately, it can also reveal information about what DODDoW users are doing with the systems and what causes them to fail. An adversary embedded within the software development team or elsewhere could use the information acquired to breach mobile operating system security. Disabling automatic transfer of such information mitigates this risk. SFRID: FMT_SMF.1.1 #47a

V-268057 in V2R4

Title

Apple iOS must implement the management setting: not allow a user to remove Apple iOS configuration profiles that enforce DODoW security requirements.

V-268058 in V2R4

Discussion

Allowing network drive access by the Files app could lead to the introduction of malware or unauthorized software into the DODDoW IT infrastructure and compromise of sensitive DODDoW information and systems. SFRID: FMT_SMF.1.1 #47

V-268059 in V2R4

Discussion

If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DODDoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DODDoW sensitive information. Dictation information could contain sensitive DODDoW information; therefore, should not leave the DODDoW control. SFRID: FMT_SMF.1.1 #47

V-268060 in V2R4

Discussion

If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DODDoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DODDoW sensitive information. Translation information could contain sensitive DODDoW information and therefore should not leave the DODDoW control. SFRID: FMT_SMF.1.1 #47

V-268061 in V2R4

Discussion

If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DODDoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DODDoW sensitive information. SFRID: FMT_SMF.1.1 #47

V-268062 in V2R4

Title

Apple iOS/iPadOS 18 must have DODoW root and intermediate PKI certificates installed.

Check text

Verify DODDoW intermediate and root certificates have been installed on Apple devices. In the iOS management tool, verify the DODDoW intermediate and root certificates are installed on the Apple device. On the iPhone and iPad device: 1. Open the Settings app. 2. Tap "General". 3. Tap "VPN & Device Management". 4. Tap the Configuration Profile from the iOS management tool containing the restrictions policy. 5. Tap "Restrictions". 6. Tap "More Details". 7. Verify the DODDoW intermediate and root certificates are listed. If DODDoW intermediate and root certificates are not installed on the Apple device, this is a finding.

Fix text

Install DODoW intermediate and root certificates on managed mobile devices using the MDM.

Discussion

DODDoW root and intermediate PKI certificates are used to verify the authenticity of PKI certificates of users and web services. If the user is allowed to remove root and intermediate certificates, the user could allow an adversary to falsely sign a certificate in such a way that it could not be detected. Restricting the ability to remove DODDoW root and intermediate PKI certificates to the administrator mitigates this risk. SFRID: FMT_MOF_EXT.1.2 #47

V-268063 in V2R4

Check text

Determine if the site AO has approved the use of Apple Watch with DODDoW-owned iPhones. Look for a document showing approval. If not approved, review configuration settings to confirm "Allow Auto Unlock" is disabled. If approved, this requirement is not applicable. This check procedure is performed on the device management tool. Note: If an organization has multiple configuration profiles, the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the iOS management tool, verify "Allow auto unlock" is not checked. If Allow auto unlock is enabled, this is a finding. This requirement will become "Supervised only" in a future iOS/iPadOS release.

Fix text

If the AO has not approved the use of Apple Watch with DODDoW-owned iPhones, configure the Apple iOS configuration profile to disable "Allow auto unlock". The procedure for implementing this control will vary depending on the MDM/EMM used by the mobile service provider. In the MDM console, set "Allow auto unlock" to "False". This requirement will become "Supervised only" in a future iOS/iPadOS release.

Discussion

Auto Unlock allows an Apple Watch to automatically unlock an iPhone or Mac when in close proximity (not available for iPad). This feature allows the iPhone/Mac to be unlocked without the user entering the device passcode, which may lead to unauthorized users access to the iPhone/Mac and sensitive DODDoW data. This control is not applicable if the authorizing official (AO) has approved the use of Apple Watches. SFRID: FMT_MOF_EXT.1.2 #47

V-268064 in V2R4

Discussion

Forcing all applications to be installed from authorized application repositories can prevent unauthorized and malicious applications from being installed and executed on mobile devices. Allowing such installations and executions could cause a compromise of DODDoW data accessible by these unauthorized/malicious applications. SFRID: FMT_MOF_EXT.1.2 #47

V-268065 in V2R4

Discussion

Forcing all applications to be installed from authorized application repositories can prevent unauthorized and malicious applications from being installed and executed on mobile devices. Allowing such installations and executions could cause a compromise of DODDoW data accessible by these unauthorized/malicious applications. SFRID: FMT_MOF_EXT.1.2 #47

V-268066 in V2R4

Discussion

An eSIM may contain sensitive DODDoW data and must be wiped of data when the mobile device is wiped to protect sensitive data from exposure. SFRID: FMT_MOF_EXT.1.2 #47

V-268067 in V2R4

Discussion

The ChatGPT feature of Apple Intelligence allows DODDoW information to be downloaded from the DODDoW iPhone/iPad and processed by the ChatGPT application in the cloud. The ChatGPT feature of Apple Intelligence increases the risk of compromise of sensitive DODDoW information. SFRID: FMT_MOF_EXT.1.2 #47

V-268068 in V2R4

Discussion

Beta operating system updates may contain features that could lead to the compromise of sensitive DODDoW information or provide a vector for the attack on the DODDoW network. The current STIG will not normally provide controls to disable these unsecure features.

V-269568 in V2R4

Discussion

Hidden apps cannot be seen by enterprise management applications (e.g., MDM server), and therefore, unauthorized apps or apps with embedded malware could be installed and hidden from the MDM or mobile threat detection (MTD) apps. Hidden apps may lead to the compromise of sensitive DODDoW data or provide a vector to attacks on the DODDoW network. FMT_MOF_EXT.1.2 #47

V-272169 in V2R4

Discussion

Cell phone recordings are saved as unmanaged recordings in the Notes app, which may be accessible to unmanaged apps. There is a risk that sensitive DODDoW information can be recorded from a cell phone call, saved in Notes, and be accessible to an unmanaged App, which may expose sensitive DODDoW information. SFRID: FMT_MOF_EXT.1.2 #47

V-272170 in V2R4

Discussion

iPhone Mirroring allows managed data on a DODDoW iPhone to be manipulated by an unmanaged Mac. In certain situations, this may lead to the exposure of sensitive DODDoW data like notifications, messages, photos, etc. SFRID: FMT_MOF_EXT.1.2 #47

V-272171 in V2R4

Title

DODoW Apple iOS/iPadOS 18 devices must disable FaceTime.

V-276196 in V2R4

Title

DODoW Apple iOS/iPadOS 18 devices must disable eSIM transfers.

Fix text

Install a configuration profile to disable the transfer of an eSIM from one DODDoW phone to another unless the service has been approved by the AO. This a supervised-only control.

Discussion

eSIM transfers could lead to the unauthorized use of DODoW paid cellular service.

V-276197 in V2R4

Title

DODoW Apple iOS/iPadOS 18 devices must disable screenshots and screen recordings.

Discussion

A screenshot or screen recording of sensitive DODoW information could lead to the inadvertent exposure of that information.

V-276198 in V2R4

Discussion

This feature must be disabled to comply with DODDoW electronic records retention requirements for mobile devices. Otherwise, mobile device users could wipe the device, which would violate DODDoW policy. SFR ID: FMT_MOF_EXT.1.2 #47

V-276199 in V2R4

Discussion

The automatic download of apps to a DODDoW mobile device could cause the exposure of sensitive DODDoW information when an unauthorized app is installed. SFR ID: FMT_MOF_EXT.1.2 #47

V-276203 in V2R4

Discussion

The connection of a DODoW iPhone to a Mac or PC could cause the exposure of sensitive DODoW information. SFR ID: FMT_MOF_EXT.1.2 #47

V-276204 in V2R4

Discussion

AirPrint allows the printing of sensitive DODDoW documents to non-DODDoW controlled printers, which may lead to the exposure of sensitive DODDoW information. SFR ID: FMT_MOF_EXT.1.2 #47

V-276205 in V2R4

Discussion

AirPrint allows the printing of sensitive DODDoW documents to non-DODDoW controlled printers, which may lead to the exposure of sensitive DODDoW information. SFR ID: FMT_MOF_EXT.1.2 #47

V-276206 in V2R4

Discussion

AirPrint allows the printing of sensitive DODDoW documents to non-DODDoW controlled printers, which may lead to the exposure of sensitive DODDoW information. SFR ID: FMT_MOF_EXT.1.2 #47

V-276207 in V2R4

Discussion

AirPrint allows the printing of sensitive DODDoW documents to non-DODDoW controlled printers, which may lead to the exposure of sensitive DODDoW information. SFR ID: FMT_MOF_EXT.1.2 #47

V-276208 in V2R4

Discussion

The security of the Apple Intelligence system has not been vetted by the DODDoW, and the risk to DODDoW sensitive information is not known at this time. Therefore, Apple intelligence features must be disabled until more information is available. SFR ID: FMT_MOF_EXT.1.2 #47

V-276211 in V2R4

Discussion

The security of the Apple Intelligence system has not been vetted by the DODDoW, and the risk to DODDoW sensitive information is not known at this time. Therefore, Apple intelligence features must be disabled until more information is available. SFR ID: FMT_MOF_EXT.1.2 #47

V-276212 in V2R4

Discussion

The security of the Apple Intelligence system has not been vetted by the DODDoW, and the risk to DODDoW sensitive information is not known at this time. Therefore, Apple intelligence features must be disabled until more information is available. SFR ID: FMT_MOF_EXT.1.2 #47

V-276213 in V2R4

Title

DODoW Apple iOS/iPadOS 18 devices must have a Mobile Threat Detection (MTD) app installed.

Discussion

DODDoW mobile devices are at constant risk of cyber threats. MTD apps mitigate these risks by providing real-time threat detection, malware prevention, and vulnerability analysis. SFR ID: FMT_MOF_EXT.1.2 #47

V-276214 in V2R4

Discussion

Authorizing Official (AO) approval is required before the Apple device camera can be enabled for a specific user or group of users, based on a risk assessment of the operational environment. Camera use may lead to the exposure of sensitive DODDoW information in some operational environments. SFR ID: FMT_MOF_EXT.1.2 #47

V-276224 in V2R4