iOS Hardening Configuration Guide - DSD

Chapter Four
Suggested Policies
This chapter lists suggested policies in graduated levels of response, applied to iOS
devices at varying security classifications. The agency’s Information Technology
Security Advisor should be consulted for the specific usage scenarios for a
deployment.
Note: at the time of writing, iOS devices implement DSD Approved Cryptographic Algorithms
and Protocols (and the implementations have been submitted for FIPS-140-2 certification),
but have not yet completed a DSD Cryptographic Evaluation (DCE) conducted by DSD.
In the absence of a DCE, use with PROTECTED and/or RESTRICTED content would
require the agency head and accreditation authority, (typically an SES level staff member
tasked with CISO responsibilities) to provide a dispensation for use. The ISM and agency
security policy should be consulted directly for risk assessment and mitigation procedures in
such use-cases.
If iOS devices are being considered for use at classifications above RESTRICTED/
PROTECTED, agencies must undertake a risk assessment following the guidance in the
ISM as well as their own agency security policies and determine mitigation procedures and
policy. Agencies must also obtain any dispensations as required by the ISM.
Feature Unclassified XX-in-Confidence Restricted/Protected
Hardware Crypto
iOS Devices
Agency’s Decision Recommended Must
BYOD ( Bring Your
Own Device )
Passcode
iTunes Account
Sync to
Content/Sync to
iTunes Account.
Agency’s Decision May be possible
(MDM opt-in for AUP
agreement and
enforcement
recommended).
See ISM section on
Mobile Devices
Must Must Must
May be possible.
(MDM opt-in for AUP
agreement and
enforcement
recommended)
See ISM section on
Mobile Devices.
Personal or Agency Personal or Agency Personal or Agency
Yes, if Personal
iTunes
Generally no Generally no
22 | D efence Signals Directorate