iOS Hardening Configuration Guide - DSD

More documents

Recommendations

Info

� A device, typically on receipt of a push notification, contacts the MDM server in an SSL encrypted session, and exchanges information using XML. This may be a simple query/response transaction, or it may lead to the device pulling content down from a location the MDM server told it to, such as a configuration profile or provisioning profiles. � The MDM vendor may also have a client app that can interact with the MDM server. Such Apps can interact in proprietary ways beyond the functionality that the MDM XML interface allows for. Such Apps do not operate at any elevated level of privilege, and if available on the App store, are subject to normal App Store approval processes, but can enhance the functionality and the user experience. Note that an MDM server cannot install native apps remotely without user intervention. Web apps can be deployed without user intervention by pushing a web clip to the device. Usually remote app installation occurs in one of 3 ways: � The MDM server can silently install or remove 6 provisioning profiles to enable or disable an application from running on a device. The application binary still needs to be downloaded to the device by some means. Enterprise Apps can either have a provisioning profile external to the App, so it can be installed/removed, typically via MDM, or have the provisioning profile embedded within the App itself, which means downloading the App bundle is sufficient for it to run (if present, the Provisioning Profile is copied from the App bundle, by the installer, and installed when the App is installed). � The MDM server can silently install or remove 7 a configuration profile that contains a web clip. If the web clip points to an appropriately constructed web site, touching on it will download an Enterprise <strong>iOS</strong> application to the device. The Web clip can also be the URL for a Web app, in which case it is usable immediately. � The MDM solution may also, either via a native app or a web app, provide a list of approved, or recommended App store apps, and Enterprise In-House Apps, that when touched by a user, will open the App Store or Web server on the device for the user to download or purchase. 6 MDM can only remove profiles that are installed via MDM. 7 See above. 31 | D efence Signals Directorate
Example of approved or re ecommendded applica ations lists s. MobileIroon shown on o top left, , Sybase AAfaria show wn on top ri ight. Airwatch Mobile Devvice Manag gement We eb Consolee 32 | Defence S ignals Directo rate
Page 1 and 2: iOS Hardening Configuration Guide F
Page 3 and 4: Audience This guide is for users an
Page 5 and 6: Using this Guide The following list
Page 7 and 8: Chappter Onne Introoductioon to Mob
Page 9 and 10: The fireewall rules aapplied to th
Page 11 and 12: ensured, due to both ‘Man-in-the-
Page 13 and 14: Question Comments/Selection Does my
Page 15 and 16: Chapter Two Installing iOS 4 This c
Page 17 and 18: Chappter Thhree Secuurity Feeatures
Page 19 and 20: Find My iPhone user interface Gener
Page 21 and 22: Conteent Filterinng Access to intra
Page 23 and 24: Chapter Four Suggested Policies Thi
Page 25 and 26: Feature Unclassified XX-in-Confiden
Page 27 and 28: � � � Passcode (can be set vi
Page 29 and 30: VPN � IPSec and SSL are DSD Appro
Page 31: Chapter Six Mobile Device Managemen
Page 35 and 36: Task Comments Provide staff with tr
Page 37 and 38: Appendix B Configuration Profiles F
Page 39 and 40: Appendix C Sample Scripts This appe
Page 41 and 42: make new VPN payload with propertie
Page 43 and 44: Appendix E Risk Management Guide Th
Page 45 and 46: Firewall Risk Mitigations Implied P

iOS Hardening Configuration Guide - DSD

Create successful ePaper yourself

Delete template?

Save as template?