iOS Hardening Configuration Guide - DSD

The fireewall
rules aapplied
to th he devices, APN subne et, and VPN N subnet, ass
well as the e EAS,
MDM seerver
in thee
DMZ, shou uld allow acccess
to the e APNS for these t servicces
to work k.
Data RRoaming
Data rooaming
geneerally
refers s to a process
by which h a device from
a speccific
carrier’s s
networkk
can take aadvantage
of o the data sservice
on a different carrier. c For eexample
a device
with a SSIM
from ann
Australian carrier, being
used in the US on a US carrieer’s
network k and
taking aadvantage
oof
the carrie er’s data infrrastructure.
Note that roaming r neeed
not be
internattional;
in some
countrie es carriers wwith
differen nt coverage e areas mayy
allow some
data
roamingg
to avoid innfrastructure
e duplicatioon.
There aare
two main
risks asso ociated withh
data roam ming:
�
�
When roamming
interna ationally, theere
are both h implied an nd actual lowwer
levels of o trust
with the levvel
of eaves sdropping and
traffic an nalysis occu urring on thee
foreign ne etwork.
As soon ass
traffic goes s internationnal,
it is ofte en not subje ect to privaccy
and cons sumer
protection rrequirements
in the same
way as purely dom mestic commmunications
in the
host countrry.
It is incorrect
to assume
that rig ghts protect ting individuual’s
privacy y are
uniform inteernationally
y.
If data roamming
is switc ched off forr
cost mana agement, the en the devicce
is “off the e grid”
for manageement
and monitoring m cconsoles
su uch as EAS,
MDM conssoles,
or
MobileMe’ss
“Find My iPhone”.
In some cases s, private da ata APN caan
be preserved
across international
bo oundaries bbecause
of commercial
c arrangemeents
betwee en
carriers - noote
that dat ta costs cann
still be hig gh.
8 | Defence S ignals
Directo
rate