3.2.1.6 Ensure 'Allow iCloud Keychain' is set to 'Disabled'

Information

This recommendation pertains to iCloud performing Keychain synchronization.

Rationale:

It is normal and expected for end-users to enter their personal iCloud credentials onto institutionally owned devices. Because of this, iCloud Keychain presents an unnecessary risk to credentials because they may be shared onto Jailbroken or otherwise compromised devices.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

1. Open Apple Configurator.
2. Open the Configuration Profile.
3. In the left windowpane, click on the 'Restrictions' tab.
4. In the right windowpane, under the tab 'Functionality', 'uncheck' the checkbox for 'Allow iCloud Keychain'.
5. Deploy the Configuration Profile.

Impact:

None.

See Also

https://workbench.cisecurity.org/files/1688