3.2.1.17 Ensure 'Allow USB accessories while the device is locked' is set to 'Disabled'

Information

This recommendation pertains to allowing USB devices to communicate with a locked device.

Rationale:

Physical attacks against iOS and iPadOS devices have been developed that exploit the trust of physically connected accessories. This has lead to proof of concept data extraction and even commercially available hardware to perform the attacks. By requiring the device to be unlocked to remove data, this control reduces the probability of a successful data extraction.

Impact:

An end-user will not be able to connect their device to a USB accessory while the device is locked.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Open Apple Configurator.

Open the Configuration Profile.

In the left windowpane, click on the Restrictions tab.

In the right windowpane, under the tab Functionality, uncheck the checkbox for Allow USB accessories while the device is locked.

Deploy the Configuration Profile.

See Also

https://workbench.cisecurity.org/files/3064