Detections
Analytics

2.1.1.1 Audit iCloud Passwords & Keychain

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The iCloud Passwords & Keychain is Apple's synchronization service that works with Apple Accounts to synchronize password, passkey, and credit card information across macOS, iOS, iPadOS. The capability allows users to use synced password, passkey, and credit card information in either macOS, iOS, or iPadOS for use in Safari and other applications.

The password, passkey, and credit card information stored in a macOS keychain on an Enterprise-managed computer is stored in Apple's cloud.

When using personal Apple Accounts, credentials and payment information may include both enterprise-related and personal data, depending on user behavior and account usage patterns.

Ensure that iCloud Passwords and Keychain usage aligns with organizational requirements, taking into account whether personal or managed Apple Accounts are being utilized.

Solution

Profile Method:

Create or edit a configuration profile with the following information:

 - The PayloadType string is com.apple.applicationaccess
 - The key to include is allowCloudKeychainSync
 - The key should be set <true/>, to allow iCloud Passwords & Keychain syncing, or <false/>, to disable it, based on your organization's requirements

Impact:

When iCloud Passwords & Keychain is turned off, password, passkey, and credit card information are no longer synchronized across devices signed in with the same Apple Account. Passwords, passkeys, and credit card information can still be stored locally in the Passwords and Keychain apps, even when iCloud Passwords & Keychain is turned off.

See Also

https://workbench.cisecurity.org/benchmarks/23040

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

References: 800-53|AC-20(1), 800-53|AC-20(2), 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|5.1, CSCv7|9.2

Plugin: Unix

Control ID: 5b4e4a32ebf5af6e7ca25b5483dfff8856005dbc3ee6ecbc1ad503ebfdf646d0