Detections
Analytics
AIOS-14-009800 - Apple iOS/iPadOS must implement the management setting: not allow messages in an ActiveSync Exchange account to be forwarded or moved to other accounts in the Apple iOS/iPadOS Mail app.
Information
The Apple iOS/iPadOS Mail app can be configured to support multiple email accounts concurrently. These email accounts are likely to involve content of varying degrees of sensitivity (e.g., both personal and enterprise messages). To prevent the unauthorized and undetected forwarding or moving of messages from one account to another, Mail ActiveSync Exchange accounts can be configured to block such behavior. While users may still send a message from the Exchange account to another account, these transactions must involve an Exchange server, enabling audit records of the transaction, filtering of mail content, and subsequent forensic analysis.SFR ID: FMT_SMF_EXT.1.1 #47
Solution
Install a configuration profile to prevent Exchange messages from being moved or forwarded between email accounts.See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apple_iOS_iPadOS_14_V1R3_STIG.zip
Item Details
Audit Name: MobileIron - DISA Apple iOS/iPadOS 14 v1r3
Category: CONFIGURATION MANAGEMENT, IDENTIFICATION AND AUTHENTICATION
References: 800-53|CM-6(1), 800-53|CM-6b., 800-53|IA-2, CAT|II, CCI|CCI-000366, CCI|CCI-000370, CCI|CCI-000764, Rule-ID|SV-228760r561031_rule, STIG-ID|AIOS-14-009800, Vuln-ID|V-228760
Plugin: MDM
Control ID: 981d4ca82c1480123638b8f7fadaf1e62f71c19244333662c6805b276178b88d