Detections
Analytics

AIOS-17-013500 - Apple iOS must implement the management setting: not allow a user to remove Apple iOS configuration profiles that enforce DOD security requirements.

Information

Configuration profiles define security policies on Apple iOS devices. If a user is able to remove a configuration profile, the user can then change the configuration that had been enforced by that policy. Relaxing security policies may introduce vulnerabilities the profiles had mitigated. Configuring a profile to never be removed mitigates this risk.

SFR ID: FMT_SMF_EXT.1.1 #47

Solution

Configure the Apple iOS configuration profile so that it can never be removed.

The procedure for implementing this control will vary depending on the MDM/EMM used by the mobile service provider.

When using Apple Configurator, under 'General Security', configure 'Security' to 'Never' and 'Automatically Remove Profile' to 'Never'.

See Also

https://public.cyber.mil/wp-content/uploads/U_Apple_iOS-iPadOS_17_V2R2_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-258370r959010_rule, STIG-ID|AIOS-17-013500, Vuln-ID|V-258370

Plugin: MDM

Control ID: a772445aeac10b8715077df3488bdd0edb80215b71f0df2ce421d5a7ccfd9921