Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-25842 | WIR-MOS-iOS-043 | SV-34933r1_rule | DCPR-1 PESP-1 | Medium |
Description |
---|
Strong configuration management of applications on a smartphone is a key malware control. Most smartphones must have individual commercial web portal (e.g., iTunes, Android Market, etc.) accounts and be connected to the commercial App Store to provision the smartphone. A DoD user can jailbreak a smartphone and bypass smartphone application and malware controls. To ensure strong configuration management of the security baseline of the smartphone, all software loading should be done by the SA. |
STIG | Date |
---|---|
Apple iOS 4 (Good Mobility Suite) Interim Security Configuration Guide (ISCG) | 2011-11-07 |
Check Text ( C-32404r1_chk ) |
---|
All smartphone provisioning and updates are under the control of the site device system administrator. Interview the site IAO and iOS device SA. Verify the site has a procedure for initial provisioning and subsequent updates of site managed iOS devices. Review the site procedure and verify it follows the procedures found in the ISCG Overview document (Sections 2.2 & 2.3). Mark as a finding if these procedures are not followed. |
Fix Text (F-28707r1_fix) |
---|
Set up local operating procedures for initial provisioning and subsequent software and application updates according to procedures published in the STIG/ISCG Overview document. |