AIOS-12-011900 - Apple iOS must implement the management setting: not share location data through iCloud.

Information

Sharing of location data is an operations security (OPSEC) risk because it potentially allows an adversary to determine a DoD user's location and movements and patterns in those movements over time. An adversary could use this information to target the user or to gather intelligence on the user's likely activities. Using commercial cloud services to store and handle location data could leave the data vulnerable to breach, particularly by sophisticated adversaries. Disabling the use of such services mitigates this risk.

SFR ID: FMT_SMF_EXT.1.1 #47

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

The user must configure Apple iOS to disable location sharing through iCloud.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apple_iOS_12_V2R1_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-8a., CAT|II, CCI|CCI-000048, Rule-ID|SV-237269r642359_rule, STIG-ID|AIOS-12-011900, STIG-Legacy|SV-96547, STIG-Legacy|V-81833, Vuln-ID|V-237269

Plugin: MDM

Control ID: d093d39354385f65b3ba5c4533d902a929299fec9bca12ecf35e231cc9669ac2