Title

Apple iOS must lock the display after 15 minutes (or less) of inactivity. (Cat II impact)

Discussion

The screen lock timeout must be set to a value that helps protect the device from unauthorized access. Having a too-long timeout would increase the window of opportunity for adversaries who gain physical access to the mobile device through loss, theft, etc. Such devices are much more likely to be in an unlocked state when acquired by an adversary, thus granting immediate access to the data on the mobile device. The maximum timeout period of 15 minutes has been selected to balance functionality and security; shorter timeout periods may be appropriate depending on the risks posed to the mobile device. SFR ID: FMT_SMF_EXT.1.1 #01b

Check Content

Review configuration settings to confirm the screen lock time-out set to 15 minutes or fewer. This check procedure is performed on both the Apple iOS management tool and the Apple iOS device. Note: If an organization has multiple configuration profiles, then the check procedure must be performed on the relevant configuration profiles applicable to the scope of the review. In the management tool, verify the sum of the values assigned to "Maximum Auto-Lock time" and "Grace period for device lock" value is between 1 and 15 minutes. Alternatively, locate the text "<key>maxGracePeriod</key>" and "<key>maxInactivity</key>" and ensure the sum of their integer value is between 1 and 15 in the configuration profile (.mobileconfig file). For example: "<key>maxGracePeriod</key> <integer>5</integer> <key>maxInactivity</key> <integer>5</integer>" Here, 5 + 5 = 10; this meets the requirement. On the iOS device: 1. Open Settings app. 2. Tap "General". 3. Record the value displayed for "Auto-Lock". 4. Go back to the Setting app main menu. 5. Tap "Touch ID & Passcode" or "Passcode". 6. Enter current device passcode and tap "Done". 7. Record the value displayed for "Require Passcode" (Record 0 if the setting is "Immediately". 8. Verify the sum of the two recorded values is between 1 and 15 minutes. Note: On some iOS devices, it is not possible to have a sum of exactly 15. In these cases, the sum must be less than 15. A sum of 16 does not meet the requirement. If the sum of the "Auto-Lock" and "Require Passcode" is not between 1 and 15 minutes in the iOS management tool, if the sum of the values assigned to "<key>maxGracePeriod</key>" and "<key>maxInactivity</key>" is not between 1 and 15 minutes in the configuration profile, or if the sum of the values assigned to "Auto-Lock" and "Require Passcode" is not between 1 and 15 minutes, this is a finding.

Fix Text

Install a Configuration Profile to lock the device display after 15 minutes (or fewer) of inactivity. This is done by setting "Maximum Auto-Lock time" and "Grace Period for device lock" so the sum of their values is between 1 and 15 minutes.

Additional Identifiers

Rule ID:

Vulnerability ID: V-61567

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.