UNCLASSIFIED

UNCLASSIFIED

I n

October 2012

Issue No: 1.0

Security Procedures

Apple iOS

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004973

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 1 of 118
UNCLASSIFIED

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Security Procedures

Apple® iOS1

Issue No: 1.0

October 2012

This document is for the purposes of issuing advice to UK Government, public sector 

organisations and/or related organisations. The copying and use of this document for 

any other purpose, such as for training purposes, is not permitted without the prior 

approval of CESG.

The copyright of this document is reserved and vested in the Crown.

Amendment History

Version Date Description

1.0 October 2012 First issue

 1 iOS is a trademark or registered trademark of Cisco in the U.S. and other countries and is 

used by Apple Inc. under license.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004974

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 2 of 118
UNCLASSIFIED

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Intended Readership

This document is intended for System 

Designers, Risk Managers, 

Administrators, Accreditors and those 

involved in the production of Security 

Operating Procedures in UK Public 

Sector organisations which are 

intending to use iOS devices t o 

exchange information with the 

corporate network.

Executive Summary

CESG have produced this document to 

assist organisations in understanding 

the risks associated with deploying iOS 

devices in their networks, and to help 

explain the mitigations which can be 

applied to help manage these risks. If 

followed, this guidance enables iOS to 

be used for sensitive enterprise mobile 

working.

iOS is not a CESG-certified platform or 

solution. There are many ways in 

which this product can be used, and , 

even when following the guidance in 

this document, there exist a number of 

residual risks which could lead to 

information being compromised. Risk 

owners should therefore carefully 

consider the residual risks for iOS 

described in Chapter 11.

However, it is CESG’s opinion 

(provided that the technical and 

procedural guidance contained within 

these Security Procedures is carefully 

followed, and sufficient user education 

and training is in-place) that, in most 

cases, iOS provides sufficient security 

to protect the contents of

RESTRICTED emails and

attachments.

Significant Risk Warnings are 

surrounded by a red border, as shown 

in this paragraph. These warnings are 

explained in more detail at the end of 

Chapter 11.

Aims and Purpose

This document sets out the current best practice and CESG guidance which enable a 

UK Public Sector organisation to make a risk -managed decision around the 

deployment of iOS devices. It provides information on key risks, and corresponding 

controls, which must be carefully considered before use of iOS is perm itted on a UK 

Government system.

This document has been produced following a detailed technical assessment of iOS 

6.0 by CESG, the UK National Technical Authority for Information Assuran ce. It is not 

a replacement for tailored technical or legal advice on specific systems or issues. 

GCHQ/CESG and its advisors accept no liability whatsoever for any expense, liability, 

loss, claim or proceedings arising from reliance placed on this guidance .

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004975

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 3 of 118
UNCLASSIFIED

Page 4

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

THIS PAGE IS INTENTI ONALLY LEFT BLANK

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004976

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 4 of 118
UNCLASSIFIED

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Contents

Chapter 1 – Introduction .................. 7

Introduction................................ ...7

Risk Management......................... 7

Chapter 2 – Scope of Assessment 11

Introduction................................ .11

iOS Software .............................. 12

Mobile Device Management .......13

Chapter 3 – Summary of 

Recommended Actions .................. 15

Recommended Actions ..............15

Chapter 4 – Platform Technical 

Overview................................ ..........17

Introduction................................ .17

Device Encryption....................... 18

Network Security ........................ 19

Device Provisioning, 

Synchronisation and Mobile Device 

Management............................... 21

Third-party Applications ..............22

Custom In-house Applications ....22

Privacy Settings .......................... 23

Apple Services............................ 23

Device Updates and Recovery ...24

Chapter 5 – Deployment Process ..27

Recommended Actions ..............27

Chapter 6 – Recommended 

Architecture ................................ ....29

Introduction................................ .29

Recommended Architecture .......29

Implementation Notes ................. 32

Private APN ................................ 33

VPN Configuration ...................... 34

Certificates and Certificate 

Authorities................................ ...34

Provisioning Terminal ................. 35

Mobile Device Management (MDM)

................................ ................... 35

Management of the Departmental 

Components .............................. 36

Reverse Proxy ........................... 36

Mail Server................................ . 36

Internet Browsing Gateway ........ 37

Apple Network Traffic ................ 37

Chapter 7 – Provisioning and Mobile 

Device Management ...................... 39

Key Principles ............................ 39

Introduction ................................ 39

Apple Configurator ..................... 39

MDM Server Considerations ...... 40

MDM Provisioning...................... 41

Profiles................................ ....... 41

Self Service................................ 42

Restrictions ................................ 43

Chapter 8 – Profile Settings .......... 45

VPN Profile ................................ 45

Passcode ................................ ... 45

Applications ............................... 46

Mail Settings .............................. 47

Browser ................................ ..... 47

Multimedia ................................ . 48

GPS ................................ ........... 48

Camera ................................ ...... 48

Account Control ......................... 49

Chapter 9 – Procedural Controls .. 51

Introduction ................................ 51

Wi-Fi ................................ .......... 51

Bluetooth ................................ ... 52

SIM Card................................ .... 52

Dock Connector ......................... 52

Profile Files ................................ 52

Chapter 10 – System Management

and Maintenance ............................ 55

Asset Management for iOS 

Devices ................................ ...... 55

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004977

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 5 of 118
UNCLASSIFIED

Page 6

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Responding to Mobile Device Loss, 

Theft, or Suspected Compromise

................................ ................... 56

Remote Lock/Wipe ..................... 56

Helpdesk Authentication .............57

Disposal or Reassignment of iOS 

Devices................................ .......57

Maintenance of iOS Devices ......57

Responding to Forgotten 

Passcodes ................................ ..57

User Training and Education ......57

Software Patching ...................... 57

Physical Security ........................ 58

Chapter 11 – Risk Treatment and 

Residual Risks ................................ 59

Introduction................................ .59

Risk Warning .............................. 60

Risk Warnings ............................ 76

iCloud ................................ .........76

Wi-Fi ................................ ...........76

Profiles................................ ........77

Remote Management Policy .......77

Appendix A – Profile Configuration 

Settings ................................ ...........79

Introduction................................ .79

Appendix B – Auditing ................... 85

Introduction................................ .85

Device details ............................. 85

Security................................ .......85

Restrictions ................................ .86

Extended MDM auditing .............86

Appendix C – Example User 

Guidance ................................ ........ 89

User Responsibilities ................. 89

General Guidance...................... 90

Mobile Working .......................... 90

Passwords ................................ . 91

Email and Calendar ................... 92

Telephony................................ .. 92

Mobile Data................................ 92

Applications ............................... 93

Overseas Use ............................ 93

Other................................ .......... 93

Incident Response ..................... 94

Appendix D – Wi-Fi ........................ 97

Supplementary Guidance for Wi -Fi

................................ ................... 97

Risks................................ .......... 97

Best Practice Guidance ............. 98

Network Architecture ............... 100

Other Considerations ............... 103

Appendix E – Third-Party

Applications ................................ . 105

Introduction .............................. 105

Risks................................ ........ 105

Strategies................................ . 106

Mitigations................................ 108

Mitigations for Custom-Developed 

Applications ............................. 108

References ................................ ... 111

Customer Feedback .................... 115

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004978

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 6 of 118
UNCLASSIFIED

Page 7

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Chapter 1 – Introduction

Key Principles

CESG has carried out a risk assessment of the iOS 6.0 platform

An enterprise deployment of iOS consists of recommended network architecture, 

including carrier components, as well as recommended provisioning, 

configuration and management of iOS devices

Introduction

1. CESG have undertaken a range of assurance work on the iOS platform, and 

have achieved a level of confidence commensurate with a foundation grade 

CPA assessment in the built-in data-at-rest and VPN components. When 

configured and used according to this guidance as part of a wider network 

architecture for remote working, iOS can be used to protect sensitive emails and 

attachments.

2. Although the VPN and data -at-rest functionality have been assessed by CESG, 

the nature of iOS means there is a heavy reliance on users to correctly use the 

security features provided, and for enterprises to extend their network 

management, monitoring and security services to their iO S deployments. Failure 

of any of these controls could compromise information security on a device.

3. This document supersedes previously issued guidance on iOS 4 and associated 

Security Procedures (reference [a]) produced from 2011.

Risk Management

4. Risk owners must read and understand t his guidance and associated risks in 

order to make an informed decision about the risks to their information assets 

before an iOS deployment is used to handle protectively marked information.

5. Risk owners and accreditors must also be content that the level of assurance 

which CESG is able to provide in iOS is appropriate for their information assets.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004979

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 7 of 118
UNCLASSIFIED

Page 8

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

6. Any data other than email data stored in the default email app must not be 

protectively marked. This in cludes calendar, contacts, SMS/MMS messages, 

media files, photographs, third -party application data2 and voice calls.

7. CESG has identified a number of risks that need to be treated to secure an 

enterprise deployment of iOS. CESG has assessed the ability of the iOS

platform to treat these risks when deployed in line with good-practice guidance. 

The outcome of the assessment has been used to inform the content of these 

Security Procedures.

8. Application of the recommended technical and procedural controls provid e a 

level of assurance however, significant residual risks will remain. The following 

points, which are discussed in more detail later in this document, highlight the 

key residual risks of an enterprise iOS deployment:

The iOS platform lacks technical cont rols to mitigate several key risks, 

placing a strong reliance on procedural controls to manage the risk s

Data stored locally under Class D encryption (see Chapter 4) can be 

decrypted and accessed using commercial or freely avai lable forensics 

tools, even with all storage encryption features enabled and configured 

correctly

Users control the enterprise VPN connection. If they choose to disable it or 

forget to enable it, the enterprise defence -in-depth mitigations will be

circumvented

The Wi-Fi interface cannot be disabled administratively and can therefore 

be used to circumvent defence-in-depth mitigations

When a device is out of a user’s control there is the potential for the device 

to be exploited via USB using freely available tools accessible to novice 

attackers, resulting in a potentially compromised d evice and data loss

Due to the complex nature of the software exposed to the carrier network, 

new vulnerabilities will be discovered which an attacker could exploit

There is a reliance on vulnerabilities being disclosed and patched promptly 

by the vendor

 2 Unless using Class A storage (see Chapter 4)

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004980

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 8 of 118
UNCLASSIFIED

Page 9

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

9. It is important to understand that such a deployment of iOS consists of more 

than just hardened mobile devices. This document describes the network 

architecture required to support an enterprise deployment of iOS as well as 

recommendations on provisioning, configuration and management of the mobile 

devices. 

10. Technical controls referenced in this document to provide security enforcement 

functionality may not be supported across all deployed configurations. It is the 

responsibility of the organisation to ensure products deployed support the 

required technical controls.

11. Implementers are reminded that additional operational assurance activities, such 

as patching, effective network monitoring and the management of the risks 

posed by malicious code will be expected to be in place to support the initial 

assessment work CESG has conducted.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004981

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 9 of 118
UNCLASSIFIED

Page 10

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

THIS PAGE IS INTENTI ONALLY LEFT BLANK

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004982

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 10 of 118
UNCLASSIFIED

Page 11

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Chapter 2 – Scope of Assessment

Key Principles

CESG has assessed iOS 6.0 on iPhone® 5, iPhone 4S, iPhone 4, iPad® 2, iPad 

3, iPad 4 and iPad mini

CESG will continue to assess new versions of iOS and reissue advice as

necessary

Organisations should determine whether technical controls remain supported 

and appropriate in newer versions of iOS

Organisations should consider the threats posed by new functionality in newer 

versions of iOS which may be released prior to updates to this document

Introduction

12. This document enables organisational risk owners to make informed decisions 

on their business use of iOS based upon:

The inherent risk in deploying iOS devices

The rationale for specific risks

Clear statements on the security capa bilities and limitations of iOS

An understanding of the business impact of deviating from these Security

Procedures

Highlighting of significant residual risk where techn ical controls cannot be 

applied

13. These Security Procedures are intentionally generic; CESG cannot anticipate 

every organisation’s particular network topology, system interconnections, threat 

models or business risks. Experience has shown that a flexible and pragmatic

approach is beneficial when interpreting the guidance for individual 

organisational use.

14. There are some areas of broader security policy where CESG can on ly provide 

generic advice (for example, details on how mobile devices should be acquir ed 

and wider procedural measures such as lost device handling ). This document 

will discuss the extra guidance required, but it is the responsibility of each 

organisation to produce the appropriate document (s) and policies for their users.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004983

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 11 of 118
UNCLASSIFIED

Page 12

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

15. This document only applies where department -owned devices are used to 

connect to departmental infrastructure a s part of a managed deployment. CESG 

strongly recommends personally-owned devices are not used as devices should

be procured from trusted sources.

16. If personally-owned devices are used, the user needs to be made aware that 

they will be handing over full management and control to the department and all

existing data on the device will be wiped. After use, the device s hould be 

disposed of as described in Chapter 10 and not returned to the user.

17. For a fuller discussion of Bring Your Own Device (BYOD), see CESG IA Notice 

2012/07, Bring Your Own Device: The Risks from Personal Devices (see 

reference [b]).

iOS Software

18. CESG has assessed the iOS 6.0 implementation of the security featu res 

discussed in this document. As some of the security-enforcing functions of the 

platform are based in hardware, this document only applies to the following 

devices:

iPhone 5, iPhone 4S, iPhone 4

iPad 2

Third-generation iPad (launched March 2012)

Fourth-generation iPad and iPad mini (launched October 2012) 3

19. CESG will assess new ver sions of Apple products as necessary and update this 

document to ensure it remains relevant. However, CESG does not intend to 

publish updated Security Procedures for every subsequently released version of 

iOS4. 

20. Mobile devices evolve rapidly. When newer versions of iOS are released, 

organisations should determi ne whether the technical controls from this 

document are still supported. If new versions include new features, departments 

 3 As CESG strongly recommends Wi -Fi be disabled, only the 3G/4G iPads should be used in 

conjunction with this guidance. 4 For clarity, CESG expects to revisit this document when major features that affect information 

security in iOS change or are updated, but will not make changes to it for every minor product 

update.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004984

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 12 of 118
UNCLASSIFIED

Page 13

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

should consider the potential risks associated with those new features, prior to 

this advice being updated.

21. CESG advises that newly released software updates from Apple within the same 

major version branch (i.e. 6.x. y) be applied promptly to ensure the benefits of 

security fixes are realised.

22. When new iOS versions are released, it will typically no longer be possible to 

provision or restore devices to the old version. Departments should consider the 

implications of forced updates when planning their deployment schedules.

Mobile Device Management

23. Mobile Device Management (MDM) servers can provide a degree of control over 

mobile devices deployed in an enterprise from a central management console. 

Typically the server will send management commands to a mobile device, which

are subsequently implemented by the client running on a mobile device. 

24. Technical controls may not be suppor ted across all iOS devices and MDM

servers. It is the responsibility of the organisation to ensure that products 

procured support the required technical controls. The base requirements of a

MDM server and further discussion around their usage is contained in Chapter 

7.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004985

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 13 of 118
UNCLASSIFIED

Page 14

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

THIS PAGE IS INTENTI ONALLY LEFT BLANK

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004986

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 14 of 118
UNCLASSIFIED

Page 15

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Chapter 3 – Summary of Recommended Actions

Key Principles

Organisations must carry out several specific actions if they intend to use iOS 

devices to store and process classified information

HMG organisations handling, storing and processing protectively marked 

information must formally assess the risks to their corporate infrastructure from 

the enterprise deployment of iOS devices , and treat the risks by applying 

appropriate technical and non-technical controls from the Baseline Control Set 

contained in the HMG IA Standard No. 1 & 2 Supplement ( IS1 & 2 Supplement), 

Technical Risk Assessment and Risk Treatment (reference [c])

Recommended Actions

25. Organisations should:

Read and understand the material presented in the Platform Technical 

Overview (Chapter 4), seeking further information where there are 

questions

Read and assess the specific residual risks (Chapter 11) and consider 

whether any of them make iOS inappropriate as a business solution in their 

situation

Ensure that the iOS system is installed, configured and managed in 

accordance with these Security Procedu res. In particular, give early and 

careful consideration to the implementation of the network architecture 

guidance. For convenience, a list of installation actions is provided in 

Chapter 5

Review and update remote working or a cceptable use policies as 

necessary to ensure any iOS deployme nt fits within these frameworks

Consider the impact of any deviation from these Security Procedures and 

factor this into their overall ris k assessment for the deployment

Understand where specific technical controls cannot be fully hardened on 

the platform, and the ease with which certain controls can be disabled or 

bypassed by an end user. For more information on these, see Chapter 9

Ensure procedural controls are put in place where specific threats cannot 

be mitigated by technical mitigations alone

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004987

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 15 of 118
UNCLASSIFIED

Page 16

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Provide Security Operating Procedures and gain formal acceptance of 

these from their user community

Ensure that incident management plans and helpdesk facilities are 

available (see Chapter 10)

Contact CESG for further advice if necessary

26. HMG organisations handling, storing and processing protectively marked 

information must formally assess the risks to their corporate infrastructure from 

the enterprise deployment of iOS devices and treat the risks by applying 

appropriate technical and non -technical controls from the Baseline Control Set 

contained in the IS1 and 2 Supplement (reference [c]).

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004988

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 16 of 118
UNCLASSIFIED

Page 17

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Chapter 4 – Platform Technical Overvi ew

Key Principles

Implementers and accreditors should understand the security features of the iOS 

platform in order to make appropriate decisions about the ri sks presented in later 

Chapters

The features described in this section are only applicable to the native security 

functions provided by the platform for data-at-rest encryption and data-in-transit 

encryption, third-party components which provide these fu nctions have not been 

assessed

Introduction

27. This Chapter provides Administrators with a high-level overview of the platform, 

giving additional detail around security enforcing features or areas where 

particular care should be taken during deployment.

28. The topics discussed here should be understood by implementers and 

accreditors so that the risks presen ted later in the document can be fully 

understood.

29. Further technical information can be acquired directly from Apple, either from the 

iOS Developer Portal or at http://www.apple.com/support/security/ . Much of the 

information given here is taken from the i OS Security overview document 

(reference [d]), published by Apple in May 2012. CESG recommend s that 

administrators and risk decision makers are familiar with this document.

30. The information presented here may become outdated as the product is 

developed further. This Chapter is current as of iOS version 6.0 and for the 

devices listed in Chapter 2. All details presented here should b e confirmed 

before making assumptions about later versions of the product.

31. The features described in this section are only applicable to the native security 

functions provided by the platform for data -at-rest encryption and data-in-transit 

encryption, third-party components which provide these functions have not been 

assessed. 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004989

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 17 of 118
UNCLASSIFIED

Page 18

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Device Encryption

32. iOS protects user data s tored on a device through several classes of encryption

provided by Apple’s Data Protection technology. All assessed iOS devices have 

Data Protection enabled by default and it is not possible to disable or configure 

it.

33. There are four classes of protected data on an iOS device. These correspond to 

the keys used to encrypt the data and when (in terms of device state) the data is

therefore available. Developers, including Apple, assign data within their

application to one of the four classes and with it an associated protection profile.

34. The four classes are outlined in this table:

5

Protection

Class Data Availability Example(s)

A Only when unlocked Email content, attachments, Safari

passwords

B Write-only when device is 

locked; read-write when 

unlocked

New email received since previous 

device lock

C After first unlock Wi-Fi, VPN and Exchange 

credentials

D Always Contacts, calendar

35. Data in classes A, B and C is encrypted using a key that is cryptographically 

combined with the user’s passcode. Without the passcode the data cannot be 

accessed, so strict policy must be set to ensure users keep passcodes secret.

 5 In Apple developer parlance, cl asses A-D are NSFileProtectionComplete, 

NSFileProtectionCompleteUnlessOpen, NSFileProtectionCompleteUntilFirstUserAuthentication 

and NSFileProtectionNone respectively for file data, and classes A,C and D are

kSecAttrAccessibleWhenUnlocked, kSecAttrAccessib leAfterFirstUnlock and 

kSecAttrAccessibleAlways respectively for keychain data

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004990

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 18 of 118
UNCLASSIFIED

Page 19

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

36. Data in class C can be accessed after the user has unlocked the device at least 

once. This is the equivalent level of protection provided by full disk encryption 

products on traditional desktop operating systems .

37. Data in class D is encrypted with a key that is always available and is not

combined with the user’s passcode, so can be decrypted and accessed at all

times.

38. Data in all classes is additionally protected by a device -specific key held in 

hardware on the device. This makes it more difficult for an attacker to read or 

modify data on the device by performing low-level operations on the memory 

chips directly.

39. CESG has assessed that the level of cryptographic protection afforded to data in 

classes A and B and judge that it provides a Foundation Grade level of security 

when the device is locked and configured in accordance with this document. By 

default, the only pre-loaded application which stores all of its data in class A and 

B storage is the Apple Mail application.

Network Security

40. iOS 6.0 introduced the Global Proxy feature, which fo rces all Application-layer

traffic to be pushed through a HTTP proxy. As this is only a HTTP proxy, no 

cryptographic security is provided by this feature, though secure connections 

can be proxied using it. From a security point of view, this feature’s bes t use is 

as a trigger for the VPN as discussed below.

41. As the Global Proxy is not a security feature, it is not hardened to attack. An 

adversary on the local network may be able to cause it to be bypassed, and a 

malicious app on the device may be able to av oid using it.

42. iOS supports both Transport Layer Security (TLS) and IPsec Virtual Private 

Networks (VPNs). CESG policy states that departments must use an IPsec VPN

to encrypt protectively-marked data in transit and securely route all traffic back 

through the department in order to take advantage of corporate monitoring and 

filtering devices already in place.

43. Use of a VPN is an optional setting in iOS that can be configured on-device or 

by using administrative profiles deployed via USB or MDM. There is, however, 

no mechanism in iOS to ensure that the VPN remains active at all times. This 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004991

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 19 of 118
UNCLASSIFIED

Page 20

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

means that there is some risk of data leakag e outside the encrypted channel, 

even when the VPN is configured properly.

44. To minimise this risk, when certain VPN types are used, the VPN can be 

configured to be “on-demand” so that it automatically connect s when certain 

triggers occur. These triggers are IP addresses or domain names which cause 

the VPN connection to be established whenever a connection is established to 

one of the listed domains. 

45. This functionality was designed to be used to allow the device to access internal 

departmental services which require the VPN to be established in order to 

connect. By having the address of the Global Proxy in this field, the VPN can be 

triggered for every application-layer outbound connection the device attempts to 

make.

46. As this triggering happens at application layer of the OS, certain low level traffic 

will not trigger the VPN. This include s DNS and APNS traffic which ma y leave 

the device before the VPN is established. Once the VPN has connected, 

however, all new connections, including DNS and APNS traffic, will be routed via 

the VPN. Existing connections, including to APNS servers may remain 

connected outside the VPN. As such, there is a slight risk of data exfiltration via 

this channel.

47. Although the VPN settings themselves are a configuration profile and can be 

prevented from being removed , both the VPN and the on-demand setting can 

still be disabled by the user in the settings menu. Thi s means that even though 

the administrator has configured the device in line with this document and best 

practice, the user can still trivially disable the VPN.

48. To mitigate this, CESG strongly recommends the provision of a carrier APN (see 

Chapter 6) and user education (see Appendix C) to mitigate data loss. 

Additionally, certain MDM products may provide features to detect that the VPN 

has been disabled and to provide administrative alerts if this has been detected. 

See Chapter 7 for further information on selecting a MDM server.

49. Even if an APN is used to augment traffic routing controls, the user could still

disable the VPN, and use Wi-Fi to connect directly to the Internet and bypass 

any corporate monitoring and protection s that are in place. No technical controls 

exist to disable Wi-Fi; users must be informed procedurally of corporate policy.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004992

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 20 of 118
UNCLASSIFIED

Page 21

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

50. Note that some connections within the VPN (such as to an Exchange server) 

may additionally be encrypted under TLS. This encryption is controlled by the 

relevant application (such as the email application) and not at a system level, so 

enforcing the IPsec VPN is still necessary.

Device Provisioning, Synchronisation and Mobile Device Management

51. With iOS 5.1, Apple released Apple Configurator (reference [e]) which can be

used for provisioning devices. Apple Configurator provides addition al options for 

hardening an iOS device, including putting the device into Supervised Mode.

52. In previous versions of iOS, the device would share cryptographic key material 

with any host connected via USB when unlocked allowing that host to fully 

manage and audit the device . Putting a device into Supervised Mode prevents 

this behaviour, thus limiting security association s to only the provisioning 

terminal used to put the device into this mode.

53. The Configurator can be used to apply configuration profiles to the device. 

These profiles include passcode policies, VPN configuration and disabling of

certain features. One such profile that can be provisioned is an a uthentication 

certificate for a MDM server. This allows for an authenticated control mechanism 

to be established between the device and MDM server.

54. By then provisioning an over-the-air MDM profile, the device establishes a 

remote security association with the MDM server , allowing an administrator to 

remotely configure, monitor and lock the device. This security association allows 

the sharing of cryptographic material between the device and MDM server so 

that passcode resets can be performed, and so that all commands are 

authenticated.

55. Users can be prevented from removing profiles set by the Apple Configurator 

tool, with the exception of the MDM profile which can always be removed. 

Removing the MDM profile will remove any additional profiles pushed to the 

device through the MDM server, as well any data associated with those profiles. 

Therefore, careful choices should be made around which settings to apply via 

the Apple Configurator and which settings to apply through the MDM server. 

Procedural controls should also be used to mitigate the risk of weakened 

security configuration. These choices are discussed further in Chapter 7.

56. The iOS platform exposes an interface so that Mobile Device Management can 

be performed by third -party server software. Organisations can therefore elect to 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004993

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 21 of 118
UNCLASSIFIED

Page 22

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

use either Apple’s MDM server or a third -party server. CESG has not assessed 

the features or quality of any given MDM server, so selection of the most 

appropriate server is left as a decision for the organisation’s risk assessment 

and accreditation process . Some considerations are provided in Chapter 7 and 

in CIAN 2012/09, Mobile Device Security Applications (ref erence [f]).

Third-party Applications

57. Apple has a large ecosystem of first- and third-party applications which augment 

the functionality provided by the base operating system. The iOS platform is 

hardened against attack from t hese applications through a robust 

implementation of sandboxing and code signing.

58. Despite these security measures, applications still have access to a multitude of 

programming interfaces that allow access to various components an d data 

stores on the iOS device. These include location sensors, contact information 

stored on-device, microphone and network services. Consequently, trust in 

these applications is a paramount consideration.

59. To provide enterprise control over applications installed on a user’s devic e, 

Apple provides several ways of limiting application installation on -device to only 

applications provided by the enterprise. This mechanism functions outside of the

App Store channel, meaning that the App Store can be disabled and approved

third-party applications still used.

60. A full discussion around the acquisition and deployment of third -party 

applications, the use of mechanisms to control them, and residual risks is given 

in Appendix E.

Custom In-house Applications

61. If an organisation joins Apple’s iOS Developer Enterprise Program it has the 

opportunity to develop in-house applications and deploy them using their own 

infrastructure rather than the public App Store. A department can also set up an 

enterprise app catalogue or use one as part of a third -party MDM server. 

62. Enterprise apps should be developed with due consideration to the security 

aspects of development. Apple produces considerable amounts of 

documentation on how to develop applications for iOS securely. This 

documentation is available on thei r developer portal http://developer.apple.com/ .

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004994

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 22 of 118
UNCLASSIFIED

Page 23

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

63. For more information on in-house app development and deployment , see 

Apple’s App Developer Guide (reference [g]).

Privacy Settings

64. With iOS 6.0, Apple introduced finer -grained user control over what personal 

data applications could access. This means that the user must explicitly give 

permission when an application wants to access the Calendar, Contacts, 

Camera, Reminders, Photos or Loca tion, or wishes to use Facebook or Twitter 

credentials. Once a user has given permission to a particular application, the 

authorisation is stored in the Privacy menu.

65. The Privacy menu can then be used to see which applications have previously 

requested access to the personal data stores, and to change the initial decision 

at a later date.

66. The Restrictions menu on the device can be used to prevent changes to the 

items on the Privacy menu. This means that all applications can be prevented 

from getting personal data on the phone by disabling all accesses in the Privacy 

menu, then preventing changes in the Restrictions menu. If individual access are 

required for trusted applications (say, a custom -developed in-house application), 

then individual permissions can be set on that, before applying the restriction in 

the Restrictions menu.

67. Recommendations for which privacy settings to configure are given in Appendix 

A.

Apple Services

68. Apple provides a number of online services by default such as iMessage, Siri

and Maps. As with all services that require the exchange of data outside of 

departmental networks , the risks of using these services should be assessed 

before they are used. The recommended architecture and settings given later in 

this document put the system into a configuration where such risks are 

minimised.

69. For example, Siri is a voice-controlled assistant which allows the user to dictate 

text and issue commands. By default, Siri is enabled and accessible when 

locked. Because Siri can dictate messages for sending, it can read contacts and 

exchange voice data with Apple servers for processing. Siri can also remind you 

of meetings and therefore it can access calendar appointments. This means 

that, by default, an unauthenticated attacker can access calendar and contacts 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004995

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 23 of 118
UNCLASSIFIED

Page 24

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

without unlocking the device. In addition, any spoken reply by Siri could be 

overheard by a bystander.

70. Even if access to these services is prevented when locked, the application still 

forwards much of its data to Apple for processing. Although this connection is 

encrypted in transit, there is no assurance of who has access to the data when it 

arrives at the remote server for processing , or if it is stored there. 

Device Updates and Recovery

71. As of iOS 5.0, iOS devices are able to receive device updates directly over-theair. This means that no direct physical connection to a computer is necessary. 

Although the majority of updates are expected to be small, and they could 

reasonably be downloaded over a 3G connection, some upda tes (e.g. a new 

major version of the OS) may be substantially larger and may require that the 

device is brought back to the department for updating via USB.

72. iOS devices have a built-in recovery mode known as Device Firmware Upgrade 

(DFU) mode. This is a minimal pre-boot environment which allows the device 

memory to be completely overwritten with a new image of the operating system. 

This could be useful in restoring devices which have become corrupted or 

compromised, as it does not require the device to be in a bootable state to use 

it.

73. To put the device into DFU mode and perform a restore , follow the steps on 

page 4 of iOS Security (reference [d]). The device must then be connected to a 

provisioning terminal to reload th e operating system software.

74. DFU mode restore operations can be used to completely reset a device to 

factory state and should be used when provisioning devices that have previously 

been used, or as a best-endeavour sanitisation before release. 

75. CESG has not assessed the rigour of the secure erase functionality of the 

device, so risks of re-provisioning to different operating environments will need 

to be assessed and considered by the department in question .

76. Administrators should sanitise devices using a DFU mode restore in the 

following scenarios:

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004996

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 24 of 118
UNCLASSIFIED

Page 25

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

When re-issuing a returned device

Before provisioning a privately owned device 6

To break all device trust relationships with previously synchronised hosts

 6 See CIAN 2012/07 (reference [b]) for a more thorough discussion of Bring Your Own Device 

(BYOD) in the UK Public Sector.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004997

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 25 of 118
UNCLASSIFIED

Page 26

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

THIS PAGE IS INTENTI ONALLY LEFT BLANK

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004998

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 26 of 118
UNCLASSIFIED

Page 27

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Chapter 5 – Deployment Process

Recommended Actions

77. To provision an enterprise deployment of iOS devices appropriate for use in the 

UK Public Sector, Administrators should:

Procure and provision an APN (Access Point Name) from a chosen cellular 

carrier, as per APN requirements in Chapter 6

Obtain SIM cards from the carrier that are exclusively provisioned to use 

the procured APN for their cellular data connection

Deploy OS X 10.7 Lion (or later), and install iTunes 10. 7 (or later) and the 

Apple Configurator utility version 1.2 (or later) onto a dedicated provisioning 

terminal as described in Chapter 6

Procure and set up a MDM Server which is compatible with iOS and fu lfils 

the requirements given in Chapter 7

Deploy and configure the requisite network components as described in 

Chapter 6

Create configuration profiles for the end -user devices in line with the 

guidance given in this document and apply these profiles to provisi oned 

devices using Apple Configurator

Securely associate each provisioned device to the MDM server by following 

the manufacturers’ instructions

Use the MDM server to apply over -the-air configuration profiles to the 

device as required

Apply any additional hardening required by using the Restrictions menu

locally on the device

Provide Security Operating Procedures, user education packages and 

training documents on the secure use of the devices

Establish a helpdesk facility to respond to loss or theft of devic es by 

performing remote lock or wipe functions

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00004999

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 27 of 118
UNCLASSIFIED

Page 28

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

THIS PAGE IS INTENTI ONALLY LEFT BLANK

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005000

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 28 of 118
UNCLASSIFIED

Page 29

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Chapter 6 – Recommended Architecture

Key Principles

The recommended network architecture is based on CES G Architectural Pattern 

2: Walled Gardens for Remote Access (reference [h]). It should be implemented 

to complement the technical controls discussed in this document

A carrier-provided and carrier-enforced APN is required to prevent data leakage

The native IPsec VPN component within iOS, in conjunction with an approved

IPsec concentrator within the Walled Garden, along with the APN, provides 

Confidentiality and Integrity of data in transit between the device and 

departmental networks sufficient to protect sensitive data in transit

X.509 certificates are used for unique endpoint identification and authentication

Technical controls within the architecture allow the device to access a limited 

subset of departmental services

Security profiles on devices are provisioned and maintained using the Apple 

Configurator utility and an appropriate MDM server

Introduction

78. This section provides advice on how to securely connect iOS devices to an 

organisation’s network in order to manage the risk to that network.

79. For organisations bound by the HMG Security Policy Framework (reference [i]), 

the risks presented to their corporate infrastructure by the deployment of devices 

operating at RESTRICTED must be formally assessed and treated by applying

appropriate technical and non -technical security controls from the baseline 

control set in the IS1 and 2 Supplement (reference [c]). All HMG ICT systems 

that handle, store and process protectively -marked data must undergo a 

proportionate assessment process .

Recommended Archit ecture

80. The recommended architecture is based on the principles in CESG Architectural 

Pattern No.2 (reference [h]). An APN is used to provide separation of

departmental mobile data from the mobile operator’s main data network. Mobile 

devices connect through an IPsec tunnel over the APN to the department into a 

‘Walled Garden’. All data communications from the mobile device travel through 

this route. The communications between the device and the departmental

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005001

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 29 of 118
UNCLASSIFIED

Page 30

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

network are mediated by a Presentation Layer within the architecture. This 

mediated access exposes only a subset of services within the department, such 

as email and internal web applications.

81. A number of Apple services , namely to the Apple Push Notification Service 

(APNS) must be made available to iOS devices via the APN before the VPN is 

established. This means that limited Internet connectivity needs to be passed to 

the iOS devices inside the APN tunnel but not through the VPN gateway . See 

the table at the end of this Chapter for more information on this.

Figure 1: Recommended architecture for an enterprise deployment of iOS

82. Figure 1 provides a high-level recommended architecture. The definitions of the 

layers are those used within the Architectural Pattern. In practice the 

architecture may need to be tailored to individual scenarios but any deviations 

from the recommended architecture will need to be given careful consideration 

to assess the security implications.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005002

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 30 of 118
UNCLASSIFIED

Page 31

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

83. The function performed by each security -critical component of the architecture is 

explained below:

The APN tunnel serves two purposes:

o It isolates the mobile device from the remainder of the carrier network, 

limiting the publicly-exposed attack surface of the devi ce

o It provides defence-in-depth for when the VPN is not active. The VPN 

could be inactive for various reasons including timeouts, user malice, 

misconfiguration, or during device boot when APNS connections are 

initially made

By terminating the APN tunnel in side the department, all mobile device 

traffic is routed via corporate monitoring and filtering systems to prov ide 

additional defence in depth

Any cryptographic parameters of the APN tunnel will generally be provided 

by the carrier and cannot be configure d. Because of this, and because the 

APN can be bypassed by SIM change or enabling Wi -Fi, a VPN needs also 

to be used

Internal Firewall which sits between the APN tunnel and the VPN gateway 

provides controls against a network -level attack from the untruste d WAN

The VPN Gateway terminates the VPN from the mobile devices. It also 

authenticates the mobile device and the user. The VPN provides 

Confidentiality and Integrity for the data in transit between the device and 

the department. Specific security requirements for the VPN are listed below 

in paragraph 84

The purpose of the Presentation Layer is to present a subset of 

departmental services to the mobile devices. This reduces the risk a 

compromised mobile device presents to the co re network. As a minimum 

the Presentation Layer is formed by the Internal Firewall, but CESG 

recommends that a reverse proxy be used to provide a layer of abstraction 

between the mobile device and the Core systems where possible. The 

Global Proxy setting in the device profile should be set to the address of th e 

reverse proxy server

The Mobile Device Management (MDM) server allows configuration 

profiles to be established and maintained for the devices. MDM 

considerations are discussed in Chapter 7

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005003

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 31 of 118
UNCLASSIFIED

Page 32

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

The Certificate Authority is the root of trust for the certificates used within 

the architecture and is a critical part of the cryptographic security

The Directory Service provides authentication of users to services within 

the department

The Internet Gateway represents the existing infrastructure such as a 

proxy server, filtering, monitoring and auditing that may already exist within 

the department infrastructure for access to Internet resources . All Internet 

browsing from the mobile dev ices should be routed over the VPN and 

through this infrastructure to ensure equivalent protections are in place for 

browsing from the mobile devices as there are for the departmental desktop 

infrastructure

Implementation Notes

84. The following advice is intended to inform implementation decisions:

It is possible that the VPN Gateway may also provide the function of the 

External Firewall, in which case it is not necessary to have a separate 

physical device

CESG do not recommend that a third interface on the access layer’s 

internal firewall be used to place the firewall in a DMZ if the firewall carries 

a lower level of assurance than the VPN Gateway. The rationale for this 

recommendation is given in the CESG Architectural Pattern No.2 (reference

[h])

Departments may consider facing the VPN concentrator to the Internet and 

permitting an exception on APN traffic to reach the VPN. This means that if 

a device were to come from a different bearer than the APN, it would still be 

protected by the VPN. In this instance, VPN connection source IP 

addresses could be used to monitor compliance wit h Wi-Fi policy, for 

example

In an emergency, it may also be beneficial to have planned an option for 

allowing the MDM server to be temporarily reachable directly from the 

Internet without reconfiguring devices. This mechanism could then be used 

to increase the likelihood of, say, a device wipe message reaching the 

device while the VPN is not connected

CESG recommend s that the Internal Firewall which sits b etween the VPN 

gateway and the APN tunnel is a separate firewall

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005004

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 32 of 118
UNCLASSIFIED

Page 33

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Both the device and the user are authenticated in the above architecture. 

Where possible it is advised that the mapping of devices to users be 

enforced. For example, users should be prevented from connecting on 

devices that were not issued to them by the department

There are no security reasons why the server components in the above 

architecture cannot be virtualised. However, unassured virtualisation should 

not be used to separate different s ecurity domains. For further 

recommendations on the usage of virtualisation please refer to CESG Good 

Practice Guide 12 (GPG 12), Use of Virtualisation Products for Data 

Separation: Managing the Security Risks (reference [j])

Private APN

85. CESG strongly recommends that organisations acquir e and use a private 

Access Point Name (APN) to route all mobile traffic back to the department. This 

configuration would isolate the communication between the iOS device and the 

department over public cellular networks, and additionally protect the VPN 

endpoint from being exposed directly to the Internet.

86. All traffic originating from devices should be captured by the APN and routed 

through the department (not just VPN traffic). This will ensure th at traffic cannot 

be routed directly to the Internet before the VPN is established.

87. The APN terminates at a department gateway which will then route traffic either, 

to the Internet Browsing Gateway (if it is APNS or other Apple Service traffic ), or 

to the VPN gateway (for all other traffic ). The routes for these service s are given 

at the end of this Chapter.

88. The APN tunnel could be configured to have multiple GGSN routes availab le to 

provide redundancy. This would provide network resilience for users should one 

of the GGSN’s fail.

89. SIM cards associated with the APN should not be allowed to connect to other 

APNs owned by the mobile operator and not controlled by the department . SIM 

cards not associated with the department should be blocked from connecting to 

the APN.

90. SIM cards associated with the APN must not contain any third-party Java 

Applets as they could compromise the security of the devices or the APN. The 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005005

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 33 of 118
UNCLASSIFIED

Page 34

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

organisation risk owner is responsible for discussing this with their mobile 

operator.

VPN Configuration

91. The built-in VPN client within iOS has been assessed against the CPA 

Foundation Grade requirements for IPsec VPN for Remote Working – Software 

Clients (reference [k]).

92. The VPN must be configured to use X.509 certificates for mutual authentication. 

Each iOS device must be issued with a certificate from an appropriate Certificate 

Authority. The VPN Gateway is also provided with an X.509 certificate that can 

be authenticated by the devices.

93. The deployed VPN gateway should be a CESG-certified device, assured to at 

least Foundation Grade against the IPsec VPN Security Gateway Characteristic 

(reference [l]), and deployed in accordance with it s published Security 

Procedures.

94. As iOS does not support configuration of key lifetime options it is necessary to

rely on key lifetime parameters set by the VPN Gateway. Therefore it is 

important to ensure that these parameters are configured appropriately on the 

VPN Gateway. 

95. Keep-alive mode should be configured as part of IKE to detect if the VPN has 

become disconnected and trigger a reconnection attempt.

Certificates and Certificate Authorities

96. CESG recommends that organisations implement a self-signed root certificate 

authority, or a subordinate to an existing HMG CA, that issues certificates to the 

mobile devices and the VPN Gateway. The infrastructure should then be 

configured to only accept device certificates that are issued by the authority.

97. Given the expected lifetime of a mobile device in a department, user and device 

certificates should have a lifetime of no more than the lower of the expected 

lifetime of the device and 3 years. New certificates will need to be reissued if the 

device lifetime later exceeds this duration.

98. Incident management pr ocedures should detail the process for revocation of 

certificates. During mobile device connection, departmental services must check 

whether the certificate of the connecting device has been revoked. Normally this 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005006

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 34 of 118
UNCLASSIFIED

Page 35

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

check uses a Certificate Revocation List ( CRL) or the Online Certificate Status 

Protocol (OCSP). The exact method is not important provided that a mechanism 

exists for revoking a particular certificate and the access and identification it 

provides.

Provisioning Terminal

99. In order to take advantage specifically of the Supervised Mode feature of iOS, 

devices must first be configured using the Apple Configurator (reference [e]) on 

the Provisioning Terminal via USB. The Provisioning Terminal may be a member 

of the departmental network but should not be a general -purpose workstation.

100. The Provisioning Terminal will require limited access to the internet to allow the 

Apple Configurator to download the latest firmware images and to activate the 

iOS devices.

101. See Chapter 7 for further details of the provisioning process, and Chapter 10 for 

further details on management and maintenance of the P rovisioning Terminal.

Mobile Device Management (MDM)

102. Mobile Device Management produc ts themselves are discussed in detail in 

Chapter 7. This section discusses their integration into the network.

103. The MDM server is located in the core network and contains cryptographic 

material for each registered device which c an be used to remotely unlock the 

device. Consequently the MDM server must have the same physical protections 

as the Certificate Authority.

104. The MDM server will require certain network ports to be open between iOS 

devices and the MDM server in order to operate correctly. The relevant MDM 

vendor’s guidance should be followed to configure the n etwork to support their

product. For example, devices may enrol using the Simple Certificate Enrolment 

Protocol (SCEP) using TCP port 1640.

105. Additional connections must also be allowed from the MDM server to Apple 

servers to allow push notifications to be sent. These ports are discussed from

paragraph 115 onwards.

106. For disaster recovery or emergency usage it may be necessary to temporarily 

expose the MDM server to the Internet. This will allow connections between the 

MDM server and devices which for whatever reason are not connected to the 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005007

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 35 of 118
UNCLASSIFIED

Page 36

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

APN and VPN (e.g. connected to the Internet via Wi -Fi with VPN disabled). To 

enable this in future, the MDM server must be configured with a public DNS 

record and IP address which is not ordinarily reachable from the Internet.

Management of the Departmental Components

107. All server and hardware components should be hardened in line with good 

industry practice. Manufac turers’ hardening guides should be followed where 

they exist.

108. The principle of least privilege should be applied to all accounts used within the 

system. Service accounts should have the minimal capability required to perform 

their function. Unnecessary pri vileges should be removed; this will reduce the 

impact of a compromise.

109. Consideration should be given to protecting the management interfaces of 

departmental components. 

Reverse Proxy

110. The reverse proxy brokers device access to internal services by allowin g only 

certain network traffic to pass through it to the internal addresses.

Mail Server

111. Whilst the provisioning of iOS into the department should not largely affect the 

configuration of the mail server, additional consideration must be given to

filtering file types which can be harmful to iOS devices. File types which must be 

prevented from reaching the device are .mobileconfig, .mobileprovision and .plist

(configuration files) and .ipa (iOS application files) as allowing these to reach the 

device could compromise its security.

112. Email messages delivered to the device should be delivered in plaintext format 

only, and should not contain any rich or active content.

113. Calendar, Contacts, Notes and other non -mail items which are synchronised 

with the mail server are not protected on devices in the same way as email and 

attachments are (see Chapter 4). Therefore CESG strongly recommend s that 

these items are not delivered to iOS devices if they are sensitive. This restriction 

can be implemented in one of several ways:

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005008

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 36 of 118
UNCLASSIFIED

Page 37

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Use IMAP with SSL (IMAPS) rather than ActiveSync. IMAP does not 

support synchronisation of anything other than e -mail with the mail server

Procedurally mandate that calendar appointments , contacts, tasks and 

notes may not contain sensitive data across all users of the system

Use an ActiveSync proxy to filter out any items other than mail which are 

protectively marked. This would also require all Exchange objects in the 

organisation to be tagged with their classification

Only configure the device to synchronise mail to the server, then use the 

local Restrictions options on the device to prevent alterations to the 

settings

Internet Browsing Gateway

114. Content filtering services must be in place and must filter th e file types given in 

paragraph 111 to prevent them from reaching the device and altering its 

configuration.

Apple Network Traffic

115. iOS devices connecting to Apple from within the corporate network (i.e. , on the 

VPN) need certain external addr esses to be reachable in order to activate and 

function correctly. A table of these required addresses is given below.

116. Note that any given apple.com sub domain will resolve to many IP addresses 

within the 17.0.0.0/8 address range which are subject to chang e at any time. 

Therefore, whitelisting should be by domain name rather than IP address.

117. For more information on these services, see 

http://support.apple.com/kb/TS1379

http://support.apple.com/kb/TS1629

Local 

Machine(s) Remote Address(es) Port(s) Purpose

Provisioning 

Server, Device

ocsp.apple.com

evsecure-ocsp.verisign.com

evintl-ocsp.verisign.com

443 Online Certificate Status service for 

checking signing certificate validity.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005009

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 37 of 118
UNCLASSIFIED

Page 38

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Provisioning 

Server, Device

crl.apple.com 443 Certificate Revocation List server for 

periodic updates to cached c ertificate 

validity information

MDM Server gateway.push.apple.com

feedback.push.apple.com

2195, 2196 MDM servers use these ports on both 

servers to send data to Apple Push 

Notification Service ser vers for forwarding

to devices

Provisioning 

Server

phobos.apple.com

itunes.apple.com

ax.itunes.apple.com

gs.apple.com

albert.apple.com

ax.init.itunes.apple.com

443 Device Activation

Device init.ess.apple.com 80 Device Activation configuration

Device gs-loc.apple.com 443 Google Services Server 

Device setup.icloud.com 443 iCloud Configuration Server

Device *-courier.push.apple.com 7 5223, 443 Apple Push Notificatio n Service to iOS 

device messages

Device mesu.apple.com 80 Device Software Updates

Device guzzoni.apple.com 443 Siri Server used at Device Activation

Device service2.ess.apple.com 443 iMessage Server used at Device 

Activation

Device static.ess.apple.co m 80 iMessage Server used at Device 

Activation

 7 There are multiple courier.push.apple.com servers, named from 1 to 200 (e.g. 5 -

courier.push.apple.com).

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005010

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 38 of 118
UNCLASSIFIED

Page 39

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Chapter 7 – Provisioning and Mobile Device 

Management

Key Principles

Provisioning is the initial process of applying security controls to a device, 

including defining a Mobile Device Management (MDM) server

Mobile Device Management allows profiles and restrictions to be remotely applied 

to a device

Devices must be provisioned in a secure environment to enable remote 

management

Introduction

118. The provisioning process for an iOS device requires it to be configured in three

separate steps:

Apple Configurator must be used to apply non -changeable security settings 

to the device, to place the device into Supervised Mode, and to prepare the 

device for being connected to a MDM server

A MDM server must be used to apply any profiles for which it may be 

desired to remotely change them at a later date

The Restrictions menu in device settings must then be used to apply 

further controls which the Apple Configurator and MDM servers cannot 

apply. These settings are locked using a four -digit PIN which should not be 

revealed to the device user

119. Actual recommended settings for the various areas of policy are listed in 

Appendix A, whereas the discussion around their impact is provided in this 

section.

120. A wider discussion on the use of mobile security products, including MDM, in the 

UK Public Sector is contained in CIAN 2012/ 09, Mobile Device Security 

Applications (reference [f]).

Apple Configurator

121. One of the most important features of the Apple Configurator is the ability to

place a device into Supervised Mode. As connectivity through the dock 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005011

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 39 of 118
UNCLASSIFIED

Page 40

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

connector cannot be hardware -disabled, the Supervised Mode feature is 

required in order to associate the device to a single comput er, preventing the 

device from syncing to other computers. This must be enabled from the 

provisioning terminal during the initial provisioning process.

122. Security profiles can then be installed on the device through the Apple 

Configurator. Profiles added in this way can be optionally locked in place so that 

they can only be removed by completely resetting the device. Policies and

settings which will never need to be changed should be added at this st age of 

the provisioning process and locked.

123. The Apple Configurator must then be used to add a profile containing the signing 

certificate used by the MDM server during enrolment in order to build a trusted 

relationship and validate future management messages. 

124. As this provisioning involves transferring certificates in plaintext, the process 

must occur over a USB cable from a dedicated provisioning terminal.

MDM Server Considerations

125. In order to manage devices securely the network administrator must deploy a

MDM server to manage profile settings on the devices, and configure them to 

trust and obey commands received from the MDM server.

126. iOS devices use a proprietary MDM protocol which is supported both by Apple’s 

MDM server and by a range of third -party providers. As such, not all MDM 

servers provide the same range of functionality. It is vital to select one which 

supports the requirements listed below as a minimum:

Passcode complexity and enforcement rules

Remote device wipe

Email account creation and configuration

Device audits

Access point management

Uses the Apple MDM API

127. The MDM server should be installed in a network location which associated 

devices can reach via the VPN. The MDM server will also require direct Internet 

connectivity to send Apple Push Notification Service (APNS) messages via 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005012

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 40 of 118
UNCLASSIFIED

Page 41

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Apple owned servers to trigger certain behaviours on the device. See Chapter 6

for more information around r ecommended network architectures, and Apple: 

Deploying iPhone and IPad Mobile Device Management (reference [m]) for 

details of the Apple MDM server .

128. Whilst this document assumes that the MDM server will be hosted on -premises, 

the use of a managed third -party service hosted on appropriately secured 

infrastructure is not precluded. Administrators and Accredi tors should consider 

the benefits and security implications before deciding where to host their MDM 

service. Whichever approach is taken, the hosting service must be accredited to 

handle the data in question.

MDM Provisioning

129. To associate a device with a MDM server it must be enrolled. In order for this to 

happen securely all MDM communications , specifically including during 

enrolment, must be digitally signed so that the device can verify the profile using 

a certificate placed on the device during the initial provisioning stage with the 

Apple Configurator. In the case of the Apple Server MDM this will be the Trust 

Profile. 

130. MDM servers can also push control messages to a device. These messages can 

be remote commands (e.g. wipe), requests for audit information, or can apply 

new configuration settings to the d evice or range of devices.

Profiles

131. Profiles are configuration files controlling one or more settings that can be 

pushed to devices via a MDM server. These can contain blank fields, enabling 

user-specific details (e.g. email credentials) to be entered at installation time.

132. Profile settings implemented through the MDM service can complement or 

augment those set through the Apple Configurator, but not override them. If 

there is a contradiction in securi ty settings then the most secure option s take 

precedence. 

133. Profile signing is important as profiles could be overwritten by alternatives

identified by the same Unique Identifier (UID). To protect against such attacks

the MDM server must be configured to si gn all profiles when they are delivered. 

134. Devices will recognise profiles which are sent via a MDM server, email or a web 

browser. As users cannot be relied upon to distinguish emails containing 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005013

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 41 of 118
UNCLASSIFIED

Page 42

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

legitimate corporate profiles from malicious ones sent by a third-party they must 

be instructed to ignore all profiles unless they are sent through the MDM server. 

Email and web filtering should be used to block .mobileconfig and 

.mobileprovision file attachments.

135. Profiles added through the MDM server can be optionally locked against user 

removal, as with profiles added using the Apple Configurator. However, the 

profile containing the MDM enrolment information cannot be locked and 

therefore can be removed by the user. Such a removal will also remove any 

profiles added by that MDM server as well as any information linked to that. For 

example, if an email account is set up by a profile pushed through the MDM 

server and then the MDM profile is removed then all email data will also be 

removed.

136. If a user removes the Devic e Management profile from a device, it will lose any 

profiles added remotely through the MDM server and any data associated with 

that profile. Auditing the device will no longer be possible and the profile

removal might not be detected. Users must be advised against removing the 

MDM profile, and administrators should carefully decide which security settings 

should be enforced through the Apple Configurator and which are trusted to the 

MDM server. 

Risk Warning: See Chapter 11 for details.

Self Service

137. Some MDM products may allow users to self -administer certain areas of their

device configuration, or to remotely locate, lock, password -reset or wipe their

device. As implementation of this functionality can vary across vendors of these 

products, the network architecture presented in this section does not account for 

variances in architecture required to support these functions.

138. If such functionality is enabled on the MDM service, users’ access should be 

over a trusted network only, with access credentials at lea st as strong as for the 

device. Usage of these services should be monitored and audited regularly for 

security breaches.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005014

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 42 of 118
UNCLASSIFIED

Page 43

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Restrictions

139. There are a number of security restrictions which can only be set locally on the 

device in the Restrictions menu (See Appendix A for details). These restrictions 

must be locked from user interference by using a 4-digit PIN.

140. By enabling certain items in the Restrictions menu, administrators can prevent 

users from changing settings w hich are not otherwise controllable by the 

department. Administrators should be aware that the use of a PIN to control 

these options will also prevent the user from wiping their device by using the 

“Erase all content and settings” menu item, as this prompt s for the Restrictions 

PIN and device passcode when used.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005015

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 43 of 118
UNCLASSIFIED

Page 44

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

THIS PAGE IS INTENTI ONALLY LEFT BLANK

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005016

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 44 of 118
UNCLASSIFIED

Page 45

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Chapter 8 – Profile Settings

Key Principles

Any functionality with no business benefit should be disabled

Administrators should consider using multiple profiles to standardise the 

provisioning process

VPN Profile

141. The device requires a VPN profile covering addresses, algorithms and 

certificates. This profile should be set to operate with the VPN configured as 

detailed in Chapter 6. 

142. CESG recommend s that VPN profiles be applied using Apple Configurator 

rather than via the MDM server. The user is then unable to remove these 

settings without Administrator interaction.

143. The VPN on demand feature should be used to force all corporate 

communications through the VPN gateway. See Appendix A for the 

recommended VPN on demand settings that should be applied.

Passcode

144. Passcode policy, rules and guidance must comply with the requirements set out 

in HMG IA Standard No. 7 (IS 7), Authentication of Internal Users of ICT Systems 

Handling Government Information (reference [n]) and employ a sensible

passcode regime. Specifically, this must enforce the use of the device lock and 

dictate passcode complexity rules.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005017

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 45 of 118
UNCLASSIFIED

Page 46

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

145. The following table sets out some of the possible passcode schemes an 

organisation could adopt, and the corresponding approximate time to brute -force 

all of the passcodes possible under that scheme.

Character 

Set

Character 

Set Size

Passcode 

Length

Approx. time to 

exhaust

0-9 10 4 15 minutes

8 90 days

A-Z, a-z, 

0-9 62

7 9,000 years

8 500,000 years

9 30,000,000 years

A-Z, a-z, 

0-9, 

symbols

~100

7 250,000 years

8 25,000,000 years

9 2,500,000,000 years

146. The above table shows several passcode policy schemes. Note that the time to 

exhaust is only an indication of the time it would take to computationally try all 

passwords in this space using current technology. Future developments in 

hardware forensics may allow for the passcode being brute-forced offline, 

reducing these estimates significantly.

147. Using this table to inform passcode policy assumes that passcodes are 

randomly chosen within the space of all possible passcodes. As users would 

normally choose their own passcode, this reduction in passcode entropy needs 

to be considered.

148. As such, CESG strongly recommend s that 9-character device passcodes are 

used and users are forced via a profile to include at least one number and 

symbol.

149. Despite these pattern policy rules, it is still possible for a user to select a weak 

passcode. This would have serious implications for the security of the system. 

The example user guidance document in Appendix C contains guidance on 

selection of passcodes. Administrators must ensure that users are aware of the 

importance of selecting a robust passcode.

Applications

150. iOS devices have a core set of applications as standard. It is possible to install

third-party applications through the App Store or an enterprise app catalogue.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005018

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 46 of 118
UNCLASSIFIED

Page 47

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

151. Profiles applied to a device can disable access to some built-in applications, 

such as the browser, the Camera app, and the App Store. This mechanism can 

therefore be used to prevent any third -party applications from being installed.

152. As there are inherent risks with the use of third -party applications, CESG 

advises that administrators disallow their use by disabling the App Store 

application. However, where there is a clear business benefit in using third-party 

applications, administrators must consi der whether the risks highlighted in 

CESG Good Practice Guide No. 7 (GPG 7), Protection from Malicious Code 

(reference [o]) are acceptable and, if so, apply the mitigations listed. 

153. All applications in the App Store have been subjected to a due -diligence 

assessment by Apple to ascertain that they are not overtly malicious.

154. Apple’s assessment notwithstanding, third -party applications may still contain 

malicious code or may simply be badly designed and introduce un intended 

vulnerabilities. Clearly, the source and quality of the software and the number of 

applications installed are major factors in the degree of risk involved.

155. Departments may wish to consider the deployment of an enterprise app 

catalogue to allow in-house applications to be deployed to connected devices.

Mail Settings

156. CESG strongly recommend s that only the default email software is used for the 

sending and receiving of protectively-marked email content and moreover that 

only email accounts from the enterprise domain mail server should be 

configured in this application to minimise the risk of data leakage via a non -

departmental mail account.

157. Profile settings must also be used to prevent the dir ect copying of email from a 

departmental email account to another account not within the department.

Browser

158. As the use of the web browser increases the attack surface, departments 

choosing to permit the use of Safari should manage the risks as described in 

GPG 7 (reference [o]).

159. If a department chooses to disable access to the browser, they should be aware 

that this does not block access to web clips , and web pages embedded in third -

party applications which facilitate the presentation of web pages. If a web clip is 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005019

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 47 of 118
UNCLASSIFIED

Page 48

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

used, it should be verified that this does not allow a user to access the wider 

Internet.

160. All browsing activity must use the APN and VPN to pass all data through the 

departmental network. The network should be configured to provide an 

equivalent degree of protection to the iOS devices as to any computer on that 

network. Malicious software and data should be detected and blocked as 

thoroughly as possible, along with unauthorised attempts to access internal 

services.

Multimedia

161. Multimedia applications for music and video, as well as iTunes for media 

purchases, can be disabled through Apple Configurator profile as per 

departmental policy. 

GPS

162. Administrators should be aware that Location Services may send current 

location, previous locations, and any search terms to Apple owned servers. 

CESG have not assessed the security of these services .

163. Users’ ability to use Location Services can be controlled using the Restrictions 

menu on the device.

Camera

164. Departments should be aware that mobile devices with a built -in camera might 

contravene some site security policies. The device camera can be disabled 

through a profile if required. Any photographs taken using the camera on the 

device are only stored using Class D encryption, so their protection cannot be 

guaranteed to the same level as othe r data on device.

165. Facetime should also be disabled as the recommended architecture prevents it 

from working.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005020

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 48 of 118
UNCLASSIFIED

Page 49

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Account Control

166. User accounts with external services (e.g. email, iCloud, iTunes, social media) 

cannot be controlled through profile settings, but can be protected from change

by a user by means of the Restrictions menu on the device. These options

should be used to prevent users ’ devices registering with external services and 

transferring data.

Risk Warning: See Chapter 11 for details

167. Third-party applications may also synchronise data with external services. In 

general, third-party application policy cannot be set through MDM, so users must 

be careful not to allow sensitive data to be synchronised via third -party 

applications they are permitted to use by administrators.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005021

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 49 of 118
UNCLASSIFIED

Page 50

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

THIS PAGE IS INTENTI ONALLY LEFT BLANK

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005022

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 50 of 118
UNCLASSIFIED

Page 51

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Chapter 9 – Procedural Controls

Key Principle

CESG has identified a number of risks that cannot be fully mitigated by technical 

controls alone. This section suggests procedural controls to treat them

Introduction

168. The iOS platform does not allow all identified risks to be mitigated by technical 

measures alone. Because of this, additional procedural controls need to be put 

in place. These procedural controls may apply to administrators, users, or both.

169. User guidance should be established and distributed to the user community to 

ensure adoption. Disciplinary procedures should be put in place to reinforce the 

importance of following these policies.

Wi-Fi

170. All iOS devices support the use of Wi-Fi as a network bearer. However, due to 

the fact that the VPN cannot be fully hardened (as discussed in Chapter 4), and 

the APN routing would not apply over Wi -Fi, CESG advises that users are

explicitly warned not to enable the Wi-Fi functionality on their devices.

171. There are currently no technical controls available on iOS for administrators to 

limit the ability of the user to enable Wi -Fi; hence its use must be procedurally 

controlled through User Security Procedures . Some MDM products may have 

the ability to monitor connections to Wi-Fi networks and alert if an unauthorised 

connection is made; such products may be used to monitor compliance if 

desired.

172. Should Wi-Fi be enabled by a user, iOS devices may no longer be subject to the 

protections provided by the departmental monitoring and filtering services. 

Attackers may be able to modify device settings by distributing mobile 

provisioning configuration files; intercept and/or modify Internet -bound traffic, or 

reach additional attack surfaces not present over 3G interface (including 

wireless synchronisation services).

173. Whilst out of scope of this document, some departments may wish to consider 

disabling the Wi-Fi hardware in iOS devices to techni cally disable the Wi-Fi 

functionality of the device.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005023

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 51 of 118
UNCLASSIFIED

Page 52

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

174. Except when explicitly approved by the department, users must not attempt to 

use Wi-Fi. As Wi-Fi access point creation cannot be explicitly disabled on 

devices, a user could attempt to connect to a third -party wireless hotspot. 

Risk Warning: See Chapter 11 for details

Bluetooth

175. Bluetooth tethering to provide data connectivity can also expose a similar set of 

iOS internal services to Wi-Fi. The risks of allowing tethering sho uld be 

considered by risk assessors before permitting it. Tethering can normally be 

controlled technically by the carrier enabling a specific account , but this should 

not be relied on as a security -enforcing function.

SIM Card

176. As the SIM card is provisione d specifically to the APN as described in Chapter 6, 

swapping the SIM card out for one not provisioned to the APN will defeat the 

protections provided by the APN. Departments should be aware of this risk and 

should document thi s in user security procedures. Tamper labels could be used 

over SIM card slots if required.

Dock Connector

177. The dock connector is required for charging the device, but must only be used 

with a dedicated charger. The iOS device should not be charged over USB from 

computers other than the dedicated provisioning terminal .

178. iOS devices should not be charged using any form of mass charging station 

such as found at airports, nor should they be charged by any non -trusted docks 

such as hotel alarm clocks.

179. Peripherals exist for iOS devices to allow the connection of removable media 

(e.g. SD cards). The handling by iOS of these peripherals has not been 

assessed by CESG and as such they should not be used.

Profile Files

180. Additional profiles (i.e. .mobileconfig files) may be sent to devices at any time via 

the mail client or web browser and users are able to install these unless a MDM 

which supports disabling profile installation is used, or profiles are filtered by 

departmental monitoring and filtering systems. Users must not accept or install a 

profile they are not expecting, and u sers must ensure all expected profiles

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005024

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 52 of 118
UNCLASSIFIED

Page 53

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

received by a device are marked as verified and signed by the installation 

dialogue on the device.

181. Users must not accept or install any unsolicited profiles. Although a correctly 

configured device cannot have its department-provisioned settings overwritten 

or removed by a malicious payload, additional settings or email accounts could 

be added, e.g. allowing for data exfiltration from the device via a secondary 

email account.

182. Screenshots of an unsolicited untrusted profile being received on a device are 

provided in the example Security Procedures for Users document in Appendix 

C.

Risk Warning: See Chapter 11 for details

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005025

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 53 of 118
UNCLASSIFIED

Page 54

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

THIS PAGE IS INTENTION ALLY LEFT BLANK

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005026

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 54 of 118
UNCLASSIFIED

Page 55

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Chapter 10 – System Management and Maintenance

Key Principles

Organisations should establish a helpdesk facility to which loss or theft incidents 

can be reported, and ensure that users are aware of the importance of 

immediately reporting such incidents

Prior to reassignment, or on disposal, administrators should factory -reset the 

device via DFU mode restore as described in Chapter 4

Administrators should regularly check the Apple Security Updates website

(reference [p]) and/or other sources of vulnerability reports, and ensure that any 

software updates addressing security issues are installed promptly

The VPN Gateway contains sensitive data such as the traffic encryption keys 

used by each device; compromise of the VPN Gateway would result in 

compromise of all traffic sent and received on the mobile devices and potentially 

provide access to the departmental core network. It is therefore important that 

procedures are established on how to handle any backups and configuration 

files of the VPN Gateway

Users should follow the supplementary guidance (see Appendix C)

Asset Management for iOS Devices

183. While there are no formal cryptographic accounting requirements applicable to 

iOS, organisations are advised to accurately track the association between 

users, mobile devices and SIM cards.

184. The ability to remotely query managed devices for their iOS version via the MDM

service may be useful for providing administrators with important inform ation 

about patch installation status.

185. Similarly, querying for “jailbreak” status offers some insight into the integrity of 

iOS devices. However, responding to this query relies on the device to 

accurately attest to its own integrity, which yields an inher ently untrustworthy 

response. 

186. MDM products that report the set of software installed on each managed device 

may allow administrators to know when users violate procedural controls. 

187. See Appendix B for details of what information can be audited.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005027

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 55 of 118
UNCLASSIFIED

Page 56

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Responding to Mobile Device Loss, Theft, or Suspected Compromise

188. It is important that procedures are in place to respond as quickly as possible to 

incidents of mobile device loss, theft or suspected compromise.

189. If an iOS device is lost or stolen, device certificates should be revoked and (if 

available) a remote wipe command should be sent to disable the device as soon 

as possible. Therefore, the helpdesk operators should have easy access to 

certificate revocation facilities as well as any existing device management 

services.

190. To prevent fraudulent use, an administrator should issue the wipe command 

before notifying the carrier of a lost SIM. If the carrier is notified first, the wipe 

command may not reach the mobile device.

191. Ideally, the helpdesk facility should be avai lable 24 hours a day, 365 days a 

year. It is recognised that this may not be possible but a quicker response will

minimise the possibility of data loss.

192. Details of how to contact the helpdesk should be provided in each organisation’s 

supplementary Users Security Procedures.

193. If for any reason a device is suspected of having been compromised and it is still

in the possession of the user, the following steps should be taken:

The administrator should revoke the device certificates

Any corporate user credentials that may have been used on the device 

should be changed

The administrator should restore the operating system via DFU-mode 

restore using the Apple Configurator

Remote Lock/Wipe

194. MDM servers provide a function to remotely lock or wipe a device. System 

administrators can use this as an additional layer of security in the event that a 

device is lost or stolen.

195. When a device is lost, the lock or wipe command should be sent before the 

operator is requested to disable the account and SIM. If the account is disabl ed 

first, the device will likely not have a network connection over which to receive 

the wipe or lock command.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005028

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 56 of 118
UNCLASSIFIED

Page 57

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Helpdesk Authentication

196. It is very important that effective authentication measures be established to 

ensure that the user reporting a theft or l oss is indeed the legitimate user. It is 

obviously undesirable for a malicious individual to be able to have a legitimate 

user’s mobile device remotely disabled by simply making a phone call to the 

helpdesk. 

Disposal or Reassignment of iOS Devices

197. Organisations should follow steps outlined in HMG IA Standard No.5 (IS5) 

Secure Sanitisation (reference [q]).

Maintenance of iOS Devices

198. In accordance with IS5 (reference [q]), devices should not be sent to external 

parties for maintenance or repair purposes and retired devices should be 

disposed of accordingly.

Responding to Forgotten Passcodes

199. If the MDM service is configured to allow it, a user’s device unlock passcode can 

be remotely reset by an admini strator. It is vital to use helpdesk authentication 

before a device is unlocked, and the user must immediately set a new device 

passcode. 

User Training and Education

200. Organisations should ensure that users receive appropriate training in the 

secure operation of iOS. If users are not sufficiently trained, the probability of 

security incidents will rise.

201. The procedural controls described in Chapter 9 should be explained to users in 

their training. Organisations should produce User Security Procedures to explain 

the security functionality of the mobile device and how to securely operate it. 

See Appendix C for examples of what the User Security Procedures should 

include.

Software Patching

202. Administrators should be aware that Apple and third-party application authors 

periodically issue software updates. These may add extra functionality, or fix 

bugs and security vulnerabilities. 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005029

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 57 of 118
UNCLASSIFIED

Page 58

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

203. It is imperative that organisations keep abreast of published vulnerabilities in the 

iOS products and react accordingly by applying patches or implementing 

controls as recommended by Apple. Patches for server components including 

any remote management servers should be applied promptly.

204. It is important for device administrators to maintain records of device pat ching

status. Device administrators should apply updates using a dedicated update 

terminal described in Chapter 4 and record the patch status of each device. 

205. Note that software updates may include additional features. Where possible, 

new features should be disabled via the corresponding settings unless they 

provide significant business benefit; in this case a local risk -management 

decision should be made.

206. CESG recommends administrators subscribe to the relevant news sources for 

the latest security updates; including the Apple Security Updates website 

(reference [p]) and Apple Security RSS feeds (reference [r]).

Physical Security

207. Administrators should be aware that anyone with physi cal access to the 

components could compromise their entire corresponding enterprise deployment 

of mobile devices and will likely have significant access to the corporate 

network.

208. This advice also applies to any system that has access to Provisioning and 

Update Terminals as well as any MDM servers. Network architectures should be 

designed to limit access to these systems to a dedicated Provisioning and 

Update Terminal only (see Chapter 6).

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005030

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 58 of 118
UNCLASSIFIED

Page 59

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Chapter 11 – Risk Treatment and Residual Risks

Key Principles

CESG has identified a number of risks that it is necessary to address in an 

enterprise deployment of iOS. CESG has assessed the ability of iOS to treat 

these risks when deployed in a UK Public Sector department

CESG advises that all the technical and procedural controls are applied to treat 

the risks. CESG has identified where considerable residual risks remains after

all recommended technical and procedural controls have been applied

Where there are residual risks that concern CESG or where there is significant 

reliance on procedural controls, this has been highlighted with an exclamation 

mark icon and outlined at the beginning of this Chapter

CESG has principally recommended technical controls to address as many of 

the risks as possible. These should be supported through the associated 

procedural controls. However, organisations are best placed to decide the 

appropriate approach to managing the risks presented in the se Security 

Procedures

Introduction

209. This Chapter sets out the residual risks for an enterprise deployment of iOS 

devices deployed in accordance with previous Chapters. CESG advises that all

the technical and procedural controls described previously are applied to treat 

relevant risks.

210. If an organisational risk owner needs to deviate from CESG recommendations, 

rationale for each risk has been provided to allow organisational risk owners to 

make informed risk management decisions.

211. Technical controls that correlate to configuration settings have been compiled in 

a comprehensive list in Appendix A for quick reference.

212. CESG Good Practice Guide No. 10 (GPG 10), Remote Working (reference [s]) 

provides further guidance on the information risk management of remote 

working practices. 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005031

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 59 of 118
UNCLASSIFIED

Page 60

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Risk Warning

213. All deployments of a complex technology, such as smartphones, also carry the 

same generic residual risks:

Due to the complex nature of the software exposed to the carrier network, 

new vulnerabilities will be discovered which an attacker could exploit

There is a reliance on vulnerabilities being disclosed and patched promptly 

by the vendor

214. The following points highlight key residual risks specific to an iOS deployment:

The iOS platform lacks technical controls to mitigate several key risks, 

placing a strong reliance on procedural controls to manage the risk s

Data stored locally under Class D encryption (see Chapter 4) can be 

decrypted and accessed using commercial or freely available forensics 

tools, even with all storage e ncryption features enabled and configured 

correctly

Users control the departmental VPN connection. If they choose to disable it 

or forget to enable it, the departmental defence-in-depth mitigations will be

circumvented

The Wi-Fi interface cannot be disabled administratively and can therefore 

be used to circumvent defence-in-depth mitigations

When a device is out of a user’s control there is the potential for the device 

to be exploited via USB using freely available tools accessible to novice 

attackers, resulting in a potentially compromised device and data loss

215. Where there are residual risks which concern CESG or significant reliance on 

procedural controls we have highlighted this with an exclamation mark icon.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005032

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 60 of 118
UNCLASSIFIED

Page 61

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

R1. Interception of data in transit and man -in-the-middle attacks

Rationale If this risk is not treated, the Confidentiality and Integrity of data passed 

between the mobile device platform and the departmental network is not 

suitably protected.

Technical 

controls

Configure the departmental architecture as detailed in Chapter 6, 

configuring the device to use an APN and departmental VPN solution.

Residual risks

The VPN does not remain permanently connected; this means 

there is a potential time frame when defence in d epth protection 

is not provided

The VPN can be disabled by the user at any time

The APN can be bypassed by a SIM change or enabling Wi-Fi

Any traffic to uncontrolled or unmanaged destinations (e.g. ,

Internet browsing and Internet em ail) could still be intercepted

Procedural 

controls

Users are discouraged from using external web services that require 

sensitive data.

Users should ensure their device is connected to the departmental VPN 

before using any network service and ensure the connection is re -

established if it becomes disconnected.

Residual risks

iOS disregards VPN routing policy for certain network traffic, 

sending some network traffic outside of the VPN ev en when 

configured not to do so

Sensitive data may accidentally or deliberately be sent in clear to 

external web services outside of departmental control

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005033

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 61 of 118
UNCLASSIFIED

Page 62

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

R2. A physical attack to extract contents of storage

Rationale The attacker has long-term physical access to the device and wishes to 

extract sensitive information from it. This may be through any physical 

interfaces to the device, or through commercial-grade forensic 

capabilities.

Technical 

controls

Enforce the use of a strong device passcode through an appropriate 

MDM server-controlled lockdown.

Ensure devices are regularly patched to remov e security vulnerabilities 

which forensic utilities may leverage to extract data from the device.

Procedural 

controls

Users should maintain control over the device at all times, treating the 

device as sensitive and using the same handling caveats as the

information it contains.

Users must be instructed to set a strong device passcode. 

Users must not attempt to jailbreak their devices as this disables several 

of the platform security features which provide the requisite data 

protections.

Residual risks

Whilst technical controls can be used to limit some weak 

passcodes, users may still be able to choose a weak passcode

which still fulfils the technical requirements

Any compromise of a device (accidental or deliberate) could 

result in compromise of sensi tive information

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005034

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 62 of 118
UNCLASSIFIED

Page 63

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

R3. Device passcode guessing

Rationale If this risk is not treated, an attacker may easily gain access to the 

device and subsequently to sensitive data.

Technical 

controls

Deploy configuration requiring a complex passcode in accordance with 

the guidance detailed in Appendix A.

Deploy configuration to automatically wipe the device after 5 failed 

passcode attempts.

Residual risks

Users might expose passcodes inadvertently

Commercial forensics software can leverage security 

vulnerabilities in the device to perform on -device passcode

guessing and bypass the failed passcodes attempts counter

Procedural 

controls

Document strong passcode requirements in the user Security 

Procedures.

Residual risks

None significant

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005035

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 63 of 118
UNCLASSIFIED

Page 64

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

R4. Theft of device whilst in use/unlocked

Rationale If this risk is not treated, data that resides on, or is accessible to, a 

device that is in use and unlocked is vulnerable if the device is stolen.

Technical 

controls

Deploy configuration enabling automatic screen lock after no more than 

5 minutes of inactivity.

Deploy configuration with an unlock grace period of no more than 5 

minutes. 

Remote wipe with a MDM service. 

Ensure there is an ability to revoke device certificate.

Ensure there is an ability to disable user account s on the VPN and 

internal services (including email) until new credentials can be 

established.

Residual risks

A 10-minute timeframe exists for compromise of sensitive data

through theft of a device left unattended

Any delay or failure in sending remote wipe commands to the 

device could be sufficient for an attacker to extract sensitive data 

from the device

An attacker could actively prevent the device from connecting 

back to the MDM server to stop remote wi pe commands from 

being received

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005036

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 64 of 118
UNCLASSIFIED

Page 65

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

R4. Theft of device whilst in use/unlocked

Procedural 

controls

Users should immediately report lost or stolen devices, as detailed in

Chapter 10.

Wipe commands should be sent and sufficient time allowed for their 

receipt before SIM cards are deac tivated by the carrier. This gives the 

wipe message a greater chance of reaching the device.

Users should be vigilant in locking devices when not in use.

Residual risks

Cannot guarantee delivery of remote wipe o f lost or stolen mobile 

devices

An adversary can maintain access to the device, subverting 

screen lock, through continual use

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005037

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 65 of 118
UNCLASSIFIED

Page 66

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

R5. Theft of credentials

Rationale An attacker who is able to steal credentials (device passcode and/or

network connection credentials) will be able to access sensitive data. 

The product should be able to prevent access to sensitive data if it is 

known that the credentials have been compromised.

Technical 

controls

Access to departmental services requires both a password and 

certificate.

Administrators are able to revoke device certificate.

Remote wipe with a MDM service, Exchange, or Outlook Web Access.

Disable user account until new credentials can be established.

Mandatory maximum password age as specified in Appendix A.

Set device and user certificates to have a lifetime as specified in 

Chapter 6.

Residual risks

The delay or failure in sending remote wipe commands to the 

device could be sufficient for an attacker to extract sensitive data 

from the device

All the above technical controls need to be applied in a timely 

manner for them to be effective

.

Procedural 

controls

Users should report any suspected credential compromise promptly and 

administrators should carry out appropriate revocation immediately, as 

described in Chapter 10.

Residual risks

Cannot guarantee delivery of remote wipe to lost mobile devices. 

If credentials have been compromised any data held on the 

mobile device could still be compromised

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005038

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 66 of 118
UNCLASSIFIED

Page 67

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

R6. Exploitation of weak cryptographic algorithm

Rationale Known weak cryptographic algorithms could fail to adequately protect 

sensitive data. 

Technical 

controls

Data-in-transit:

VPN should be configured as described in Chapter 6.

Data-at-rest:

iOS devices use always -on storage encryption to protect mail stores

Untrusted third-party apps should not be installed on the device

Procedural 

controls

The department should ensure third-party applications correctly use the 

built-in data protection APIs if they are handling sensitive data.

Users should not modify the settings in the VPN configuration.

Residual risks

Third-party applications, including security or sandbox 

applications may use their own cryptographic algorithms or 

implementations which have not been assessed by CESG

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005039

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 67 of 118
UNCLASSIFIED

Page 68

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

R7. Exploitation of software implementation error

Rationale Any software vulnerabilities could be exploited by an attacker.

Technical 

controls

Installing patches and security updates will ensure that any discover ed 

weaknesses in the product are fixed.

The vendor asserts that the operating system has defence -in-depth 

mitigations to reduce the impact of vulnerabilities.

Residual risks

Due to the complex nature of the software new vulnerabilities will 

be discovered which an attacker could explo it

Reliance on vulnerabilities being disclosed and patched promptly 

by the vendor

Older mobile devices may become unsupported and cease t o 

benefit from security patches

Future large device updates may require devices be recall ed to 

Administrators if over-the-air updating is not allowed

There is limited remote log management and viewing capability of 

operating system components, including the VPN

Most MDM software allows the software versions running on the 

iOS device to be audited

Procedural 

controls

Patching of devices should occur at the earliest opportunity as 

described in Chapter 10. Users should accept and install minor security 

updates when prompted by their device .

iOS devices that become unsupported should be replaced with newer 

models.

Residual risks

CESG has not performed any validation of the defence -in-depth 

mitigations provided by the operating system

There is limited remote log management and viewing capability of 

operating system components, including the VPN

Reliance on vulnerabilities being disclosed and patched promptly 

by the vendor

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005040

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 68 of 118
UNCLASSIFIED

Page 69

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

R8. Exploitation via physical interfaces

Rationale Physical interfaces (e.g., USB, removable media) on the mobile device 

can provide an attack vector for malicious code as well as an import 

mechanism for unapproved software.

Technical 

controls

Ensure appropriate enterprise controls are applied to all machines the 

mobile device connects to over USB.

Ensure devices are put into Supervised Mode to lower the risk of data 

loss via the USB interface.

iOS devices do not natively have removable media.

Residual risks

The local wired interface cannot be fully disabled administratively 

and can therefore still be used as a potential exploitation r oute

Procedural 

controls

Users should never connect their device to a computer, even for 

charging. 

The use of adapters to facilitate removable media use should be 

prohibited.

Residual risks

When device is out of users control there is potential for interface

to be exploited using freely available tools accessible to novice 

attackers

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005041

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 69 of 118
UNCLASSIFIED

Page 70

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

R9. Exploitation via local wireless interface

Rationale Local wireless interfaces (e.g. , Wi-Fi, Bluetooth) on the mobile device 

can provide an attack vector for malicious code as well as an import 

mechanism for unapproved software.

Technical 

controls

VPN should be configured as described in Chapter 6.

MDM products should be used where possible to audit device’s wireless 

pairing history.

Residual risks

Wireless cannot be disabled administratively and can therefore 

still be used as a potential exploitation route

The device does not have any ability to configure white l isting of 

approved applications

Procedural 

controls

Users should not enable Wi-Fi.

Users should not enable Bluetooth.

Residual risks

Users may enable wireless interfaces accidentally or deliberately. 

Prompts to enable these interfaces are seen regularly if there is 

no other connectivity available and a user could inadvertently

enable Wi-Fi at those times

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005042

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 70 of 118
UNCLASSIFIED

Page 71

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

R10. Exploitation via carrier network

Rationale Network interfaces on the mobile device connecting to untrusted 

networks can provide an attack vector for malicious code as well as an 

import mechanism for unapproved software.

Note: Wi-Fi is not considered here as this is covered in R9. Exploitation 

via local wireless interface.

Technical 

controls

Provisioning of an APN to limit access between the departmental

enclave and the remainder of the carrier network.

When the VPN is enabled (as detailed in Chapter 6) users only browse 

through the Internet Browsing Gateway, thereby benefiting from 

departmental defence-in-depth mitigations.

The vendor asserts that the operating system has defence -in-depth 

mitigations to reduce the impact of vulnerabilities.

Residual risks

Due to the complex nature of the software exposed to the carrier 

network, new vulnerabilities will be discovered which an attacker 

could exploit

Users can manually download and install applications signed with 

an enterprise developer certificate through the browser

The VPN does not remain permanently connected; this means 

there is a potential timeframe when defence -in-depth protection is 

not provided

iOS disregards VPN routing policy for certain network traffic,

sending some network traffic outside of the VPN ev en when 

configured not to do so

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005043

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 71 of 118
UNCLASSIFIED

Page 72

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

R10. Exploitation via carrier network

Procedural 

controls

Users should be discouraged from browsing websites for non -business 

use and not to visit links or open attachments in unsolicited emails.

Users should ensure their device is connected to the departmental VPN 

before using any network service and ensure the connection is re -

established if it becomes disconnected.

Users must not attempt to change the SIM card in their device.

Residual risks

There is still potential for malicious code to be executed on the 

device from targeted and non -targeted network-based attacks

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005044

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 72 of 118
UNCLASSIFIED

Page 73

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

R11. Reconfiguration of security -related settings of the device

Rationale If security-related settings on a device can be altered in an u nauthorised 

manner, the protection of data and functionality accessible via the device 

might be compromised.

Technical 

controls

Deploy configuration profiles via Apple Configurator with a complex

passcode known only to device administrators.

Ensure the device is placed into Supervised Mode.

Departmental monitoring and filtering should 

remove .mobileconfig, .mobileprovision, .plist and .ipa files from any 

email and web browsing traffic to the device.

Residual risks

A number of security-related settings cannot be mandated via 

profiles

Procedural 

controls

Ensure users follow all proced ural guidance outlined in this Chapter and 

understand the risks if procedural controls are not followed.

Users must be instructed not to install unexpected profiles.

Users must be instructed to not remove the Remote Management

(MDM) profile.

Residual risks

Reliance on procedural enforcement of security -related settings is 

prone to both intentional and unintentional abuse by users

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005045

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 73 of 118
UNCLASSIFIED

Page 74

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

R12. Compromise of the departmental infrastructure

Rationale Providing remote mobile device access to internally hosted services 

increases the departmental infrastructure attack surface and exposes it 

to additional remote threat actors.

Technical 

controls

Follow the architectural guidance in Chapter 6, providing a defence-indepth approach.

Prompt application of security patches to all departmental services 

(including network appliances and internal servers).

Standard network monitoring of the co mponents outlined in Chapter 6.

Residual risks

A threat actor can attempt to connect to the external interface, 

hence a vulnerability in any of the external network interfaces will 

expose the access layer to potential attack, but the presentation 

layer limits the impact to the core network

Users who intentionally share the mobile device’s data connection 

via USB or Wi-Fi may expose internal departmental infrastructure 

to devices of unknown provenance

Procedural

controls

Ensure appropriate intrusion detection and response mechanisms are 

enforced (covered in CESG Good Practice Guide 13 , GPG 13, 

Protective Monitoring for HMG ICT Systems (reference [t])).

Advise users to ensure Wi-Fi and USB tethering are disabled at all times 

and to connect devices only to departmental machines designated for 

provisioning or maintenance.

Residual risks

Reliant on effective signatures and mechanisms to identify

malicious or suspicious behaviour

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005046

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 74 of 118
UNCLASSIFIED

Page 75

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

R13. Compromise by malicious code

Rationale For higher threat environments, a targeted attack by an exploit 

attempting to run malicious code on an iOS device containing sensitive 

data is more likely. Technically capable attackers may be able to craft an 

exploit which results in the compromise of sensitive data.

Technical 

controls

iOS incorporates a robust implementation of code signing and 

sandboxing, limiting the impact of a compromise .

Corporate monitoring and filtering services detect and filter any known 

exploits.

Third-party applications are not used or limited to reduce the attack 

surface presented on the device .

MDM products may be able to attest to jailbreak status .

Residual risks

Physical attack on the device to exploit local interfaces

Low level technical attacks could exploit the air interfaces and 

compromise data

Unfiltered malicious attachments could compromise higher level 

iOS components

Procedural 

controls

Users should not open unsolicited attachments .

Users should not browse to suspicious webs ites.

Users should ensure devices are not physically connected to any

untrusted systems.

Residual risks

Targeted attacks by a technically capable adversary will not be 

filtered or detected by corporate monitoring systems

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005047

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 75 of 118
UNCLASSIFIED

Page 76

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Risk Warnings

216. The following sections expand upon the Risk Warning paragraphs highlighted in 

earlier sections.

iCloud

217. Paragraph 166 highlights the limitation that user accounts with external services 

cannot be limited through a profile, and instead can only be controlled using 

Restrictions options on the device. 

218. Allowing the creation of other accounts (webmail or social media) creates an 

interface that can easily be used to transfer sensitive user data to third-party

services. If an iCloud account is enabled on a device, it will automatically backup 

user data including sensitive email, contacts, and photos to Apple ’s servers.

219. To treat this risk, it is therefore vital to use the Restrictions menu to prohibit the 

use of iCloud. 

Wi-Fi

220. Paragraph 174 explains that Wi-Fi must not be used unless explicitly approved 

by the department. 

221. The use of Wi-Fi connectivity presents substantial risk to sensitive data as it 

allows a direct connection from the device to the Internet to be established, 

bypassing the protective infrastructure put in place by the department. Without 

firewalls, web traffic filtering or protective monitoring it is much easier for an 

attacker to find and attack device components and for these attacks to go 

undetected. 

222. On public Wi-Fi networks, there is the additional risk that the Internet access 

itself cannot be trusted. It is possible for traffic to be re -routed to phishing sites, 

or perform Man-In-The-Middle attacks to decrypt data in transit. 

223. Moreover, as using Wi-Fi connections bypasses departmental auditing systems, 

it allows users to perform any number of online activities without any monitoring 

or control from the department.

224. This significant issue can only be managed by procedural controls, and so 

should be carefully considered by risk assessors before deployment. 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005048

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 76 of 118
UNCLASSIFIED

Page 77

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Profiles

225. Paragraph 136 discusses the risks associated with profile files. 

226. When used correctly, profiles allow a department to apply security restrictions or 

provision account settings to a device. A signing mechanism is in place allowing 

users to verify the authenticity of received profiles, but there are no technical 

measures to prevent unapproved profiles being applied to a device by a user if 

they receive a file from a third-party. Profiles from a malicious third-party can

weaken the security of the device. 

227. Users must be made aware of the risks of untrusted profiles, recognise the 

difference between trusted and untrusted sources and understand the 

importance of never instal ling third-party profiles. Advice must be provided in the 

supplementary guidance (Appendix C) on how official profiles will be distributed 

by the MDM server.

Remote Management Policy

228. Paragraph 181 refers to the Remote Management profile, which contains the 

settings that allow a department to protect, control and audit a device remotely.

229. By design, this profile can always be removed by the user. Should a user do so, 

this will remove all departmental control profiles, accounts and data associated 

with that profile and therefore will allow the user to operate the device without 

any departmental restrictions. Any accounts or profiles which were not 

provisioned by the MDM service (e.g. via Configurator), will remain on the device 

and can only be removed if they were marked as removable at time of 

provisioning.

230. If a user were to remove the Remote Management profile from a device, the 

department would no longer be able to update settings , audit or send wipe 

commands to it. Depending on the MDM server used, it may be possible to 

detect that the profile has been removed and alert an administrator.

231. Users must be warned in the supplementary guidance against removing this 

profile, and administrators should monitor for attempts by users to re-enroll a 

device with the MDM server after removing a departmental profile.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005049

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 77 of 118
UNCLASSIFIED

Page 78

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

THIS PAGE IS INTENTI ONALLY LEFT BLANK

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005050

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 78 of 118
UNCLASSIFIED

Page 79

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Appendix A – Profile Configuration Settings

Introduction

232. This section details all security configuration settings supported by iOS devices.

Where settings are omitted, they are viewed as cosmetic rather than controlling

specific features, or are department specific . For example, the names of policies

and owner text are not defined here , nor are specific server addresses .

233. Where necessary, an explanation of the risks presented by the setting is given to 

justify mandatory settings and support recommended ones.

234. Not all settings are available in all profile management software. Features are 

marked as available on MDM servers (M), on Apple Configurator (C) or in the 

Restrictions menu (R). Departments must ensure that any settings they need to

set are set in at least one of these three possible places.

235. The Restrictions menu options can only be protected with a 4 -digit PIN. CESG 

recommends that the 4-digit PIN be unique to each device, and it must not be 

provided to the user.

236. Because the different methods of setting policies have different removal 

characteristics, the recommended method of setting each individual policy is 

documented in bold. The rationale behind these recommendations is generally:

MDM service is preferred for non -critical security settings to allow for future 

flexibility

Settings where removal of that profile would also remove sensitive data (or 

access to sensitive data) can be set by a MDM server

Settings where the removal of that setting make it easier for an adversary 

to attack or get access to the data are set by Configurator

Settings where there are no MDM or Configurator altern atives are set via 

Restrictions

237. If a setting given is not available on the selected MDM, it should be applied 

using another available method.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005051

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 79 of 118
UNCLASSIFIED

Page 80

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

General Group Recommendations (apply these to all Configurator profiles)

Setting Method Value CESG Advice

Security C Never Mandatory

Passcode Group Recommendations

Setting Method Value CESG Advice

Allow simple value CM No Strongly Recommended

Require alphanumeric 

value

CM Yes Strongly Recommended

Minimum passcode length CM 9 Strongly Recommended

Minimum number of 

complex characters

CM 1 Strongly Recommended

Maximum passcode age CM 90 (days)

30 (days)

Strongly Recommended

Recommended

Auto-Lock CM 5 minutes Strongly Recommended

Passcode history CM 8

12

Strongly Recommended

Recommended

Grace period for device 

lock

CM 5 minutes

None

Strongly Recommended

Recommended

Maximum number of failed 

attempts

CM 5 Strongly Recommended

Restrictions Group Recommendations

Setting Method Value CESG Advice

Functionality Tab

Allow use of camera CMR Departmental Policy

Allow FaceTime CMR Departmental Policy

Allow screen capture CM No Strongly Recommended

Allow Photo Stream CM No Strongly Recommended

Allow Shared Photo 

Streams

CM No Strongly Recommended

Allow Passbook 

notifications while locked

CM No Strongly Recommended

Allow iMessage C No Strongly Recommended

Allow voice dialling CM Departmental Policy

Allow Siri CMR No Strongly Recommended

Allow Siri while device is 

locked

CM No Mandatory

Enable Siri Profanity Filter CMR Departmental Policy

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005052

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 80 of 118
UNCLASSIFIED

Page 81

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Restrictions Group Recommendations

Setting Method Value CESG Advice

Allow Bookstore C Departmental Policy

Allow Erotica C Departmental Policy

Allow installing apps CMR No Strongly Recommended

Allow removing apps C No Strongly Recommended

Allow In-App purchase CM Departmental Policy

Require iTunes password 

for all purchases

CM Departmental Policy

Allow iCloud document 

sync

CM No Mandatory

Allow iCloud backup CM No Mandatory

Allow automatic sync while 

roaming

CM Departmental Policy

Force encrypted backups CM Yes8 Recommended

Allow users to accept 

untrusted TLS certificates

CM No Mandatory

Allow Configuration 

Profiles Installation

CM No Mandatory9

Send diagnostic and 

usage data to Apple

CM No Strongly Recommended

Applications Tab

Allow use of YouTube CMR No Recommended

Allow use of iTunes Store CM No Strongly Recommended

Allow use of Game Center C No Strongly Recommended

Allow adding Game 

Center friends

CMR No Strongly Recommended

Allow multiplayer gaming CMR No Strongly Recommended

Allow use of Safari CMR Departmental Policy

Enable autofill CM No Recommended

Force fraud warning CM Departmental Policy

Enable JavaScript CM Departmental Policy

Block pop-ups CM Departmental Policy

 8 This policy will have no effect, except on the provisioning terminal, if iCloud is disabled and the 

device is configured to be in Supervised Mode, as strongly recommended by this guidance. 9 If this option is available in the MDM then it is mandatory. MDM servers will not be able to 

enrol devices if set by the Apple Configurator. 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005053

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 81 of 118
UNCLASSIFIED

Page 82

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

VPN Group Recommendations

Setting Method Value CESG Advice

Connection Type CM IPsec (Cisco) Strongly Recommended 10

Machine Authentication CM Certificate Mandatory

Enable VPN On Demand CM Yes Mandatory

If Global Proxy is being use, t he VPN On Demand feature must be set to trigger for all 

domains by setting the On Demand Action to be “Always est ablish” for the address of 

the Global Proxy server. 

If Global Proxy is not being used, this option must be set to trigger the VPN by setting 

the On Demand Action to be “Always establish” for the 36 wildcard hosts 

“a.”, “b.”, “c.”, ..., “z.”, “0.”, “1.”, ... , “9.” (without quotes).

Proxy Setup CM Manual or

Automatic

Mandatory

Exchange ActiveSync Group (or Email Group if using IMAP) Recommendations

Setting Method Value CESG Advice

Use SSL CM Yes Mandatory

Do not allow user to move 

messages from this 

account

CM Yes Mandatory

Use Only in Mail CM Yes Mandatory

Enable S/MIME CM Departmental Policy

On-Device Restrictions Menu Recommendations11

Setting Value CESG Advice

Privacy Section

Location Services – Enable12 Departmental Policy

Location Services – Allow Changes Departmental Policy

Contacts – Allow Changes No Strongly Recommended

Calendars – Allow Changes No Strongly Recommended

Reminders – Allow Changes No Strongly Recommended

Photos – Allow Changes No Strongly Recommended

 10 The use of a VPN is mandatory. The use of an IPsec VPN specifically is strongly

recommended. 11 Only items that are not available in Configurator and MDM are listed here. Other settings can

be controlled elsewhere.

12 Both Location Services items must be set to No to ensure Location Services cannot be 

enabled by the user.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005054

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 82 of 118
UNCLASSIFIED

Page 83

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Bluetooth Sharing – Allow Changes No Mandatory

Twitter – Allow Changes No Mandatory

Facebook – Allow Changes No Mandatory

Allow Changes Section

Accounts – Allow Changes No Mandatory

Other On-Device Settings

Setting Value CESG Advice

General  About  Advertising 

Limit Ad Tracking

Yes Recommended

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005055

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 83 of 118
UNCLASSIFIED

Page 84

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

THIS PAGE IS INTENTI ONALLY LEFT BLANK

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005056

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 84 of 118
UNCLASSIFIED

Page 85

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Appendix B – Auditing

Introduction

238. This section details all device detail s that can be audited through a MDM server.

239. Audits should take place regularly to ensure that devices are compl ying with 

technical and procedural controls as far as can be detected and should also be 

used to ensure that devices are still associated with the departmental network.

Device details

Device type

Model number

Software version

Software build number

Device serial number

UUID

Wi-Fi MAC

Bluetooth MAC

Last check-in time

Device capacity

Available capacity

Remaining battery life

Certificates

In device groups

Installed applications

Security

Hardware encryption

Force encrypted backup

Passcode compliance

Passcode present

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005057

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 85 of 118
UNCLASSIFIED

Page 86

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Restrictions

Manual fetch when roaming

Allow app installation

Allow camera

Allow explicit content

Maximum rating for media

Allow screenshot

Allow YouTube

Allow iTunes

Allow FaceTime

Allow auto-sync when roaming

Allow voice dialling

Allow in-app purchases

Allow multiplayer gaming

Allow Safari

Safari: allow autofill

Safari: force fraud warning 

Safari: allow JavaScript

Safari: allow pop-ups

Safari: accept cookies

Extended MDM auditing

240. In addition to details that can be audited through the generic MDM int erface 

provided, third-party MDM servers may utilise a client on the device to provide 

enhanced auditing.

241. A non-exhaustive list of the extra auditing features which can be expected from 

a third-party MDM service are listed below:

Jailbreak detection

VPN activity indicator

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005058

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 86 of 118
UNCLASSIFIED

Page 87

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Usage statistics

Current GPS location

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005059

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 87 of 118
UNCLASSIFIED

Page 88

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

THIS PAGE IS INTENTI ONALLY LEFT BLANK

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005060

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 88 of 118
UNCLASSIFIED

Page 89

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Appendix C – Example User Guidance

242. Procedural security guidance should be provided for iOS users, some of which 

may be based upon the procedural controls and re sidual risks outlined in 

Chapter 7.

243. Supplementary user guidance should contain, as a minimum, the i tems listed 

below:

Arrangements for training of users and processes for allocating mobile 

devices to users and provisioning mobile devices

Procedures to be followed in the event of mobile device loss or theft, or 

forgotten passwords (See Chapter 10 for more details). This should include 

helpdesk contact details and opening hours and a description of any

authentication measures. It may also discuss the process by which a new 

mobile device is acquired and provisioned

Procedures to be followed in the event of unexplained malfunction of 

devices, or other security incidents (such as sus pected mobile device 

tampering)

Any organisational policy related to the use of email, which needs to be 

restated in the context of iOS use

An organisational remote working policy, outlining the security requirements 

and restrictions on users working remotely

For the purposes of charging the device, users should only use external 

chargers and, for example, should never c harge via USB from any 

computer

The architecture outlined in Chapter 6 enforces a VPN Gateway that 

prevents email push notifications to iOS devices. Therefore, users should 

ensure that local Exchange configuration is applied t o the devices to enable 

polling

244. An example set of Security Procedures for Users takes up the remainder of this 

Appendix.

User Responsibilities

245. All users should follow these Security Procedures at all times while operating an 

iOS device. They should also comply with any supplementary guidance issued 

by their own department.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005061

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 89 of 118
UNCLASSIFIED

Page 90

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

246. Users must be aware that their device does not of fer any security for voice 

telephony or SMS. Telephone conversations and text messaging must therefore 

be limited to UNCLASSIFIED. 

247. All users must read, fully understand and accept the procedures and advice in 

this document before using their iOS device. This should be acknowledged in 

writing.

248. Users must understand that they are responsible for the physical security of their

device, and that failure to follow these Security Procedures could lead to 

compromise of not only their own data, but also their departmental network.

249. The security strengths of the iOS device are closely linked to the strength of the 

user password. Users must read the password guidance and ensure that they 

do not select a weak password.

250. When using an approved iOS device, users must ensure that it is not possible 

for bystanders to view classified information on the display, or to observe the 

device password being entered. 

General Guidance

251. An iOS device configured as recommended by CESG and with the 

recommended enterprise settings, can only be used for the processing and 

storage of data up to RESTRICTED. Users should also consider whether the 

aggregation of numerous items of RESTRICTED information on their device

may, when viewed as a whole, increase the business impact of that data being

compromised. They should, therefore, delete RESTRICTED items from their 

device as soon as they are no longer required ; see CESG Good Practice Guide 

No. 9 (GPG 9), Taking Account of the Aggregation of Information (reference [u]). 

Mobile Working

252. Users must recognise that the nature of using smartphones for remote working 

brings with it an increased level of information risk, and should follow the advice 

given to minimise this risk.

253. The iOS device is an attractive target to thieves. In addition to the obvious 

inconvenience of having a device stolen, there is also a risk of sensitive data 

being extracted. Users should therefore take all possible measures to avoid their 

device being stolen; it must never be left unattended.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005062

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 90 of 118
UNCLASSIFIED

Page 91

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

254. The user must not allow anyone else to use t he device as there is a risk that 

they could modify device settings in order to render the device vulnerable to 

further attack.

255. It is easy for somebody in the vicinity of a user to view the device’s display. 

Therefore, users must not view or work on classi fied data while in a public place

where they may be overlooked . 

256. It is particularly important that users exercise great care when entering their

password in a public place and do not do so if there is any possibility of being

overlooked. This is because th e keyboard’s design does not lend itself to rapid 

typing and it is not difficult for a bystander to see the password by watching the 

user type it in. 

Passwords

257. It is important that a strong password is chosen, i.e. one that is difficult to guess. 

In the event of the device falling into the wrong hands, a weak password could 

make it easier for sensitive data on the device to be accessed and / or the 

departmental network to be compromised. 

258. Unless advised otherwise, the password must meet the following req uirements:

It must be a minimum of 9 characters in length

It must contain a mixture of upper and lower case letters, numbers and 

special characters13

It should be as random as possible, and in particular must not contain 

recognisable words or any other s trings associated with the user

It must not contain more than two c onsecutive identical characters

259. The device should be configured such that it will reject any password that does 

not contain at least one upper case letter, one lower case letter, one number, 

and one special character. However, this check is not in itself sufficient to ensure 

that a password is strong enough ( e.g. the password “Passwrd1!” would pass 

the device verification, but is clearly not a good choice). Therefore, the onus is 

on the user to choose a strong password. Weak passwords reduce the overall 

security of the departmental network.

 13 where a special character is one of the following: , ’ ? ! ” - ( ) @ / : _ ; + & % * = < > £ € $ ¥ [ ] 

{ } \ ~ ^ ¡ § ¿ # | ¤ 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005063

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 91 of 118
UNCLASSIFIED

Page 92

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

260. The password should be changed after a maximum period of 90 days and must 

not match any of the previous 8 passwords nor use a password that is, or h as 

been, in use on another system. The device will prompt the user when a 

password change is due. 

261. Whatever the reason, users must never disclose their device password to 

anyone (including helpdesk administrators), either in person, by phone, or by

email / text messaging.

262. If the password is written down by the user it must be placed in an envelope and 

treated according to its sensitivity (i.e. kept in a secure cabinet). Under no 

circumstances should a written copy of the password be carried along with the 

device.

Email and Calendar

263. Users should note that email and calendar functionality on devices are an 

extension of the departmental network. Use of the device is therefore governed 

by the same rules that apply to the network. 

264. Users must not make any protectively-marked calendar appointments due to the 

way that calendar information is stored on the device.

265. On any email system, messages received from untrusted networks (e.g. the 

Internet) may have a spoofed source address and may, therefore, not have 

come from what purports to be the sender. Users should be aware that this is 

equally true when using Apple iOS devices.

266. Users must not attempt to use iCloud (or iTunes) sync functionality to backup 

email, contacts, calendar appointments or anything else online. 

267. Users must not attempt to connect to any other email or social networking 

services via the built-in applications or settings menu on the device .

Telephony

268. No restrictions are placed on the use of the devices’ built -in telephony and SMS 

functionality by these Security Procedures. However, these messages must only

be UNCLASSIFIED. 

Mobile Data

269. Unclassified Internet and Intranet browsing are possible on the device, as all 

data traffic is passed through the departmental network and corporate browsing 

policy is applied. 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005064

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 92 of 118
UNCLASSIFIED

Page 93

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Applications

270. Users must never attempt to download or install applications on the device using 

email, the browser, Apple App Store or physical connections. The use of any 

third-party applications on your device must be done in accordance with your 

local security policy and guidance.

Overseas Use

271. In general, it is acceptable for users to carry and use iOS devices overseas, 

provided that their use has been accredited for such an environment in 

accordance with HMG IA Standard 1 & 2 (IS1 & 2), Informati on Risk 

Management (reference [v]). However, users must seek formal approval from 

their own department before doing so as there are a number of legal issues 

surrounding use overseas and carriage of cryptographic items which mus t first 

be considered. For information see, IS4 Supplement 8, Movement of 

Cryptographic Items (reference [w]). 

272. If using an iOS device overseas users must take extra care to ensure that their

use is not overlooked or overheard and must tak e all precautions to prevent the 

theft of their device.

Other

273. Users must not alter the device settings; in particular users must not remove the 

provisioning profile for Mobile Device Management (MDM), as this is required by 

network administrators to mainta in security of the device.

274. The device must never be connected to a user’s own personal computer or 

Portable Electronic Device (PE D), whether by Bluetooth, Wi -Fi or USB.

275. Users must not attempt to alter VPN settings or enable Wi -Fi as this could 

compromise the secure routing of enterprise -bound traffic.

276. The device should only ever be recharged with the provided USB power adapter 

and cable. 

277. Access to camera, Global Positioning Systems (GPS) or other peripherals is 

strictly prohibited unless explicitly stated otherwise in the departmental 

supplementary Security Procedures.

278. Users must not attempt to run unsigned code (e.g. jailbreak) or otherwise 

circumvent security controls on the iOS device.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005065

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 93 of 118
UNCLASSIFIED

Page 94

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Incident Response

279. This section discusses actions to be taken by devi ce users in the event of 

certain incidents and emergencies. Some of this guidance is dependent upon 

the procedures established by individual departments and should therefore be 

read in conjunction with departmental guidance.

280. If an iOS device is believed to be lost or stolen, users must contact the

departmental helpdesk so that the device can be remotely wiped.

281. If a user has any reason to believe that their password has been compromised,

it must be changed immediately. This can be done on the devic e or by 

contacting the helpdesk and requesting a password reset .

282. If a user forgets the password to their device they should contact the helpdesk 

and have their identity confirmed according to local procedures prior to a 

password reset taking place , or alternatively the user can reset the device 

password themselves through Microsoft Outlook Web Access service.

283. If an iOS device stops functio ning as normal, users should contact their

departmental helpdesk for further advice. The device must not be given by the 

user to a third-party (e.g. commercial repairer) to rectify any issues.

284. If a device shows signs of having been tampered with, the user must stop using 

it immediately, switch it off and inform their departmental helpdesk.

285. Devices should never receive une xpected profiles over any interface. Profile 

updates sent through the trusted MDM will happen without user interaction. 

Profiles downloaded by the user but generated by a trusted authority will request 

user confirmation of the installation.

286. Untrusted profiles contained within a .mobileconfig file which have not been 

signed by a trusted authority can still be installed but will present warnings. 

Users must never install profiles which are unsigned / unverified, and if one is 

received by email, SMS or browsin g the user must immediately inform their

departmental helpdesk as their device may have been targeted for attack.

287. The following page shows images of what untrusted and trusted configuration 

messages look like.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005066

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 94 of 118
UNCLASSIFIED

Page 95

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Message when installing a 

trusted Profile

Verified Profile from a 

Trusted Source

Unverified Profile from an 

Untrusted Source

Warning when installing 

an Unverified Profile

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005067

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 95 of 118
UNCLASSIFIED

Page 96

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

THIS PAGE IS INTENTI ONALLY LEFT BLANK

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005068

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 96 of 118
UNCLASSIFIED

Page 97

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Appendix D – Wi-Fi

Supplementary Guidance for Wi-Fi

288. This Chapter presents best-practice advice for the use of Wi -Fi on iOS for 

departments who have a business requirement to use Wi -Fi and are prepared to 

accept and manage the higher level of associated risk .

289. This guidance has been produced following feedback suggesting that some 

departments may still wish to use Wi -Fi on iOS devices; this section is not a 

CESG endorsement of Wi -Fi, the discussions presented in earlier Chapters 

contain the rationale behind w hy CESG does not endorse the use of Wi -Fi at this 

time.

290. The previous Chapters have described the challenges associated with the use of 

Wi-Fi on iOS devices.

291. It is important to understand that this Chapter stands in isolation from the rest of 

the document. Earlier Chapters recommend Wi-Fi is procedurally disabled and 

are written assuming that this remains the case at all times. By not complying 

with this recommendation, key risks will arise that have not been considered in 

the various sections of this docume nt. 

292. CESG have not formally risk -assessed the use of Wi-Fi as part of any official 

process. Departments wishing to use the Wi -Fi functionality must perform due -

diligence risk assessment work as part of their iOS procurement and deployment 

processes.

Risks

293. This section discusses some of the key additional risks departments will inherit 

by using the Wi-Fi functionality of iOS devices .

The lack of enforced enterprise routing (i.e. the APN) and sufficiently -

enforced VPN, combined with the ease of setting up a s poofed Wi-Fi 

access point significantly lowers the bar for attack . An attacker who 

subsequently acquires a trusted SSL certificate would then be able to man -

in-the-middle all enterprise and ActiveSync traffic

More network services are exposed on the Wi -Fi interface than are 

exposed on the cellular data interface (including Bonjour, iTunes Wi -Fi 

sync, Airplay). This results in an increased and richer attack surface on the 

devices’ networking stacks

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005069

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 97 of 118
UNCLASSIFIED

Page 98

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

The lack of an APN equivalent and device firewall on the Wi -Fi interface 

means services on that interface ca nnot be shielded from attackers

There is a significantly lower cost of entry attacking through Wi -Fi 

infrastructure compared with 3G infrastructure due to, amongst other 

factors, lower infrastructure costs as well as more widespread knowledge 

and skills

Authenticating to an untrusted Wi -Fi access point via a web portal (i.e. a 

captive portal) requires exposing the browser to a potentially hostile 

network without having enterprise controls in place, or require s the 

installation of a third-party application to automatically authenticate to the 

captive portal. Either case requires the parsing and execution of potentially 

untrusted third-party code on the device

A compromised device (e.g. Jailbroken) could use a W i-Fi connection as a 

means to exfiltrate sensitive data without traversing enterprise 

infrastructure (as was previously guaranteed by the APN) , thus evading 

protective monitoring

iOS devices will periodically rebroadcast SSIDs of previously associated 

Wi-Fi networks to speed up reconnection times. This informa tion could be 

used to identify Government employees who have previously connected to 

departmental Wi-Fi networks. At the very least, it provides an easily 

accessible history of previously used access points for a given device, 

therefore providing potentially sensitive user information that could be of 

use to an attacker

Best Practice Guidance

294. If a department chooses to use Wi -Fi, their implemented enterprise design 

should ideally:

Mutually authenticate all connections

Minimise the amount of traffic sent unencrypted

Ensure the VPN is connected as soon as possible after connectivity is 

established

Not require a captive portal for department -provisioned devices

Protect the enterprise infrastructure from at tacks coming from local Wi-Fi 

infrastructure

Protect the enterprise infrastructure from attacks coming from the Internet

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005070

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 98 of 118
UNCLASSIFIED

Page 99

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

295. Much of the advice in this section is derived from that given in the CESG 

Architectural Pattern on Wireless Networking (reference [x]).

296. There are essentially two scenarios for managed iOS devices to use Wi -Fi 

access points; either the Wi-Fi access points are a part of the same enterprise 

infrastructure as the enterprise components the device is attempting to c onnect 

to, or the infrastructure is hosted by a third -party. The following advice presented 

around these two cases is largely derived from Scenarios 2 and 3 in reference 

[x].

297. It is important to understand that there are no tech nical controls in iOS to assist 

departments in controlling access to these two types of network. By following 

this guidance, departments must realise that they require their end -users to 

make sensible decisions around which Wi -Fi network(s) it is appropria te to 

connect to.

298. It is important to understand also that the nature of the access points users will 

connect to is indicative of the level of risk they are exposing departmental data 

to by connecting. The following table roughly presents increasing levels of risk 

exposure resulting from connections to various types of Wi -Fi infrastructure.

Type of Wi-Fi Network

Enterprise-owned and managed

Increasing level of risk

Trusted second-party owned network 

(e.g. contractor or supplier)

Non-hostile wireless network (e.g. home 

Wi-Fi network, reputable private third -

party company network)

Potentially hostile wireless network (e.g. 

unprotected hotel or coffee -shop 

network)

Potentially hostile wireless network with 

captive portal 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005071

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 99 of 118
UNCLASSIFIED

Page 100

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Network Architecture

Scenario 1 – Enterprise Infrastructure

Figure 2 – Enterprise Wi-Fi architecture

299. For full details on the recommended enterprise infrastructure, see reference [x]. 

The key components of this architecture are summarised here:

WPA2-Enterprise is used to secure the physical layer of the wireless LAN. 

Devices connecting are required to present a valid certificate to the 

Authentication Server in order for the infrastr ucture to permit the 

connection

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005072

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 100 of 118
UNCLASSIFIED

Page 101

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

A Wireless Access Server (e.g. RADIUS) is used to auth enticate the 

connecting devices

A firewall restricts all wireless traffic to only the VPN endpoint

The VPN connection is appropriately configured as described in Chapter 6

Configuration of the security protocols are as described in Manual Y, Use 

of WPA2 unevaluated wireless technology in Government systems 

(reference [y])

300. In addition, VPN triggers (see Appendix A) must be set up to ensure that the 

VPN connects whenever the Wi-Fi connection is established. To configure this 

using Apple Configurator or a MDM server:

Create a Wi-Fi profile containing the necessary settings for the wireless 

network(s) the device will connect to

Configure the Wi-Fi profile’s proxy server setting to be an internal proxy 

which is inside the enterprise infrastructure

Configure the VPN trigger (in the VPN profile) to contain the proxy server’s 

address as a trigger for the VPN connection

301. By using a MDM server or Apple Configurator to set Wi -Fi policies in this way,

devices can automatically connect to the trusted networks you configure. 

However, as wireless networks can only initially be identified by their SSID, iOS 

devices will attempt to connect to any network with the same SSID as your 

trusted Wi-Fi access point. Thus it remains important for departments hosting

wireless infrastructure to frequently survey the surrounding area for rogue 

access points which may be attempting to spoof your internal n etwork. 

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005073

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 101 of 118
UNCLASSIFIED

Page 102

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Scenario 2 – Third-party Infrastructure

Figure 3 – Third-party Wi-Fi architecture

302. As no control can be exerted over the nature of third -party infrastructure, iOS 

devices connecting to infrastructure must protect themsel ves from attack until a 

secure VPN connection to the enterprise can be established. 

303. The most robust way of achieving this is to follow the guidance in Appendix A 

and configuring the VPN to trigger on all connection attempts by supplying the 

domain wildcard VPN triggers.

304. From iOS 6.0, the Global Proxy setting can be used to the same effect:

Configure the Global Proxy to be the address of an internal proxy server

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005074

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 102 of 118
UNCLASSIFIED

Page 103

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Configure the VPN triggers to be the address of the internal proxy server

In this way, all connections will attempt to be routed through the proxy server 

which will in turn trigger the VPN connection.

305. Note that both of these methods will prevent networks with captive portals from 

working, whether they use a webpage or an application to do the authent ication. 

To be able to use captive portals, the user will need to be given manual control 

of the VPN and triggers cannot be set. This must be avoided where possible.

Other Considerations

306. As discussed earlier, departments should be aware that the iOS VPN co nnection 

is not guaranteed to be active before data is passed across it. As such, there is 

a risk that data may pass unprotected across untrusted networks, and moreover 

that this failure to bring up the VPN may be coercible by an attacker. As such, it 

becomes even more important to protectively monitor incoming connections for 

irregularity. One example would be to monitor the corporate network for 

incoming ActiveSync connections which aren’t protected by the VPN. This would 

give some indication that a devic e has failed to correctly establish the VPN.

307. Departments should also be aware that it may be possible to bridge the internal 

corporate network to an external untrusted Wi -Fi network using the two physical 

networking interfaces of the device. For example, i f the iOS device establishes a 

VPN connection over the cellular interface to the enterprise whilst also 

maintaining connectivity to a local Wi -Fi connection, the device is acting as a 

bridge between those two networks. This risk is even greater in iOS 6.0 with the 

introduction of the Wi-Fi plus cellular feature.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005075

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 103 of 118
UNCLASSIFIED

Page 104

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

THIS PAGE IS INTENTI ONALLY LEFT BLANK

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005076

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 104 of 118
UNCLASSIFIED

Page 105

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Appendix E –Third-Party Applications

Introduction

308. This Chapter discusses the possible ways departments can technically deploy 

applications, the risks they inh erently accept in doing so and some suggested 

risk-treatment activities that may reduce these risks.

Risks

309. By default, third-party applications can access user data in a variety of storage

locations. In iOS 6, some locations now require a user prompt befor e an 

application can access them. These locations are:

Calendar

Contacts

Reminders

Camera (and saved photos)

Current location

Bluetooth file shares

Facebook Account Information

Twitter Account Information

310. Third-party Applications can, without user promptin g, additionally access:

Device unique identifiers

Hardware information

Microphone

Enterprise network infrastructure (if on VPN)

Local Wi-Fi services (if on Wi-Fi)

Network information (e.g. Carrier name, signal strength, network addresses)

311. Users are also free to ‘give’ data to applications, e.g. a user may choose to open 

an e-mail attachment using a third -party application. In this case, the application 

is given a copy of that attachment and could, for example, copy the contents to a 

cloud storage location, or may write the file to storage in a lesser -protected data 

protection class (See Chapter 4) than it was previously stored in with the e -mail 

client.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005077

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 105 of 118
UNCLASSIFIED

Page 106

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

312. iOS 6 also introduces the Sharing menu, where various parts of the operating 

system feature a share button. Text, photographs and files could easily be 

deliberately or accidentally shared with a third -party application via this 

mechanism.

313. The following non-exhaustive list briefly highlights some risks departments could 

be exposed to by the presence of a third-party application.

One of the main objectives of an attacker looking to compromise a system 

is to have their code running on the system. Allowing an attacker -controlled 

third-party application to run on the device makes it easier for an atta cker 

to achieve that first step

A badly written application could increase the attack surface which an 

attacker can use to gain execution on the device

A badly written application could inadvertently leak sensitive information 

(e.g. for usage stats) in a non -secure way which could be intercepted and 

used maliciously

Apps may be able to evade enterprise protective monitoring in a way that a 

web-based application cannot ( e.g. by opening direct network sockets to 

the Internet)

An installed application may mis use Data Protection, thereby weakening

the protections already in place around sensitive data st ores such as email attachments

Similarly, an application with access to sensitive data may transmit that 

data in an insecure manner

A third-party application may simulate Interprocess -communication through 

the use of URL handlers. This may allow the third -party application to 

sense which applications are installed on the platform and targ et one for 

further exploitation

The presence of a third-party application may increase the likelihood of 

accidentally sending sensitive data outside the enterprise (e.g. by 

accidentally opening a sensitive e -mail attachment in a social media 

application)

Strategies

314. There are essentially six strategies which an enterprise can adop t to help 

manage the risks from third-party applications on iOS devices:

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005078

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 106 of 118
UNCLASSIFIED

Page 107

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Deployment Strategy

No third-party applications permitted

Increasing level of risk

Installation of vetted third-party or inhouse applications is only permitted from 

an enterprise catalogue or pushed by a 

MDM solution, as supported by a trusted 

administrator.

Third-party application installation is only 

permitted from an enterprise catalogue or 

pushed by an MDM solution, as 

approved by a trusted administrator.

Arbitrary app-store application installation 

permitted, using white- or black-listing as 

supported by MDM.

Arbitrary app-store application installation 

permitted, manually audited through 

MDM.

Arbitrary app-store application installation 

permitted.

315. CESG recommends that departments adopt the strategy with the minimum level 

of risk that is viable for their particular deployment.

316. Installing applications using MDM Push requires using a MDM server which 

supports wireless application deployment.

317. Users are required to accept and confirm all over -the-air application 

deployments. Users can decline their installation. Using Configurator does not 

prompt for confirmation. For some types of application, the MDM may require to 

temporarily allow app installation on the d evice; this permission should only be 

transitory and be disabled after deployment of the application completes.

318. Application push methods which require the application to be downloaded from 

the App Store (VPP and App Store URL) will require the user to have an Apple 

ID account and to enter their password at the time of push. Paid apps purchased 

in this way will be charged to that account , unless already paid for using VPP .

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005079

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 107 of 118
UNCLASSIFIED

Page 108

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Mitigations

319. Departments wishing to use a third -party application should perform due -

diligence assessments of the application they wish to use and of the developer 

of that application.

320. Ensure all software installed on the device is from a trusted, reputable source, 

which practices code auditing and quality control. CESG is unable to provide any 

guidance with respect to specific third-party applications or developers but 

recommends that departments use the same approach for vetting applications 

as they do for other systems.

321. Set the Allow App Installation policy to No. This prevents users from 

downloading and installing arbitrary third-party software onto their device; CESG 

strongly recommends that third-party applications are centrally managed from 

the MDM.

322. Ensure iOS devices and server components are patched quickly in response to 

new vulnerabilities or when security updates are made available .

Mitigations for Custom -Developed Applications

323. Departments that wish to have a custom iOS application developed by a thirdparty need to consider the risks involved. When the application is installed on 

iOS, it will be implicitly trusted by the device and given the permissions required. 

The organisation needs to understand the risk of an application abusing these 

permissions (i.e. abusing the application’s access to sensitive data).

324. The application developer should be chosen carefully. There are several issues 

to consider (sample questions are not exhaustive):

Developer Background

What background does the developer have in information and application 

security? 

How much experience does the developer have in writing iOS

applications? 

Departments need to be confident that the developer has not only good 

track record in iOS application development, but also clearly defined 

processes for software development. Ultimately a department needs to be 

confident with the professional credentials of the developer.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005080

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 108 of 118
UNCLASSIFIED

Page 109

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

Developer Coding Practices

What source code analysis tools are used to minimise security flaws?

Are there any good practice coding standards applied to all developers?

How much third-party code does the developer use?

Are defensive compiler technologies such as Position Independent 

Execution used?

Departments need to be confident that the developer is able to write 

secure code, as well as applying a consistently high standard of coding

throughout their development team. Identify their coding standards and 

compare them to established standards, such as ISO90003 or CESG IA 

Developers’ Notes No. 6, Coding Requirements and Guidance (reference 

[z]). The application must not significant ly increase the attack surface of the 

overall iOS platform or associated enterprise infrastructure.

Developer Audit Control

What source code audit controls exist?

Is source code access limited to only those developers that are required?

Departments need t o have confidence that whilst their application is being 

developed, that it is not being maliciously altered. Source code must have 

non-repudiated audit controls (i.e. all changes to source code must be 

attributed to the developer who made the change). Add itionally source 

code access could be limited to only those that require access.

Developer Security Environment 

What physical measures are in place to prevent source code access? 

What software/hardware measures are in place to prevent source code 

access?

Departments need to have confidence that it is reasonably difficult for an 

adversary to gain access to and alter source code. Source code servers 

that have external network connections (i.e. Internet) should not be used 

unless it can be extensively proven that the integrity of the source code can 

be maintained.

Developer Documentation

How much code commenting is there?

How much design and code structure documentation is there?

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005081

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 109 of 118
UNCLASSIFIED

Page 110

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Departments need to ensure that developers extensively comment code in 

case of a third-party review (see below) of the source code. Similarly, 

design and code structure documents should exist.

325. The purpose of an independent third-party review is to ensure that:

The application does not abuse the permission(s) granted to it (for exampl e, 

Application Programming Interfaces (APIs) are called only when required)

There exists no (potentially malicious) additional functionality that was not 

specified by the department

The application is written with security in mind

The source code reviewed by the third-party matches the built version 

running on departmental devices

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005082

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 110 of 118
UNCLASSIFIED

Page 111

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

References

[a] CESG Security Procedures, Apple iOS 4.3, Issue 1.0, April 2011, 

(UNCLASSIFIED). Available from the CESG IA Policy Portfolio

[b] CESG IA Notice 2012/07, Bring Your Own Dev ice: The Risks from Personal 

Devices, May 2012, (UNCLASSIFIED). Available from the CESG IA Policy 

Portfolio

[c] HMG IS 1 and 2 Supplement, Technical Risk Assessment and Risk Treatment , 

Issue 1.0, April 2012, (UNCLASSIFIED). Available from the CESG IA Policy 

Portfolio

[d] Apple iOS Security

May 2012

http://images.apple.com/ipad/business/docs/iOS_Security_May12.pdf

[e] Apple Configurator software

Version 1.2

http://itunes.apple.com/gb/app/apple -configurator/id434433123

[f] CESG IA Notice 2012/10, Mobile Device Security Applications , July 2012,

(UNCLASSIFIED). Available from the CESG IA Policy Portfolio

[g] Apple App Developer Guide

http://www.apple.com/business/accelerator/

[h] CESG Architectural Pattern, Walled Gard en for Remote Access , Issue 1.0, 

March 2011, (UNCLASSIFIED). Available from the CESG IA Policy P ortfolio

[i] HMG Security Policy Framework, Tiers 1 -3 (Not Protectively Marked) are 

available at: http://www.cabinetoffice.gov.uk

[j] CESG Good Practice Guide No. 12, Use of Virtualisation Products for Data 

Separation: Managing the Security Risks, Issue 2.0, July 2012 

(UNCLASSIFIED). Available from the CESG IA Policy Portfolio

[k] CESG Commercial Product Assurance Security Characteristic – IPsec VPN for 

Remote Working – Software Client

Issue 1.2, August 2012, UNCLASSIFIED

http://www.cesg.gov.uk/servicecatalogue/CPA/Pages/Security -

Characteristics.aspx

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005083

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 111 of 118
UNCLASSIFIED

Page 112

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

[l] CESG Commercial Product Assurance Security Characteristic – IPsec Security 

Gateway

Issue 1.2, August 2012, UNCLASSIFIED

http://www.cesg.gov.uk/servicecatalogue/CPA/Pages/Security -

Characteristics.aspx

[m] Apple: Deploying iPhone and iPad Mobile Device Management

http://images.apple.com/ipad/business/docs/iOS_MDM.pdf

[n] HMG IA Standard No. 7 , Authentication of Internal Users of ICT Systems 

Handling Government Information , Issue 1.0, October 2010, (UNCLASSIFIED). 

Available from the CESG IA Policy Portfolio

[o] CESG Good Practice Guide No. 7, Protection from Malicious Code , Issue 1.1, 

October 2012, (UNCLASSIFIED). Available from the CESG IA Policy Portfolio

[p] Apple Security Updates website, 

http://support.apple.com/kb/HT1222

[q] HMG Information Assurance Stan dard No. 5, Secure Sanitisation, Issue 4.0, 

April 2011 (UNCLASSIFIED). Available from the CESG IA Policy Portfolio

[r] Apple Security-Announce RSS Feed

http://rss.lists.apple.com/security -announce.rss

[s] CESG Good Practice Guide No. 10, Remote Working , Issue 2.2, September 

2012, (UNCLASSIFIED). Available from the CESG IA Policy Portfolio

[t] CESG Good Practice Guide No. 13, Protective Monitoring for HMG ICT 

Systems, Issue 1.7, October 2012 (UNCLASSIFIED). Available from the CESG 

IA Policy Portfolio

[u] Good Practice Guide No. 9 , Taking Account of the Aggregation of Information ,

Issue 1.2, March 2009, (Not Protectively Marked). Available from the CESG IA 

Policy Portfolio

[v] HMG Information Assurance Standard No. 1 & 2, Information Risk Management, 

Issue 4.0, April 2012 (UNCLASSIFIED). Available from the CESG IA Policy 

Portfolio.

[w] HMG IS4 Supplement 8, Movement of Cryptographic Items , Issue 1.0, April 

2011, (UK RESTRICTED). Available from the CESG IA Policy Portfolio

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005084

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 112 of 118
UNCLASSIFIED

Page 113

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

Apple iOS

[x] CESG Architectural Pattern, Wireless Networking. (Under production, 

forthcoming)

[y] CESG Infosec Manual Y, Use of WPA2 unevaluate d wireless technology in 

Government systems , Issue 1.0, January 2007, (UK RESTRICTED). Available 

from the CESG IA Policy Portfoli o

[z] IA Developers’ Notes No. 6 - Coding Requirements and Guidance , Issue 1.0, 

June 2009, (Not Protectively Marked) Available from the CESG IA Policy 

Portfolio

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005085

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 113 of 118
UNCLASSIFIED

Page 114

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

UNCLASSIFIED

THIS PAGE IS INTENTI ONALLY LEFT BLANK

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005086

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 114 of 118
<INSERT THE PROTECTIVE MARKING ON COMPLETION >

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

<INSERT THE PROTECTIVE MARKING ON COMPLETION >

Apple iOS

Customer Feedback

CESG Information Assurance Guidance and Standards welcomes feedback and 

encourage readers to inform CESG of their experiences, good or bad in this 

document. We would especially like to know about any inconsistencies and 

ambiguities. Please use this page to send your comments to:

Customer Support

CESG

A2b

Hubble Road

Cheltenham GL51 0EX

(for the attention of IA Policy Development Team)

Fax: (01242) 709193 (for UNCLASS IFIED FAXES ONLY)

Email: enquiries@cesg.gsi.gov.uk

For additional hard copies of this document and general queries please contact 

CESG enquiries at the address above

PLEASE PRINT

Your Name:

Department/Company Name and Address:

Phone number:

Email address:

Comments:

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005087

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 115 of 118
<INSERT THE PROTECTIVE MARKING ON COMPLETION>

This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information 

legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email infoleg@gchq.gsi.gov.uk

<INSERT THE PROTECTIVE MARKING ON COMPLETION >

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005088

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 116 of 118
UNCLASSIFIED

UNCLASSIFIED

CESG Security Procedures are issued by the UK Technical Authority for Information 

Assurance with the aim of informing intended recipients of the general security issues 

they should consider in their approach to information and communications 

technologies. They are not a replacement for tailored technical or legal advice on 

specific systems or issues. GCHQ/CESG and its advisors accept no liability 

whatsoever for any expense, liability, loss, claim or proceedings arising from reliance 

placed on this guidance.

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005089

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 117 of 118
UNCLASSIFIED

UNCLASSIFIED

IA 

CESG 

A3e

Hubble Road

Cheltenham

Gloucestershire

GL51 0EX

Tel: +44 (0)1242 709141

Fax: +44 (0)1242 709193

Email: enquiries@cesg.gsi.gov.uk

© Crown Copyright 2012. Communications on CESG telecommunications systems may be monitored 

or recorded to secure the effective operation of the system and for other lawful purposes. This 

information is exempt under the Freedom of Info rmation Act 2000 and may be exempt under other UK 

Information legislation. Refer any FOIA queries to GCHQ on 01242 221491 x30306 or email 

Infoleg@gchq.gsi.gov.uk .

HIGHLY CONFIDENTIAL - ATTORNEYS' EYES ONLY APL-GRACE_00005090

Case 5:17-cv-00551-LHK Document 285-31 Filed 10/18/18 Page 118 of 118