Chapter 6 Security 53
Users can make sure that data protection is enabled on their device by looking at the passcode
settings screen. Mobile device management solutions are able to query the device for this
information as well.
There are also data protection APIs for developers, which can be used to secure data within
App Store apps or custom-developed in-house apps. With iOS 7 or later, data stored by apps is,
by default, in the security class “Protected Until First User Authentication.” This is similar to full-
disk encryption on desktop computers, and protects data from attacks that involve a reboot.
iOS 8 includes data protection for Calendars, Contacts, Messages, Notes, Reminders, and
managed books and PDFs.
Note: If a device is upgraded from iOS 6, existing data stores aren’t converted to the new class.
Removing and reinstalling the app causes the app to receive the new protection class.
Encryption
iOS devices use hardware encryption. Hardware encryption uses 256-bit AES to protect all data
on the device. Encryption is always enabled, and cannot be disabled. Additionally, data backed
up in iTunes to a user’s computer can be encrypted. This can be enabled by the user, or enforced
by using device restriction settings in conguration proles.
The cryptographic modules in iOS 6 or later have been validated to comply with U.S. Federal
Information Processing Standard (FIPS) 140-2 Level 1. This validates the integrity of cryptographic
operations in Apple apps and third-party apps that properly use iOS cryptographic services.
For more information, see the Apple Support articles iOS product security: Validations and
guidance and Apple FIPS iOS Cryptographic Modules v4.0.
Per-message S/MIME
iOS 8 and OS X Yosemite support per-message S/MIME, so S/MIME users can choose to always
sign and encrypt by default or selectively sign and/or encrypt individual messages for greater
control over the security of each mail message.
Certicates for use with S/MIME can be delivered to the Apple device using a conguration
prole, MDM, or SCEP. This gives IT the exibility needed to ensure that users always have the
appropriate certicates installed.
External email addresses
iOS 8 and OS X Yosemite support creating a domain list of specic suxes. Mail messages that
aren’t addressed to domains in the approved list are marked in red. For example, a user could
have both example.com and group.example.com in their list of known domains. If a user with
example.com and group.example.com in their known domains list were to enter anyone@
acme.com in a Mail message, that address would be clearly marked so the user would know the
domain acme.com wasn’t on their approved list.
Touch ID
Touch ID is the ngerprint-sensing system built into some iOS devices, making highly secure
access to the device faster, easier, and more secure. This technology reads ngerprints in any
orientation and learns more about the user’s ngerprint over time, with the sensor continuing to
expand the ngerprint map as additional overlapping nodes are identied with each use.
Touch ID makes using a longer, more complex passcode more practical, because the user doesn’t
have to enter it as often.
100% resize factor
