iOS Security Controls

by Jacob Moorman
Independent
[email protected]

Overview

I found my recent switch to an iPhone running iOS 18 very frustrating. The features, apps, and data migration were all just fine. But, as a privacy-conscious user, I struggled to acclimate to this platform's security features and controls. I spent a couple of weeks thinking about this problem, and this paper is the result of that work. I'm sharing this in case it is of use to others.

Existing Controls Guidance

As I worked to come up to speed on iOS 18 security, I read a few resources:

My Needs

Threat Modeling

Threat models identify potential risks. They should be tailored to the user, their devices, and environments to reflect the threats they will likely encounter.

Many threat modeling frameworks exist, including STRIDE, MITRE ATT&CK®, and Objective Threat Model (OTM). I designed OTM as part of this work, recognizing that I needed a threat model that better aligned with my concerns as a mobile device user.

To form my threat model, I asked GenAI for help, working with OpenAI ChatGPT and Anthropic Claude. I used a prompt like:

I am a privacy-conscious iPhone user who uses my phone at home, in a business setting, and while traveling. Please use the STRIDE, MITRE ATT&CK, and OTM (JSON provided) threat modeling frameworks to synthesize a realistic representation of threats I may encounter. Output a threat model structured using OTM categories.

The results served as a starting point.

Configuration Sequence

Device configuration should be sequenced to ensure preventative measures are present before the device can encounter related threats. For example, various device hardening should be performed before the device is ever connected to a network. Even private, "trustworthy" networks could be compromised.

Configuration sequence may be less concerning in institutional settings where device configuration occurs using configuration tools (Apple Configurator 2) or Mobile Device Management (MDM) platforms since a complete configuration can be loaded simultaneously. However, sequencing is quite essential when manually configuring devices individually.

To form a configuration sequence, I designed a model that considers the threats at different points in the device lifecycle. I then sorted available iOS 18 features, settings, and relevant third-party solutions in alignment with the model's time segments. For convenience, I've included links to Apple documentation where applicable.

This paper's primary contribution is the novel structuring of controls by time, which increases usability and forms a more straightforward narrative.

When What
Throughout the device lifecycle

Threat responses are focused on threat model deficiencies and increasing user awareness.

  • Prepare, update, or evaluate the threat model and business requirements to identify control needs
    • For a physician, "Business Requirements" might mean specific regulatory compliance requirements due to work with HIPAA-protected data
    • For the individual, we might think of "Business Requirements" as your risk appetite
  • Ensure appropriate tradeoffs between security and functionality
  • User training
Before device acquisition

Threat responses are focused on supply chain attacks and device acquisition practices.
Before the device is used

Threat responses are focused on physical security attacks and setup is performed before network connections are made.
Before network connection

Threat responses are focused on network-based attacks and appropriate network configuration.
Before applications are used

Threat responses are focused on application-based attacks and application management.
Before the device leaves physical control

Threat responses are focused on latent data and lifecycle management.
Before excess time passes

Threat responses are focused on undetected compliance issues and audits.

Tradeoffs

Regulatory requirements may compel companies and professional users to take a conservative approach that favors security. However, the individual user has greater flexibility and might favor functionality over security. In considering the various controls and decision points in implementing iOS 18, I generated this list of tradeoffs that can be considered when choosing which controls are appropriate:

Conclusion

While implementing controls as an individual user on iOS 18 was initially challenging, I hope this paper provides helpful information for others on that journey. Remember to right-size and right-time your controls based on your threat model and needs.

License

iOS Security Controls © 2025 by Jacob Moorman is licensed under Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)

This first release was made on 2025-01-08.