Update operating system to the latest version

Apple devices ship with the most current version of the operating system available when the device was manufactured, but new updates often address security vulnerabilities in addition to bug fixes and adding new features. Not all devices will support the most recent version of iOS. Upgrade to the latest supported version for your device. Instructions for updating iOS devices are at http://support.apple.com/kb/HT4623.

For high-security environments, plan on replacing devices every 2-3 years in order to stay current on operating system releases.

Do not Jailbreak iOS to sideload applications

Jailbreaking takes advantage of known vulnerabilities in the operating system to bypass and disable the security controls that prevent unauthorized software from executing in iOS. While this does allow the use of software that is not available in the App Store, it also significantly weakens the overall security of the device. Apple reviews all applications in the App Store to filter out malicious and infected software. While not perfect, this approach does reduce the ability of malware to spread on un-Jailbroken devices. Unlike traditional computers, virus scanners and anti-malware applications for mobile operating systems like iOS are not bundled with the operating system and not comparable to their desktop counterparts in their ability to detect and quarantine malicious software. Thus, the so-called walled garden approach taken by Apple adds a significant layer of security and a hurdle for malware developers to overcome. Some applications are now checking for Jailbroken devices and refusing to install on them as well out of (misguided) piracy concerns.

Additionally, Jailbreaks may prevent you from upgrading to newer versions of iOS as they become available, as it takes time for the groups responsible for Jailbreaks to identify and exploit vulnerabilities in newer versions of iOS. Upgrading may mean losing your Jailbreak and the applications you've installed from other sources, but not upgrading may expose you to the security vulnerabilities that were addressed by the newer version of iOS.

You should understand that by Jailbreaking your device, you are taking on increased responsibility for securing your device and protecting yourself from malicious software. Devices used with Category I data should not be Jailbroken.

Enable Automatic Downloads of App Updates

Application updates often address security vulnerabilities in addition to bug fixes and adding new features. It is recommended that applications, especially those used to interact with The internet and web-based services (e.g. Internet browsers) be updated frequently. This feature will automatically download and install application updates when they become available.

To enable:

1. Tap Settings.
2. Tap iTunes & App Store.
3. Turn on Updates in the Automatic Downloads configuration list.

Enable remote wipe functionality

The intent with this is to ensure that if the device is lost, the data can be erased remotely.  There are number of ways to accomplish this with iOS:

Austin Exchange Messaging Service provides this functionality to synchronized devices.  Device wipes can be requested by the Exchange server administrator or initiated by the account holder through Outlook Web Access under Options > Mobile Devices.

Apple's iCloud service provides, among other things, the ability to track GPS enabled devices, display messages on the screen, lock a device, and wipe all data.  These features are provided free of charge to owners of iPhone 4 and newer, iPod Touch 4th generation and newer, and all iPad devices, but this does need to be setup on the device in advance (i.e. it can't be done after the device is lost). This feature is called Find My iPhone, which is discussed in more detail later.

Enable Find My iPhone

Find My iPhone is a free service provided by Apple that allows users to track and remotely lock or erase an iDevice. Despite the name, this service also works with iPad and iPod Touch devices. A free iCloud account is required to use this service. If a device is lost or stolen, having this service enabled may allow the owner to find and recover the device with the assistance of the University Police Department (UTPD). Even if recovery of the device isn't possible, the ability to remotely erase may protect any sensitive data that was stored on it. With iOS7 Apple introduced Activation Lock, so enabling Find My iPhone now also prevents someone from erasing and restoring a device without entering the iCloud username and password associated with it.

To enable Find My iPhone:

1. Tap Settings.
2. Tap iCloud.
3. Enter your iCloud username and password if not already configured.
4. Turn on Find My iPhone.
5. Tap OK.

If using iOS 8, enable Send Last Location:

1. Tap Settings.
2. Tap iCloud.
3. Tap Find My iPhone.
4. Turn on Send Last Location.

Encrypt device backups through iTunes

By default, backups of devices made in iTunes are not encrypted. This may expose sensitive data if the computer is lost or compromised. Additionally, data in the backup might be used to compromise the associated iOS device.

To enable encrypted backups, connect the iOS device to the computer, open iTunes, and check "Encrypt |LF||LF|devicetype|RF||RF| backup" under Options. Select a strong, complex password when prompted. 

Erase all data before return, repair, or recycle

In order to prevent an unauthorized person from being able to recover sensitive information from the device, the disk should be overwritten via the "Erase All Content and Settings" setting before it is out of your physical control. 

To securely erase a device:

1. Tap Settings.
2. Tap General.
3. Tap Reset.
4. Tap Erase All Contents and Settings.
5. If a passcode is configured, enter the passcode when prompted.

Require a passcode or password

Setting a passcode prevents casual unauthorized access to a device. A passcode is also required in order to enable Data Protection and take full advantage of the encrypted storage of all recent iOS devices.

To configure a passcode:

1. Tap Settings.
2. Tap General.
3. Tap Passcode Lock.
4. Tap Turn Passcode On
5. Enter a passcode and then tap Next
6. Enter the same passcode and tap Next again.

In addition to the default 4 digit passcode, Apple also supports the use of numeric passcodes greater than 4 digits and regular alphanumeric passwords. There have been examples of brute force attacks against passcodes that bypass the normal user log in mechanisms and attack the keychain directly to prevent data from being erased after 10 invalid attempts (which is the default behavior). Since a 4 digit passcode only has a maximum of 10,000 possible combinations, we recommend that users select a longer passcode or a password when possible. iOS will present the standard numeric keypad for entry regardless of the length of a passcode, so long as the passcode consists only of numbers. For high-security applications, it is recommended that a standard alphanumeric password be used instead of a passcode.

To configure a complex passcode or password:

1. Tap Settings.
2. Tap General.
3. Tap Passcode Lock.
4. Enter the current passcode if configured.
5. Turn off Simple Passcode.
6. Enter current passcode when prompted.
7. Enter a new, longer passcode or a password and tap Next.
8. Enter the new passcode or password again and tap Next.

Enable TouchID with a complex password

If the device supports TouchID (iPhone 5S and newer), configure a complex password (8 characters minimum with letters, numbers, and symbols) and enable TouchID. TouchID will allow you to authenticate to the phone without having to type in the password except when the phone is first turned on or when you have not authenticated to the phone via TouchID in more than 48 hours. Using a complex password instead of a passcode makes brute force attacks significantly harder and more time consuming, protecting the data on the phone better (the standard 4 digit passcode is defeatable in under 3 minutes). While TouchID is not perfect, this combination still represents better security than a simple passcode alone.

Set auto-lock timeout

This option automatically locks the device after it has been inactive for the specified amount of time.

To enable the auto-lock timeout:

1. Tap Settings. 
2. Tap General. 
3. Tap Auto-Lock. 
4. Tap “2 Minutes” or one of the other values.  Lower values are more secure.

Disable grace period for screen lock

The grace period allows the device to be unlocked after auto-locking without providing an unlock code.  Setting a value of "Immediately" will require the passcode to be entered regardless of when the device was last locked.

To disable the grace period for screen lock:
1. Tap Settings. 
2. Tap General. 
3. Tap Passcode Lock. 
4. Tap Require Passcode. 
5. Tap Immediately.

Erase data upon excessive passcode failures

Devices can be configured to automatically erase user settings and data after ten passcode failures.  As excessive passcode failures typically indicate the device is out of your physical control, enabling this may protect the confidentiality of information stored on the device.

To enable this option:

1. Tap Settings.
2. Tap General.
3. Tap Passcode Lock.
4. Enter the current passcode when prompted and tap Done.
5. Turn on Erase Data.
6. Tap Enable.

Enable Data Protection

With devices that support hardware encryption (iPhone 3GS and later, iPod Touch 3rd gen and later, and all iPads), iOS 4 and above allow applications to use an encryption key derived from your passcode to protect application data.  Enabling this feature is as simple as setting a passcode on the device.

To verify that data protection is enabled: 
1. Tap Settings. 
2. Tap General. 
3. Tap Passcode. 
4. "Data protection is enabled" should be displayed at the bottom of the screen.

Note: If the device originally shipped with iOS 3 (e.g. the iPhone 3GS, iPad, and iPod Touch), this feature will not be available until the device is restored after upgrading to iOS 4.  This feature is not available on older devices, such as the iPhone 3G and earlier models, at all, as they do not support hardware encryption.

It is important to understand that applications must be specifically designed to utilize data protection. Do not store or use sensitive data with applications that do not make use of data protection. 

With iOS 7 and above all third party applications and the native system apps such as Messages, Mail, Calendar, Contacts, and Photos make use of Data Protection to encrypt data.

Enable Fraud Warning in Safari

The Fraudulent Website Warning feature in Safari helps protect users from visiting potentially fraudulent Internet sites. If you navigate to a known fraudulent site covered by this service, Safari will not load the site and instead display a warning about its suspect nature. 

To enable:

1. Tap Settings.
2. Tap Safari.
   1. Turn on Fraudulent Website Warning.

Disable AutoFill for sensitive information

AutoFill will remember information entered into forms and then automatically fill in this information in matching fields on later forms. While this may be convenient, it also may result in the storage of sensitive information locally on the device. Additionally, automatically filling in fields on web forms could result in unintentional disclosure of sensitive data to unauthorized people. It is strongly recommended that, at a minimum, the storage of Credit Cards be disabled.

To disable AutoFill:

1. Tap Settings.
2. Tap Safari.
3. Tap Passwords & AutoFill.
4. Deselect the categories of information you do not want to be saved and automatically filled in.

Block cookies from third parties

Third party cookies are set by websites other than those specifically navigated to by you. These cookies are often used for tracking and may facilitate identification and behavioral analysis of users for the purposes of advertising. While third party cookies do not represent a specific security threat, they offer no benefit to end users and help erode online privacy.

To configure blocking of third party cookies:

1. Tap Settings.
2. Tap Safari.
3. Tap Block Cookies and select "From third parties and advertisers"

Turn on Do Not Track

The Do Not Track option instructs Safari to send a specific header in web requests that indicates the your preference not to be tracked by the websites you visit. Many sites have opted to honor this preference so there is some small privacy benefit from enabling it. It is important to note, however, that this feature is strictly voluntary and web sites are under no obligation to honor it. There are no guarantees that any specific web site will now, or, in the future, continue to, obey this header.

To turn on Do Not Track:

1. Tap Settings.
2. Tap Safari.
3. Turn on Do Not Track.

Turn off Ask to Join Networks

By default, iOS devices will prompt you to join an unknown network, if any are detected, when no networks that have previously been connected to are available. The issue is that anyone can run a wireless hotspot and, joining a poorly configured or insecure network could allow a malicious user on that same network to intercept, capture, and alter any network traffic sent by a user. In fact, many attackers will intentionally run wireless networks in popular, crowded areas, like airports and coffee shops, hoping to lure unsuspecting users into connecting. If this feature is disabled, you must manually select a wireless network to join from a list of detected available networks. This may reduce the risk of inadvertently joining a similarly named yet untrusted network (e.g. “defualt” instead of “default”).

To disable Ask to Join Networks:

1. Tap Settings.
2. Tap Wi-Fi.
3. Turn off “Ask to Join Networks”.

Turn off AirDrop when not in use

AirDrop is a service that provides a very simple and easy way to transfer files and information between iOS devices. As with all such services, it is safer to have it enabled only when it is actively being used and you are expecting to transfer or receive files.

To turn AirDrop off:

1. Open the Control Center by swiping up from the bottom of the iOS 7 screen.
2. Tap AirDrop.
3. Tap Off.

Turn off Bluetooth when not in use

Disabling Bluetooth reduces the remote attack surface of devices and may also prevent you from unintentionally connecting to unknown Bluetooth services and devices. Bluetooth should be enabled only when it is actively being used.

To turn off Bluetooth:

1. Tap Settings.
2. Tap Bluetooth.
3. Turn off Bluetooth.

Turn off Personal Hotspot when not in use

The Personal Hotspot feature allows devices with cellular data connections to share their network connectivity with other devices over Bluetooth, Wi-Fi, or USB. This feature should be disabled when not in use to prevent unauthorized usage and reduce the remote attack surface of the device.

To turn off Personal Hotspot:

1. Tap Settings.
2. Tap Cellular.
3. Tap Personal Hotspot.
4. Turn off Personal Hotspot.

Forget Wi-Fi networks to prevent automatic rejoin

By default, an iOS device will remember and automatically rejoin networks that it has previously associated with. The problem with this is a trusted but unauthenticated Wi-Fi network may be spoofed and then automatically joined. Additionally, if previously joined network has a common SSID, such as “default” or “linksys”, it is very probable that the device will encounter an untrusted instance of a same-named Wi-Fi network and automatically join it.

To forget a remembered or connected Wi-Fi network:

1. Tap Settings.
2. Tap Wi-Fi.
3. Locate the Wi-Fi network to forget and tap the Detail Disclosure button.
4. Tap Forget this network.
5. Tap Forget.

Note: the Wi-Fi network must be in range for it to appear in the list of available networks to forget; if the Wi-Fi network is no longer in range, the user must reset all network settings, which will forget all Wi-Fi networks.

Turn off Location Services

Location Services allows installed applications and visited websites the ability to request your current location. Once access is granted to an application, the application may request the data again at any time with no further notification to users.

To turn off Location Services:

1. Tap Settings.
2. Tap Privacy.
3. Tap Location Services.
4. Turn off Location Services.
5. Tap Turn off on the confirmation dialog.

Restrict access to Location Services, Contacts, Photos, etc.

With iOS 7, application access to Location Services, Contacts, Photos, Calendars, and similar user data can all be controlled and restricted on a per application basis. Applications will prompt for access to this user data once, and afterwards changes can be made in Settings -> Privacy and selecting the specific type of information that was requested. So instead of disabling Location Services, for example, you could go to Settings -> Privacy -> Location Services and specifically choose the applications you wish to allow to access your current location. Location Services in particular is unique as this service can also be configured to place an icon in the status bar when in use as a visual notification that an app is accessing your location.

It is strongly recommended that users go through this setting and disable access to personal and confidential data from applications that have no need of it. Additionally, some forms of advertising (e.g. location based iAds) and ad tracking can be disabled and limited here.

Disable access to Control Center on Lock Screen

The Control Center introduced in iOS 7 allows users to quickly access certain frequently used settings and applications without having to unlock the device. Almost immediately after the release of iOS 7, a vulnerability was found in this feature that allowed anyone with physical access to the device to bypass the lock screen and access a significant amount of potentially sensitive data on a device. While this specific flaw was fixed with iOS 7.0.2, the nature of the Control Center and the applications it grants access to both make it a valuable target for attackers. Disabling access to the Control Center from the Lock Screen could help mitigate any future bypass exploits that are found. The Control Center is still available with this setting, the device just has to be unlocked first.

To disable the Control Center from the Lock Screen:

1. Tap Settings.
2. Tap Control Center.
3. Turn off Access on Lock Screen.

Disable TouchID

On iPhone 5S and newer devices, TouchID allows a fingerprint to unlock the device in place of entering a passcode/password. While TouchID is substantially better than not having a passcode at all, the best option for high security environments is still a strong alphanumeric password. TouchID has also been bypassed, although not in a way that would make it less viable or secure for most users. Despite this, questions do remain as to what data Apple is capturing in order to facilitate TouchID and how this data is stored and accessed. As with all biometric identification schemes, users should exercise extreme caution before use, as you can't change the aspects of your person that these systems use if they turn out to be untrustworthy (that is to say, you can't change your fingerprints).

To disable TouchID:

1. Tap Settings.
2. Tap General.
3. Tap Passcode & Fingerprint.
4. Tap Fingerprint.
5. Turn off Passcode Unlock for the Fingerprints setting.
6. Follow the steps in control 8 above to set a complex password.

While disabling TouchID and setting a complex password is the most secure configuration, it obviously is the least usable configuration as this complex password has to be entered every time to unlock the device. TouchID combined with a complex password is more secure than a simple passcode alone, while still convenient to use. Don't disable TouchID only to use a 4 digit passcode.

Enable Private Browsing in Mobile Safari as needed

Private Browsing is a mode that can be enabled in Safari that will prevent the browser from tracking your browsing history, performed searches, or use any AutoFill information. This is useful for protecting privacy and thwarting advertiser tracking. Note that this mode only persists for the selected session.

To enable Private Browser for a Safari session:

1. Tap Safari.
2. Tap the Safari button at the lower right of the screen.
3. Tap Private.
4. Select "Close All" or "Keep All" on the "Close All Pages?" dialog box.

Disable JavaScript in Mobile Safari

Ideally JavaScript should only be available when browsing trusted websites. In high security environments, it may make sense to disable JavaScript as a method of hardening the browser against malicious web sites. This is not recommended for most users as JavaScript is heavily utilized by typical modern web applications.

To disable JavaScript:

1. Tap Settings.
2. Tap Safari.
3. Tap Advanced.
4. Turn off JavaScript.