Container Checklist
Container Checklist
- Sensitive data (e.g. usernames, passwords or encryption keys) is not written to the filesystem unencrypted.
- Crash Data is not stored unencrypted outside the secure Container
- Data from the Containerized Application can not copy data outside the System
- Adding data to the Keyboard Cache should not be able to retrieve data outside the container
- Use long press to Share Data outside of the container
- Filenames relating to user data (such as downloaded files, cached files) are obfuscated or encrypted
- Log can not be viewed in the application
- Containerized data is not cached outside of the container unencrypted.
- When a device goes out of policy all container application information is deleted
- Bookmarks, Cookies and web history are properly stored within the encrypted container.
- A screenshot of a managed application’s UI is not saved or is obscured when switching between applications on the device.
- Screenshots are disabled while a managed application is being used.
- [iOS]
- Also Enable Assistive Touch and test
- [Android]
- Notifications containing information from within the container are disabled when a device goes out of policy.
- Filenames of files downloaded in a managed application are not disclosed in notifications.
- Managed applications implement a PIN or password lock screen.
- Managed applications have a lockout time with a PIN or password lock screen.
- [iOS] What is the Application timeout?
- Does the application need a PIN when the application is forcefully Killed?
- [Android] What is the Application timeout?
- Does the application need a PIN when the application is forcefully Killed?
- Users are not permitted to set a weak PIN (e.g. 1234, 0000, etc).
- [iOS]
- Also check if the iOS pin is not a weak PIN
- [Android]
- Also check if the Android pin is not a weak PIN
- Managed applications lock users out after a certain number of invalid PIN attempts
- Managed applications do not log sensitive data.
- Managed applications do not expose any Inter-Process Communication (IPC) endpoints insecurely.
- All traffic is sent through a secure tunnel.
- The browser application does not permit loading sites with insecure SSL/TLS settings
- Managed applications implement certificate pinning that cannot be bypassed by off-the-shelf tools.
- The solution implements root / jailbreak detection in a way that is difficult to reverse engineer and bypass.
- The solution implements runtime checks to prevent hooking and debugging.
- The solution implements binary integrity checks to prevent modifying and repackaging.
- Managed applications are obfuscated to make reverse engineering of critical components more difficult.