Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Since iOS 4, Apple data protection supports hardware based encryption of confidential information on the device. I looked around for best practices considering the use of Apple data protection, but found nothing comprehensive. If I understood this article about the limitations of Apple data protection correctly, one of the main elements is using a strong passcode on the mobile device. But how strong is strong enough?

Are there any best practices out there that should be considered when using Apple data protection?

share|improve this question
up vote 2 down vote accepted

For the passcode, you just need to use something that's not easily guessable by the attacker, who only has 10 attempts before access via passcode is disabled.

So no 0000 or 1234 or the year your kid was born or such like.

As well as this, other best practices would be:

  • Turn data protection on in the first place.
  • Protect the backups - this is way more important than protecting the device.
  • Train your users to report lost/stolen devices immediately so you can remote wipe them ASAP.
  • Don't assume all apps encrypt their data.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.