Add guidance for iOS NSUserDefaults rule

guidance/DS191340.md

@@ -1,11 +1,21 @@
-## Do not store sensitive data in NSUserDefaults.
+# Do Not Store Sensitive Data in NSUserDefaults
 
-### Summary
-Do not store sensitive data in NSUserDefaults.
+## Summary
 
-### Details
-TO DO - put more details of problem and solution here
+* Code was found that stores a secret such as a password or key in `NSUserDefaults`.
+* Consider another secret storage mechanism such as the Keychain API.
 
-### Severity Considerations
-TO DO - put more details on the severity of the issue here.  Generally how big of a problem is this, and what makes it more or less of a problem?
+## Details
 
+The keys and values saved in `NSUserDefaults` are stored in an unencrypted file that can be easily viewed.
+Therefore, `NSUserDefaults` is not a secure way to store secrets.
+Secrets should be stored using a different mechanism such as the Keychain API.
+
+## Severity Considerations
+
+The severity of this issue depends on the sensitivity of the secret and the impact of any attack leveraging that secret.
+
+## References
+
+* [Apple iOS API Documentation: Keychain services](https://developer.apple.com/documentation/security/keychain_services)
+* [OWASP Testing Guide: iOS Data Storage](https://mas.owasp.org/MASTG/iOS/0x06d-Testing-Data-Storage/)