Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

LG Android 5.x Interim Security Configuration Guide

V1R2 · · · Released 25 Sep 2015 · 39 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

This Interim Security Configuration Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.
Sort by
a
The LG Android 5.0 platform must be configured to enforce a minimum password length of 6 characters.
IA-5 - Low - CCI-000205 - V-58769 - SV-73199r1_rule
RMF Control
IA-5
Severity
L
CCI
CCI-000205
Version
LGA5-10-000100
Vuln IDs
  • V-58769
Rule IDs
  • SV-73199r1_rule
Password strength is a measure of the effectiveness of a password in resisting guessing and brute force attacks. The ability to crack a password is a function of how many attempts an adversary is permitted, how quickly an adversary can do each attempt, and the size of the password space. The longer the minimum length of the password is, the larger the password space. Having a too-short minimum password length significantly reduces password strength, increasing the chance of password compromise and resulting device and data compromise. SFR ID: FMT_SMF.1.1 #01
Checks: C-59613r2_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Password length" setting in the MDM console. 2. Verify the setting for the password length equals or is greater than the required length. On The LG Android device: 1. Unlock the device 2. Navigate to the password entry screen: Settings >> Lockscreen >> Select screen lock >> Password 3. Attempt to enter a password with a length less than the required value. If the configured value of the "Password length" setting is less than the required length, or if device accepts a password of less than the required length, this is a finding.

Fix: F-64153r1_fix

Configure the mobile device to enforce a minimum password length of 6 characters. On the MDM Administration Console, set the "Password length" value to 6 or greater.

b
The LG Android 5.0 platform must be configured to lock the display after 15 minutes (or less) of inactivity.
AC-11 - Medium - CCI-000057 - V-58771 - SV-73201r1_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000057
Version
LGA5-10-000200
Vuln IDs
  • V-58771
Rule IDs
  • SV-73201r1_rule
The screen lock timeout must be set to a value that helps protect the device from unauthorized access. Having a too-long timeout would increase the window of opportunity for adversaries who gain physical access to the mobile device through loss, theft, etc. Such devices are much more likely to be in an unlocked state when acquired by an adversary, thus granting immediate access to the data on the mobile device. The maximum timeout period of 15 minutes has been selected to balance functionality and security; shorter timeout periods may be appropriate, depending on the risks posed to the mobile device. SFR ID: FMT_SMF.1.1 #02
Checks: C-59615r3_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Maximum time to lock" setting in the MDM console. 2. Verify the value of the setting is 15 minutes or less. On the LG Android device: 1. Unlock the device 2. Navigate to the screen timeout setting: Settings >> Display >> Screen timeout 3. Stop all activity on the device for 15 minutes. If the "maximum time to lock" setting is not set to 15 minutes, or if the user does not have to unlock the device after 15 minutes of inactivity, this is a finding.

Fix: F-64155r1_fix

Configure the mobile device to lock the device display after 15 minutes (or less) of inactivity. On the MDM Administration Console, set the "Maximum time to lock" value to 15 minutes (or less).

a
The LG Android 5.0 platform must be configured to prohibit more than 10 consecutive failed authentication attempts.
AC-7 - Low - CCI-000043 - V-58773 - SV-73203r1_rule
RMF Control
AC-7
Severity
L
CCI
CCI-000043
Version
LGA5-10-000300
Vuln IDs
  • V-58773
Rule IDs
  • SV-73203r1_rule
Users must not be able to override the system policy on the maximum number of consecutive failed authentication attempts because this could allow them to raise the maximum, thus giving adversaries more chances to guess/brute-force passwords, which increases the risk of the mobile device being compromised. Therefore, only administrators should have the authority to set consecutive failed authentication attempt policies. SFR ID: FMT_SMF.1.1 #02
Checks: C-59617r1_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display "Maximum failed password attempts" setting in the MDM console. 2. Verify the value is 10 or less. On the LG Android device: Note: it is recommended that this procedure be performed only on a test device. 1. Enter the wrong Password until the device performs a factory reset. 2. Note the number of password attempts needed before the device performs a factory reset. If the "Maximum failed password attempts" is not set to 10 or less or the device did not perform a factory reset before a wrong password was entered eleven times, this is a finding.

Fix: F-64157r1_fix

Configure the mobile device to allow only 10 or less consecutive failed authentication attempts. On the MDM Administration Console, set the "Maximum failed password attempts" value to 10 or less.

b
The LG Android 5.0 platform must be configured to enforce an application installation policy by specifying one or more authorized application repositories: disable Google Play.
CM-6 - Medium - CCI-000366 - V-58775 - SV-73205r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-10-000401
Vuln IDs
  • V-58775
Rule IDs
  • SV-73205r1_rule
Forcing all applications to be installed from authorized application repositories can prevent unauthorized and malicious applications from being installed and executed on mobile devices. Allowing such installations and executions could cause a compromise of DoD data accessible by these unauthorized/malicious applications. SFR ID: FMT_SMF.1.1 #10
Checks: C-59619r2_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Google Play Store" setting in the MDM console. 2. Verify the setting is disabled. On the LG Android device: 1. Unlock the device 2. Navigate to the Play Store: Apps >> Play Store 3. Verify Google Play Store application does not run. If the "Allow Google Play Store" setting is enabled, or if the user is able to run the Google Play Store on the device, this is a finding.

Fix: F-64159r1_fix

Configure the mobile device to use one or more authorized application repositories. On the MDM Administration Console, disable "Google Play Store".

b
The LG Android 5.0 platform must be configured to enforce an application installation policy by specifying one or more authorized application repositories: disable unknown source.
CM-6 - Medium - CCI-000366 - V-58777 - SV-73207r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-10-000402
Vuln IDs
  • V-58777
Rule IDs
  • SV-73207r1_rule
Forcing all applications to be installed from authorized application repositories can prevent unauthorized and malicious applications from being installed and executed on mobile devices. Allowing such installations and executions could cause a compromise of DoD data accessible by these unauthorized/malicious applications. SFR ID: FMT_SMF.1.1 #10
Checks: C-59621r4_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow unknown sources" setting in the MDM console. 2. Verify the setting is disabled. On the LG Android device: 1. Unlock the device 2. Navigate to the "Unknown sources": Settings >> Security >> Unknown sources 3. Verify "Unknown sources" setting is disabled. If the "Allow unknown sources" setting is enabled, or if the user is able to install the unknown source application, this is a finding.

Fix: F-64161r2_fix

Configure the mobile device to use one or more authorized application repositories. On the MDM Administration Console, disable "Unknown Sources".

b
The LG Android 5.0 platform must be configured to enforce an application installation policy through an application whitelist specifying a set of allowed applications and versions.
CM-6 - Medium - CCI-000366 - V-58779 - SV-73209r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-10-000500
Vuln IDs
  • V-58779
Rule IDs
  • SV-73209r1_rule
Requiring all authorized applications to be in an application whitelist prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the whitelist. Failure to configure an application whitelist properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DoD data accessible by these applications. SFR ID: FMT_SMF.1.1 #10
Checks: C-59623r2_chk

This validation procedure is performed on the MDM Administration Console. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Application whitelist configuration" setting in the MDM console. 2. Verify the "Application whitelist configuration" setting is enabled. 3. Verify all applications on the list of white-listed applications have been approved by the Approving Official (AO). 4. Verify the mobile device is on the list of managed devices in the MDM console. Note: This list can be empty if no applications have been approved. If the "Application whitelist configuration" setting is disabled, or if applications listed in the MDM console "Application whitelist configuration" are not approved by the AO, this is a finding.

Fix: F-64163r1_fix

Configure the mobile device to allow installing application based on whitelist. On the MDM Administration Console, enable "Application whitelist configuration".

b
The LG Android 5.0 platform must be configured to disable developer modes.
AC-17 - Medium - CCI-000063 - V-58781 - SV-73211r1_rule
RMF Control
AC-17
Severity
M
CCI
CCI-000063
Version
LGA5-10-000700
Vuln IDs
  • V-58781
Rule IDs
  • SV-73211r1_rule
Developer modes circumvent certain security measures, so their use for standard operation is not recommended. Developer modes may increase the likelihood of compromise of confidentiality, integrity, and availability. SFR ID: FMT_SMF.1.1 #20
Checks: C-59625r3_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow development mode" setting in the MDM console. 2. Verify the setting is disabled. On the LG Android device: 1. Unlock the device 2. Navigate to Settings >> About Phone >> Software info >> Build number. 3. Push "Build number" multiple times until a pop-up menu display indicates developer option unavailable. If the "Allow development mode" setting is enabled, or if the user is able to find the development mode on the device, this is a finding.

Fix: F-64165r1_fix

Configure the mobile device to disable developer modes. On the MDM Administration Console, disable "Developer Modes".

c
The LG Android 5.0 platform must be configured to enable data-at-rest protection for on-device storage.
CM-6 - High - CCI-000366 - V-58783 - SV-73213r1_rule
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
LGA5-10-000800
Vuln IDs
  • V-58783
Rule IDs
  • SV-73213r1_rule
The operating system must ensure the data being written to the mobile device's built-in storage media is protected from unauthorized access. If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can read storage media directly, thereby circumventing operating system controls. Encrypting the data ensures confidentiality is protected even when the operating system is not running. SFR ID: FMT_SMF.1.1 #21
Checks: C-59627r2_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Encryption" setting in the MDM console. 2. Verify "Device Encryption" is selected. On the LG Android device: 1. Unlock the device 2. Navigate to: Settings >> Security >> Encrypt phone 3. Verify "Encrypt phone" is enabled and cannot be disabled. If the "Device Encryption" is not enabled, or if the user is able to disable the setting on the device, this is a finding.

Fix: F-64167r1_fix

Configure the mobile device to enable data-at-rest protection for on-device storage. On the MDM Administration Console, enable "Device Encryption" for on-device storage.

c
The LG Android 5.0 platform must be configured to enable data-at-rest protection for removable storage media.
CM-6 - High - CCI-000366 - V-58785 - SV-73215r1_rule
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
LGA5-10-000900
Vuln IDs
  • V-58785
Rule IDs
  • SV-73215r1_rule
The operating system must ensure the data being written to the mobile device's removable media is protected from unauthorized access. If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can read removable media directly, thereby circumventing operating system controls. Encrypting the data ensures confidentiality is protected even when the operating system is not running. SFR ID: FMT_SMF.1.1 #22
Checks: C-59629r3_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Encryption" setting in the MDM console. 2. Verify "Storage Card Encryption" is enabled. On the LG Android device: 1. Unlock the device 2. Navigate to: Settings >> Security >> Encrypt SD card storage 3. Verify "Encrypt SD card storage" is enabled and cannot be disabled. If the "Storage Card Encryption" is not enabled, or if the user is able to disable the setting on the device, this is a finding.

Fix: F-64169r1_fix

Configure the mobile device to enable data-at-rest protection for removable media. On the MDM Administration Console, enable "Storage Card Encryption" for removable media.

a
The LG Android 5.0 platform must be configured to require the user to manifest consent to the terms of the DoD-specified warning banner each time the user boots the device.
AC-14 - Low - CCI-000062 - V-58787 - SV-73217r1_rule
RMF Control
AC-14
Severity
L
CCI
CCI-000062
Version
LGA5-10-001100
Vuln IDs
  • V-58787
Rule IDs
  • SV-73217r1_rule
The mobile operating system is required to display the DoD-approved system use notification message or banner before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Required banners help ensure that DoD can audit and monitor the activities of mobile device users without legal restriction. System use notification messages can be displayed when individuals first access or unlock the mobile device. The banner shall be implemented as a "click-through" banner at device unlock (to the extent permitted by the operating system). A "click through" banner prevents further activity on the information system unless and until the user executes a positive action to manifest agreement by clicking on a box indicating “OK.” The approved DoD text must be used exactly as specified in the DoDI 8500.01. For devices accommodating banners of 1300 characters, the banner text is: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. For Blackberries and other PDAs/PEDs with severe character limitations, the banner text is: I've read & consent to terms in IS user agreem't. The administrator must configure the banner text exactly as written without any changes. SFR ID: FMT_SMF.1.1 #24
Checks: C-59631r2_chk

Note: the following procedure is exactly the same as requirement LGA5-20-001300. The procedure only needs to be performed once. This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Enforce warning banner" setting in the MDM console. 2. Verify the Enforce warning banner has been set up and the wording is exactly as specified in the Vulnerability Discussion. On the LG Android device: 1. Reboot the device and verify the warning banner is displayed. 2. Verify the required text is displayed and the user must click "Agree" after checking "I understand and agree to this". If the "Enforce warning banner" setting is not set, does not show the required text, or if device does not show the Warning banner after every device reboot, this is a finding.

Fix: F-64171r1_fix

Note: the following procedure is exactly the same as requirement LGA5-20-001300. The procedure only needs to be performed once. Configure the mobile device to enforce warning banner. On the MDM Administration Console, set the "Enforce warning banner" with the required text.

b
The LG Android 5.0 platform must be configured to disable USB.
AC-8 - Medium - CCI-000049 - V-58789 - SV-73219r1_rule
RMF Control
AC-8
Severity
M
CCI
CCI-000049
Version
LGA5-10-001200
Vuln IDs
  • V-58789
Rule IDs
  • SV-73219r1_rule
This data transfer capability could allow users to transfer sensitive DoD data onto unauthorized USB storage devices, thus leading to the compromise of this DoD data. SFR ID: FMT_SMF.1.1 #41
Checks: C-59633r2_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow USB" setting in the MDM console. 2. Verify the setting is disabled. On the LG Android device: 1. Unlock the device 2. Connect device to test PC using USB cable. 3. Navigate to the PC connection: Open device Notification bar >> select USB connected. 4. Verify all USB connection types, except for "Charge only", are disabled and cannot be enabled. Since the USB storage and USB media player cannot be used, the USB function is only available for device charging. If the "Allow USB" setting is enabled or if the user is able to enable the setting on the device, this is a finding.

Fix: F-64173r1_fix

Configure the mobile device to disable data transfer capabilities through USB. On the MDM Administration Console, disable "Allow USB".

b
The LG Android 5.0 platform must be configured to fully wipe protected data upon unenrollment from the MDM.
CM-6 - Medium - CCI-000366 - V-58791 - SV-73221r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-10-001300
Vuln IDs
  • V-58791
Rule IDs
  • SV-73221r1_rule
When a mobile device is no longer going to be managed by MDM technologies, its protected/sensitive data must be sanitized because it will no longer be protected by the MDM software, so it is at much greater risk of unauthorized access and disclosure. SFR ID: FMT_SMF.1.1 #42
Checks: C-59635r1_chk

This validation procedure is performed on the MDM Administration Console. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to verify on the MDM console the "Device + SD Card Wipe" setting is automatically implemented upon unenrollment of the device from the MDM. If the "Device + SD Card Wipe" setting is not enabled upon device unenrollment from the MDM, this is a finding.

Fix: F-64175r1_fix

Configure the mobile device to wipe protected data from the device when it is unenrolled from MDM. On the MDM Administration Console, set the MDM to automatically enable the "Device + SD Card Wipe" when the device is unenrolled from the MDM.

b
The LG Android 5.0 platform must not allow the device unlock password to contain more than two sequential characters (e.g., 456, abc).
CM-6 - Medium - CCI-000366 - V-58795 - SV-73225r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-000101
Vuln IDs
  • V-58795
Rule IDs
  • SV-73225r1_rule
Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute-force attack. Passwords with sequential or repeating numbers or alphabetic characters (e.g., 456, 987, 222, abc, ddd) are considered easier to crack than random patterns. Therefore, disallowing sequential or repeating numbers or alphabetic characters makes it more difficult for an adversary to discover the password. SFR ID: FMT_SMF_EXT.1
Checks: C-59639r3_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Max Sequential Characters" in the MDM console. 2. Verify the setting is the same or less than the required length. On The LG Android 5.0 platform device: 1. Unlock the device 2. Navigate to the password entry screen: Settings >> Lockscreen >> Select screen lock >> Password 3. Attempt to enter a password with more than two sequential characters (letters or numbers). Determine if the new password is allowed. If the configured values of the “Max Sequential Character” setting are greater than the required length, or if device accepts a password that contains sequential characters of length greater than the required length, this is a finding.

Fix: F-64179r1_fix

Configure the mobile device to enforce a sequential password length of no more than 2 characters. On the MDM Administration Console, set the "Max Sequential Characters" value to 2.

b
The LG Android 5.0 platform must not allow the device unlock password to contain more than two repeating characters (e.g., 444, aaa).
SC-13 - Medium - CCI-001144 - V-58797 - SV-73227r1_rule
RMF Control
SC-13
Severity
M
CCI
CCI-001144
Version
LGA5-20-000102
Vuln IDs
  • V-58797
Rule IDs
  • SV-73227r1_rule
Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute-force attack. Passwords with sequential or repeating numbers or alphabetic characters (e.g., 456, 987, 222, abc, ddd) are considered easier to crack than random patterns. Therefore, disallowing sequential or repeating numbers or alphabetic characters makes it more difficult for an adversary to discover the password. SFR ID: FCS
Checks: C-59641r3_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Max Repeating Characters" setting in the MDM console. 2. Verify the setting is the same or less than the required length. On The LG Android 5.0 platform device: 1. Unlock the device 2. Navigate to the password entry screen: Settings >> Lockscreen >> Select screen lock >> Password 3. Attempt to enter a password with more than two repeating characters. Determine if the new password is allowed. If the configured values of the “Max Repeating Characters” setting are greater than the required length, or if device accepts a password that contains repeating characters of length greater than the required length, this is a finding.

Fix: F-64181r1_fix

Configure the mobile device to enforce a repeated password length of no more than 2 characters. On the MDM Administration Console, set the "Max Repeating Characters" value to 2.

b
The LG Android 5.0 platform must be configured to implement the management setting: disable Google Backup.
CM-6 - Medium - CCI-000366 - V-58799 - SV-73229r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-000301
Vuln IDs
  • V-58799
Rule IDs
  • SV-73229r1_rule
A cloud backup feature may gather a user's information, such as PII, or sensitive documents. With this feature enabled, sensitive information will be backed up to the manufacturer's servers and database. This data is stored at a location that has unauthorized employees accessing this data. This data is stored on a server that has a location unknown to the DoD. Disabling this feature mitigates the risk of a backup feature that stores sensitive data on a server that has the potential to be located in a country other than the United States. SFR ID: FCS_STG_EXT.1.4
Checks: C-59643r3_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Google Backup" settings in MDM console. 2. Verify the setting is disabled. On the LG Android device: 1. Unlock the device 2. Navigate to the Backup & reset: Settings >> Backup & reset 3. Verify "Back up my data" is disabled and cannot be enabled. If the "Allow Google Backup" setting is enabled, or if the user is able to enable the setting on the device, this is a finding.

Fix: F-64183r1_fix

Configure the mobile device to disable Google Backup. On the MDM Administration Console, disable the "Allow Google Backup" setting.

b
The LG Android 5.0 platform must be configured to implement the management setting: disable LG Backup.
AC-7 - Medium - CCI-001383 - V-58801 - SV-73231r1_rule
RMF Control
AC-7
Severity
M
CCI
CCI-001383
Version
LGA5-20-000302
Vuln IDs
  • V-58801
Rule IDs
  • SV-73231r1_rule
A cloud backup feature may gather a user's information, such as PII, or sensitive documents. With this feature enabled, sensitive information will be backed up to the manufacturer's servers and database. This data is stored at a location that has unauthorized employees accessing this data. This data is stored on a server that has a location unknown to the DoD. Disabling this feature mitigates the risk of a backup feature that stores sensitive data on a server that has the potential to be located in a country other than the United States. SFR ID: FIA_AFL_EXT.1.2
Checks: C-59645r2_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow LG Backup" settings in the MDM console. 2. Verify the setting is disabled. On the LG Android device: 1. Unlock the device 2. Navigate to the Backup & reset: Settings >> Backup & reset 3. Verify "Back up my data" is disabled and cannot be enabled. If the "Allow LG Backup" setting is enabled, or if the user is able to enable the setting on the device, this is a finding.

Fix: F-64185r1_fix

Configure the mobile device to disable LGBackup. On the MDM Administration Console, disable the "Allow LG Backup" setting.

b
The LG Android 5.0 platform must not allow Google crash report.
CM-6 - Medium - CCI-000366 - V-58803 - SV-73233r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-000400
Vuln IDs
  • V-58803
Rule IDs
  • SV-73233r1_rule
The sending of diagnostic data back to the manufacturer is prohibited in the DoD. Sending this data to an organization other than DoD is termed a “phone-home” vulnerability. This setting may enable the device manufacturer to gather sensitive location data or other information about the user’s practices. This data will be sent to the manufacturer's servers and database. This data is stored at a location which has unauthorized employees accessing this data. By disabling this feature, the phone-home risk will be mitigated. SFR ID: FMT_MOF.1.1(2) #08
Checks: C-59647r2_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Google crash report" setting in the MDM console. 2. Verify the Google crash report is disabled. On the LG Android device: 1. Unlock the device 2. Navigate to the Google crash report: Settings >> Developer Options >> check "Power menu bug reports" box >> press and hold power button to display Phone options. 3. Click bug report 4. Press "Report" 5. Verify pop-up message that Google crash reports cannot be used. Note: If "Developer mode" is disabled, "bug report" is not available and the requirement has been met. If the "Allow Google crash report" setting is enabled, or if the user is able to enable the setting on the device, this is a finding.

Fix: F-64187r1_fix

Configure the mobile device to disable Google crash report. On the MDM Administration Console, disable the "Allow Google crash report" setting.

b
The LG Android 5.0 platform must not display notifications with sensitive DoD information when the device is locked: disable contact info.
CM-6 - Medium - CCI-000366 - V-58805 - SV-73235r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-000502
Vuln IDs
  • V-58805
Rule IDs
  • SV-73235r1_rule
If the mobile operating system were to display notifications or calendar information on the lock screen, an adversary may be able to gather sensitive data without needing to Unlock the device. This adversary may use this gathered intelligence to plan future attacks and possibly a physical attack. By disabling notifications on the lock screen, this prevents sensitive data from being displayed openly on the device’s lock screen. SFR ID: FMT_MOF.1.1(2) #12
Checks: C-59649r1_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Contact info Access on lockscreen" setting in the MDM console. 2. Verify the setting is disabled. On the LG Android 5.0 platform device: 1. Unlock the device 2. Add a phone number in the Contacts with contact name. 3. Lock the LG device. 4. Call the LG device from another phone. 5. Verify the LG device displays the incoming call phone number but not the contact name. If "Allow Contact info Access on lockscreen" setting on the MDM is not set correctly, or if the contact name is displayed on the locked screen for a received call on the LG device, this is a finding.

Fix: F-64189r1_fix

Configure the mobile device to disable contact info access on lockscreen. On the MDM Administration Console, set the "Allow Contact info Access on lockscreen" to disable.

b
The LG Android 5.0 platform must not display notifications with sensitive DoD information when the device is locked: calendar notifications.
CM-6 - Medium - CCI-000366 - V-58807 - SV-73237r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-000600
Vuln IDs
  • V-58807
Rule IDs
  • SV-73237r1_rule
If the mobile operating system were to display notifications or calendar information on the lock screen, an adversary may be able to gather sensitive data without needing to Unlock the device. This adversary may use this gathered intelligence to plan future attacks and possibly a physical attack. By disabling notifications on the lock screen, this prevents sensitive data from being displayed openly on the device’s lock screen. SFR ID: FMT_MOF.1.1(2) #13
Checks: C-59651r1_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Keyguard" setting in the MDM console. 2. Verify "All" is selected in the "Keyguard Disabled" screen. On the LG Android device: 1. Unlock the device 2. Add a calendar event for the current day on the device. 3. Lock the device. 4. Verify no notifications are displayed on the lockscreen of the LG device. If the "All" Keyguard Disabled setting is not disabled, or if the device is able to display notifications, this is a finding.

Fix: F-64191r1_fix

Configure the mobile device to disable the keyguard All setting. On the MDM Administration Console, disable "All" for the Keyguard Disabled setting.

b
The LG Android 5.0 platform must not allow use of a voice assistant service.
CM-6 - Medium - CCI-000366 - V-58809 - SV-73239r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-000700
Vuln IDs
  • V-58809
Rule IDs
  • SV-73239r1_rule
On MOS devices, users (may be able to) access the device's contact database or calendar to obtain phone numbers and other information using a human voice even when the mobile device is locked. Often this information is personally identifiable information (PII), which is considered sensitive. It could also be used by an adversary to profile the user or engage in social engineering to obtain further information from other unsuspecting users. Disabling access to the contact database and calendar in these situations mitigates the risk of this attack. The AO may waive this requirement with written notice if the operational environment requires this capability. SFR ID: FMT_MOF.1.1(2) #14
Checks: C-59653r2_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow voice command" setting in the MDM console. 2. Verify voice command application is disabled. On the LG Android device: 1. Unlock the device 2. Navigate to the "Voice Command": Apps >> Tools (Verizon only) >> Voice command. 3. Verify voice command application does not run. If the "Allow voice command" setting is enabled, or if the user is able to enable the setting on the device, this is a finding.

Fix: F-64193r1_fix

Configure the mobile device to disable running voice command application. On the MDM Administration Console, disable the "Allow voice command" setting.

b
The LG Android 5.0 platform must not allow Google Auto sync.
CM-6 - Medium - CCI-000366 - V-58815 - SV-73245r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-001100
Vuln IDs
  • V-58815
Rule IDs
  • SV-73245r1_rule
Synchronization of data between devices associated with one user permits a user of an MOS device to transition user activities from one device to another. This feature passes sufficient information between the devices to describe the activity, but app data synchronization associated with the activity is handled through cloud services, which should be disabled on a compliant MOS device. If a user associates both DoD and personal devices to the same Apple ID, the user may improperly reveal information about the nature of the user's activities on an unprotected device. Disabling this service mitigates this risk. SFR ID: FMT_SMF.1.1 #42
Checks: C-59659r2_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Auto Sync" setting in the MDM console. 2. Verify the setting "Allow Auto Sync" is disabled. On the LG Android device: 1. Unlock the device 2. Open the device settings. 3. Navigate to the Auto Sync setting: Settings >> Accounts (or Account & Sync) 4. Verify the list of Auto-Sync data is disabled with the following message and cannot be unchecked. “Auto Sync is disabled. Synchronization is enabled manually by server policy.” If the "Allow Auto Sync" setting is enabled, or if the user is able to enable the setting on the device, this is a finding.

Fix: F-64199r1_fix

Configure the mobile device to disable Google auto sync. On the MDM Administration Console, disable the "Allow Auto Sync" setting.

a
The LG Android 5.0 platform must retain the notice and consent banner on the screen until the user executes a positive action to manifest agreement by selecting a box indicating acceptance.
CM-6 - Low - CCI-000366 - V-58817 - SV-73247r1_rule
RMF Control
CM-6
Severity
L
CCI
CCI-000366
Version
LGA5-20-001300
Vuln IDs
  • V-58817
Rule IDs
  • SV-73247r1_rule
To ensure notice of and consent to the terms of the DoD standard user agreement, an Android app must display a consent banner. Additionally, the app must prevent further activity in the application unless and until the user executes a positive action to manifest agreement, such as by tapping an acceptance button in the app. By preventing access to the system until the user accepts the conditions, legal requirements are met to protect the DoD and to remind users the device is designed and implemented for business use. Additional information is found in DoD Instruction 8500.01. SFR ID: FMT_SMF.1.1 #42
Checks: C-59661r2_chk

Note: the following procedure is exactly the same as requirement LGA5-10-001100. The procedure only needs to be performed once. This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Enforce warning banner" setting in the MDM console. 2. Verify the Enforce warning banner has been set up and the wording is exactly as specified in the Vulnerability Discussion. On the LG Android device: 1. Reboot the device and verify the warning banner is displayed. 2. Verify the required text is displayed and the user must click "Agree" after checking "I understand and agree to this". If the "Enforce warning banner" setting is not set, does not show the required text, or if device does not show the Warning banner after every device reboot, this is a finding.

Fix: F-64201r1_fix

Configure the mobile device to enforce warning banner. On the MDM Administration Console, set the "Enforce warning banner" with the required text.

b
The LG Android 5.0 platform must not allow a user to remove security configuration profiles enforcing DoD security requirements.
CM-6 - Medium - CCI-000366 - V-58819 - SV-73249r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-001400
Vuln IDs
  • V-58819
Rule IDs
  • SV-73249r1_rule
Configuration profiles define security policies on MOS devices. If a user is able to remove a configuration profile, the user can then change the configuration that had been enforced by that policy. Relaxing security policies may introduce vulnerabilities that the profiles had mitigated. Configuring a profile to never be removed mitigates this risk. SFR ID: FDP_IFC_EXT.1.1
Checks: C-59663r2_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Removal of device administrator rights" setting in the MDM console. 2. Verify the setting for the "Removal of device administrator rights" has been disabled. On the LG Android device: 1. Unlock the device 2. Open the device settings. 3. Navigate to the Remove Device Admin rights setting: Settings >> Security >> Phone administrators 4. Verify the list of Device Admin applications is disabled and cannot be unchecked. The following message may be displayed: Removal of device administrator is disabled by server policy. If the "Removal of device administrator rights" setting is enabled or if the user is able to enable the setting on the device, this is a finding.

Fix: F-64203r1_fix

Configure the mobile device to disable removing device admin rights. On the MDM Administration Console, disable "Removal of device administrator rights".

b
The LG Android 5.0 platform must disable split-tunneling on the VPN client.
CM-6 - Medium - CCI-000366 - V-58821 - SV-73251r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-001500
Vuln IDs
  • V-58821
Rule IDs
  • SV-73251r1_rule
Spilt-tunneling allows multiple simultaneous remote connections to the mobile device. Without VPN split-tunneling disabled, malicious applications can covertly off-load device data to a third-party server or set up a trusted tunnel between a non-DoD third-party server and a DoD network, providing a vector to attack the network. SFR ID: FPT_BBD_EXT.1.1
Checks: C-59665r6_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow VPN Split Tunneling" setting in the MDM console. 2. Verify the setting for the VPN Split Tunneling is disabled. On the LG Android device: 1. Unlock the device. 2. Open the device settings. 3. Navigate to the VPN Split Tunneling setting: Settings >> Tethering & Networks (or Wireless & Networks) >> VPN >> LG VPN >> add LG VPN network >> select "Show advanced options" popup >> "Disable Split Tunneling". Verify it is checked. If the "Allow VPN split tunneling" setting is enabled, or if the user is able to change the "Disable Split Tunneling" setting on the device, this is a finding.

Fix: F-64205r1_fix

Configure the mobile device to disable VPN split tunneling. On the MDM Administration Console, disable the "Allow VPN split tunneling" setting.

b
The LG Android 5.0 platform must be configured to implement the management settings: disable NFC.
CM-6 - Medium - CCI-000366 - V-58823 - SV-73253r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-001701
Vuln IDs
  • V-58823
Rule IDs
  • SV-73253r1_rule
NFC provides the capability for Android devices to transfer data between them. Data transfer is not encrypted using FIPS-validated encryption mechanisms. Sensitive DoD information could be compromised if NFC is enabled. SFR ID: FPT_TST_EXT.2.2
Checks: C-59667r2_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow NFC" setting in the MDM console. 2. Verify the setting for the NFC is disabled. On the LG Android device: 1. Unlock the device 2. Navigate to the NFC setting: Settings >> Share & Connect >> NFC 3. Verify the NFC menu is disabled and the following message is displayed: NFC is disabled by server policy. If the "Allow NFC" setting is not disabled on the MDM console, or if the user is able to enable the NFC setting on the device, this is a finding.

Fix: F-64207r1_fix

Configure the mobile device to disable NFC. On the MDM Administration Console, disable the "Allow NFC" setting.

b
The LG Android 5.0 platform must be configured to implement the management settings: disable Android Beam.
CM-6 - Medium - CCI-000366 - V-58825 - SV-73255r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-001702
Vuln IDs
  • V-58825
Rule IDs
  • SV-73255r1_rule
Android Beam provides the capability for Android devices to transfer data between them. Data transfer is not encrypted using FIPS-validated encryption mechanisms. Sensitive DoD information could be compromised if Android beam is enabled. SFR ID: FPT_TUD_EXT.2.5
Checks: C-59669r3_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Android Beam" setting in the MDM console. 2. Verify the setting for the Android Beam is disabled. On the LG Android device: 1. Unlock the device 2. Navigate to the Android Beam setting: Settings >> Share & Connect >> Android Beam 3. Verify the Android Beam menu is disabled and the following message is displayed: Android Beam is disabled by server policy. If the "Allow Android Beam" setting is enabled, or if the user is able to enable the setting on the device, this is a finding.

Fix: F-64209r1_fix

Configure the mobile device to disable Android Beam. On the MDM Administration Console, disable the "Allow Android Beam" setting.

b
The LG Android 5.0 platform must be configured to implement the management settings: disable Wi-Fi Direct.
AC-8 - Medium - CCI-000048 - V-58827 - SV-73257r1_rule
RMF Control
AC-8
Severity
M
CCI
CCI-000048
Version
LGA5-20-001703
Vuln IDs
  • V-58827
Rule IDs
  • SV-73257r1_rule
Wi-Fi Direct allows the device to connect directly to another device via Wi-Fi without accessing a Wi-Fi access point and using DoD-required security mechanisms since Wi-Fi Direct can be used by applications to exchange files between devices. Disabling this feature mitigates the risk of compromising sensitive DoD data. Note: Disabling Wi-Fi Direct also disables Miracast. SFR ID: FTA_TAB.1.1
Checks: C-59671r2_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Wi-Fi Direct" setting in the MDM console. 2. Verify the setting for the Wi-Fi Direct is disabled. On the LG Android device: 1. Unlock the device 2. Open the device settings. 3. Navigate to the Wi-Fi Direct setting: Settings >> Wi-Fi >> Menu >> Advanced Wi-Fi >> click "Wi-Fi Direct" 4. Verify the Wi-Fi Direct is disabled and the following message is displayed: Wi-Fi Direct is disabled by server policy. If the "Allow Wi-Fi Direct" setting is enabled, or if the user is able to enable the setting on the device, this is a finding.

Fix: F-64211r1_fix

Configure the mobile device to disable Wi-Fi Direct. On the MDM Administration Console, disable the "Allow Wi-Fi Direct" setting.

b
The LG Android 5.0 platform must be configured to implement management setting: disable screen mirroring.
CM-6 - Medium - CCI-000366 - V-58829 - SV-73259r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-001800
Vuln IDs
  • V-58829
Rule IDs
  • SV-73259r1_rule
Screen mirroring allows the user to display device content to a compatible device (e.g., TV) over a Wi-Fi connection. Although this feature uses HDCP 2.x protocol and encryption of visual data to transmit data, vulnerabilities in the 2.0 and 2.1 protocol implementation can result in compromise of sensitive DoD data. Disabling this feature will mitigate this risk. SFR ID: FMT_SMF.1.1 #42
Checks: C-59673r2_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Miracast" setting in the MDM console. 2. Verify the setting for the Miracast. On the LG Android device: 1. Unlock the device 2. Open the device settings. 3. Navigate to the Miracast setting: Settings >> Share & Connect >> Miracast 4. Verify the Miracast menu is disabled and the following message is displayed: Miracast is disabled by server policy. If the "Allow Miracast" setting is enabled, or if the user is able to enable the setting on the device, this is a finding.

Fix: F-64213r1_fix

Configure the mobile device to disable Miracast. On the MDM Administration Console, disable the "Allow Miracast" setting.

b
The LG Android 5.0 platform must be configured to enforce an application launching policy through an application blacklist specifying a set of disallowed applications: disable unapproved core and preinstalled applications.
CM-6 - Medium - CCI-000366 - V-58831 - SV-73261r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-002101
Vuln IDs
  • V-58831
Rule IDs
  • SV-73261r1_rule
Applications from various sources (including the vendor, the carrier, and Google) are preinstalled on the device at the time of manufacture. Some of the applications can compromise DoD data or upload user's information to non-DoD approved servers. A user must be blocked from using such applications that exhibit behavior that can result in compromise of DoD data or DoD user information. The site administrator must analyze all pre-installed applications on the device and block all applications not approved for DoD use by configuring the application disable list. SFR ID: FMT_SMF.1.1 #42
Checks: C-59675r1_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the list of unapproved core and preinstalled applications in the "Application Blacklist (prevent launch of blacklist apps)" setting in the MDM console. 2. Verify the list contains all core and preinstalled applications not approved for DoD use by the Approving Official (AO). Note: Refer to the Supplemental document for additional information. On the LG Android device: 1. Attempt to launch an unapproved core and preinstalled application on the device. 2. Verify the application will not run and the following message is displayed: Application is disabled by server policy. If the "Allow Application Blacklist (prevent launch of blacklist apps)" setting is not set up with a list of unapproved core and preinstalled applications, this is a finding.

Fix: F-64215r1_fix

Configure the mobile device to disable the unapproved core and preinstalled applications. On the MDM Administration Console, set up a list of unapproved core and preinstalled applications in "Application Blacklist (prevent launch of blacklist apps)".

b
The LG Android 5.0 platform must be configured to disable the capability for an operating system update to be automatically downloaded and installed on the mobile device.
CM-6 - Medium - CCI-000366 - V-58833 - SV-73263r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-002102
Vuln IDs
  • V-58833
Rule IDs
  • SV-73263r1_rule
FOTA allows the user to download and install firmware updates over-the-air. These updates can include OS upgrades, security patches, bug fixes, new features and applications. Since the updates are controlled by the carriers, DoD will not have an opportunity to review and update policies prior to update availability to end users. Disabling FOTA will mitigate the risk of allowing users access to applications that could compromise DoD sensitive data. After reviewing the update and adjusting any necessary policies (i.e. disabling applications determined to pose risk), the administrator can re-enable FOTA. SFR ID: FMT_SMF.1.1 #42
Checks: C-59677r2_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the list of unapproved core and preinstalled applications in the "Application Blacklist (prevent launch of blacklist apps)" setting in the MDM console. 2. Verify the LGDMSclient package is on the list. On the LG Android device: 1. Unlock the device 2. Open the device settings. 3. Navigate to the System updates setting: Settings >> System updates 4. Verify the System updates menu is not running and the following message is displayed: Application is disabled by server policy. If the LGDMSclient package setting is enabled, or the "System updates" setting can be launched, this is a finding.

Fix: F-64217r1_fix

Configure the mobile device to disable the FOTA client. On the MDM Administration Console, set the LGDMSclient package as Application Blacklist (prevent launch of blacklist apps).

b
The LG Android 5.0 platform must be configured to implement the management setting: disable all Bluetooth profiles except for HSP (Headset Profile) and HFP (Hands-Free Profile).
CM-6 - Medium - CCI-000366 - V-58835 - SV-73265r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-002200
Vuln IDs
  • V-58835
Rule IDs
  • SV-73265r1_rule
Unsecure Bluetooth profiles may allow either unauthenticated connections to mobile devices or transfer of sensitive DoD data without required DoD information assurance (IA) controls. Only the HSP and HFP profiles are required to meet current DoD Bluetooth needs and DoD data and voice IA controls. SFR ID: FMT_SMF.1.1 #42
Checks: C-59679r2_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Bluetooth File Transfer" setting in the MDM console. 2. Verify the Bluetooth File transfer (pbap, ftp, opp, sap, hdp, gatt, map), Network(pan) and HID(hid) settings for the Bluetooth Profile are disabled. On the LG Android device: 1. Unlock the device 2. Open the device settings. 3. Navigate to the Bluetooth setting: Settings >> Bluetooth 4. Pair with the other device. 5. Try to send files (for example, a photo) to paired device. 6. Verify sending files failed and the following message is displayed: Bluetooth is disabled by server policy. If the Bluetooth File transfer(pbap, ftp, opp, sap, hdp, gatt, map), Network (pan) and HID(hid) profiles are not disabled in the "Allow Bluetooth Profiles" setting, or if the user is able to send data files via these Bluetooth profiles on the device, this is a finding.

Fix: F-64219r1_fix

Configure the mobile device to disable Bluetooth Profiles. On the MDM Administration Console, set the "Allow Bluetooth Profile" to disable File transfer, Network, and HID Profiles.

b
The LG Android 5.0 platform must be configured to disable download mode.
CM-6 - Medium - CCI-000366 - V-58837 - SV-73267r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-002300
Vuln IDs
  • V-58837
Rule IDs
  • SV-73267r1_rule
Download mode allows the firmware of the device to be flashed (updated) by the user. All updates should be controlled by the system administrator to ensure configuration control of the security baseline of the device. SFR ID: FMT_SMF.1.1 #42
Checks: C-59681r1_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Download mode" setting in the MDM console. 2. Verify the setting for the Download mode is disabled. On the LG Android device: 1. Power on the device and connect USB. 2. Try to flash device firmware. 3. Verify flashing device firmware is disabled and the following message is displayed: Download mode is disabled by server policy. If the "Allow download mode" setting is enabled, or if the user is able to flash device firmware on the device, this is a finding.

Fix: F-64221r1_fix

Configure the mobile device to disable download mode. On the MDM Administration Console, set the "Allow download mode".

b
The LG Android 5.0 platform must be managed by an MDM.
CM-6 - Medium - CCI-000366 - V-58839 - SV-73269r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-002500
Vuln IDs
  • V-58839
Rule IDs
  • SV-73269r1_rule
Security-related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security-related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large-scale environment relative to an environment in which each device must be configured separately. SFR ID: FMT_SMF.1.1 #42
Checks: C-59685r2_chk

This validation procedure is performed on the LG Android device. On the LG Android device: 1. Open the application list and verify the presence of an MDM agent. 2. Open the MDM agent and verify that the MDM agent has been enrolled: Settings >> Security >> Phone Administrator. MDM Agent must be checked. Note: Verification of the MDM agent is MDM vendor specific. If the MDM agent is not present on the LG Android device, or if the MDM agent has not been enrolled (checked), this is a finding.

Fix: F-64223r1_fix

Enroll the device in MDM. Install the MDM agent on the device to centrally manage configuration settings on the device.

b
The LG Android 5.0 platform must be configured to enable CC Mode.
CM-6 - Medium - CCI-000366 - V-58841 - SV-73271r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-002600
Vuln IDs
  • V-58841
Rule IDs
  • SV-73271r1_rule
CC mode implements several security controls required by the Mobile Device Functional Protection Profile (MDFPP). If CC mode is not implemented, DoD data is more at risk of being compromised, and the MD is more at risk of being compromised if lost or stolen. CC mode implements the following controls: 1. Certificate Validation LG provides Certificate validation feature for all certificates to protect your secure connection from spoofing and invalid certificates. This capability can be automatically configured by enabling CC Mode. 2. Firmware Update Protection Except secure update verified by RSA (2048bit) algorithm and SHA256 for hash, unsecured firmware update methods is restricted in CC mode. 3. Self-test for crypto libraries If the CC Mode is enabled, self-tests for crypto libraries are automatically started at bootup time. 4. Restriction of TLS cipher suites Limited cipher suites can be selectable in the CC mode. SFR ID: FMT_SMF.1.1 #42
Checks: C-59687r1_chk

This validation procedure is performed on the MDM Administration Console only. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "CC Mode" setting in the MDM console. 2. Verify the setting for the CC mode is set and the device is enrolled on the MDM. If the "Set CC Mode" setting is disabled on the MDM console, this is a finding.

Fix: F-64225r1_fix

Configure the mobile device to enable CC Mode. On the MDM Administration Console, set the "CC Mode".

b
The LG Android 5.0 platform must be configured to implement the management setting: disable Allow System Time Changes.
CM-6 - Medium - CCI-000366 - V-58843 - SV-73273r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-002700
Vuln IDs
  • V-58843
Rule IDs
  • SV-73273r1_rule
Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events. Periodically synchronizing internal clocks with an authoritative time source is needed in order to correctly correlate the timing of events that occur across the enterprise. The three authoritative time sources for mobile operating systems are an authoritative time server that is synchronized with redundant United States Naval Observatory (USNO) time servers as designated for the appropriate DoD network (NIPRNet or SIPRNet), or the Global Positioning System (GPS), or the wireless carrier. Time stamps generated by the audit system in mobile operating systems shall include both date and time. The time may be expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC. SFR ID: FMT_SMF.1.1 #42
Checks: C-59689r1_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow System Time Changes" check box. 2. Verify the setting is disabled. On the LG Android device: 1. Open the device settings. 2. Select "Date and time". 3. Verify the "Auto date and time" check box is checked. 4. Verify a user cannot deselect the "Auto date and time" check box. If either the "Allow System Time Changes" is not disabled in the MDM administration console; or the "Auto date and time" check box is not selected on the device; or if it is possible to deselect this option on the device, this is a finding.

Fix: F-64227r1_fix

On the MDM Console, disable "Allow System Time Changes".

a
The LG Android 5.0 platform must not allow the user to modify Owner Info on the device screen.
CM-6 - Low - CCI-000366 - V-58845 - SV-73275r1_rule
RMF Control
CM-6
Severity
L
CCI
CCI-000366
Version
LGA5-20-002800
Vuln IDs
  • V-58845
Rule IDs
  • SV-73275r1_rule
The Owner Info screen may contain required information, including a phone number to call if a device is lost, or the DoD Warning Banner. The ability of the device user to modify the Set Owner Info screen needs to be disabled so that required info is always displayed on the locked screen. SFR ID: FMT_MOF.1.1(2) #11
Checks: C-59691r2_chk

Note: This requirement is Not Applicable if the site has not configured the optional "Set Owner Info" configuration setting. This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Disallow Owner Info" setting in the MDM console. 2. Verify the setting is enabled. On the LG Android platform device: 1. Go to lock screen. 2. Show owner info on the lock screen. 3. Navigate to the password entry screen: Settings >> Lockscreen >> Contact info for lost phone 4. Verify the Owner info is displayed but the user cannot change it. If the "Disallow Owner Info" setting is not enabled, or if the user is able to change the owner info text on the device, this is a finding.

Fix: F-64229r1_fix

Configure the mobile device to disallow a user to change owner info displayed on the locked screen. On the MDM Administration Console, enable the "Disallow Owner Info" setting.

b
The LG Android 5.0 platform must disable Android Smart Lock.
CM-6 - Medium - CCI-000366 - V-58847 - SV-73277r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-002900
Vuln IDs
  • V-58847
Rule IDs
  • SV-73277r1_rule
Android Smart Lock provides the capability for the user to unlock the device using non-approved methods, including having a "trusted" device nearby, trusted face viewing the screen, or by swiping the device with a specific pattern. Alternate device authentication methods to using the device unlock password have not been approved for use in the DoD. SFR ID: FMT_MOF.1.1(2) #13
Checks: C-59693r3_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Smart Lock" setting in the MDM console . 2. Verify "Allow Smart Lock" is disabled. On the LG Android device : 1. Unlock the device. 2. Open the device settings. 3. Navigate to the Smart Lock setting: Settings > Lock Screen > click "Smart Lock" 4. Verify Smart Lock is disabled and the following message is displayed: (Disabled by administrator) If the Smart Lock setting is not disabled, or if the user is able to enable Smart Lock, this is a finding.

Fix: F-64231r2_fix

Configure the mobile device to disable the Smart Lock setting. On the MDM Administration Console, disable the "Allow Smart Lock" setting.

b
The LG Android 5.0 platform must be configured to implement the management setting: Disable native Android browser.
CM-6 - Medium - CCI-000366 - V-58849 - SV-73279r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-003000
Vuln IDs
  • V-58849
Rule IDs
  • SV-73279r1_rule
The native browser includes encryption modules that are not FIPS 140-2 validated. DoD policy requires all encryption modules used in DoD IT systems be FIPS 140-2 validated. SFR ID: FMT_MOF.1.1(2) #13
Checks: C-59695r1_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the list of unapproved core and preinstalled applications in the "Application Blacklist (prevent launch of blacklist apps)" setting in the MDM console. 2. Verify the list contains LGbrowser (AT&T) and Chrome (AT&T and Verizon). On the LG Android device: 1. Attempt to launch the native Android Browser (LG Browser) and Chrome apps on the device. 2. Verify the apps will not run and the following message is displayed: Application is disabled by server policy. If the "Allow Application Blacklist (prevent launch of blacklist apps)" setting is not set up with "LGbrowser" and "Chrome" or the native Android browser and Chrome browser can be launched on the device, this is a finding.

Fix: F-64233r1_fix

Configure the mobile device to disable non-FIPS-validated browsers. On the MDM Administration Console, list "LGbrowser" (AT&T) and "Chrome (AT&T and Verizon) in "Application Blacklist (prevent launch of blacklist apps)".

b
The LG Android 5.0 platform must be configured to implement the management setting: Disable native Android email client.
CM-6 - Medium - CCI-000366 - V-58851 - SV-73281r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
LGA5-20-003100
Vuln IDs
  • V-58851
Rule IDs
  • SV-73281r1_rule
The native email client includes encryption modules that are not FIPS 140-2 validated. DoD policy requires all encryption modules used in DoD IT systems be FIPS 140-2 validated. SFR ID: FMT_MOF.1.1(2) #13
Checks: C-59697r1_chk

This validation procedure is performed on both the MDM Administration Console and the LG Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the list of unapproved core and preinstalled applications in the "Application Blacklist (prevent launch of blacklist apps)" setting in the MDM console. 2. Verify the list contains LGEmail. On the LG Android device: 1. Attempt to launch the native Android email client on the device. 2. Verify the email app will not run and the following message is displayed: Application is disabled by server policy. If the "Allow Application Blacklist (prevent launch of blacklist apps)" setting is not set up with "LGEmail" or the native Android email client can be launched on the device, this is a finding.

Fix: F-64235r1_fix

Configure the mobile device to disable the native Android email client. On the MDM Administration Console, list "LGEmail" in "Application Blacklist (prevent launch of blacklist apps)".