BlackBerry 10 OS Security Technical Implementation Guide

Developed by BlackBerry Ltd. in coordination with DISA for use in the DoD. Comments or proposed revisions to this document should be sent via e-mail to the following address: [email protected]

Details

Version / Release: V1R2

Published: 2013-10-07

Updated At: 2018-09-23 02:03:56

Compare/View Releases

Select any two versions of this STIG to compare the individual requirements

Select any old version/release of this STIG to view the previous requirements

Actions

Download

Filter


Findings
Severity Open Not Reviewed Not Applicable Not a Finding
Overall 0 0 0 0
Low 0 0 0 0
Medium 0 0 0 0
High 0 0 0 0
Drop CKL or SCAP (XCCDF) results here.

    Vuln Rule Version CCI Severity Title Description Status Finding Details Comments
    SV-50090r2_rule BB10-00-000100 CCI-000048 LOW BlackBerry 10 OS must display the DoD warning banner exactly as specified at startup device unlock. The operating system is required to display the DoD approved system use notification message or banner before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, p
    SV-50091r2_rule BB10-00-000110 CCI-000056 MEDIUM BlackBerry 10 OS must retain the work space lock until the user reestablishes access using established identification and authentication procedures. The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identificat
    SV-50092r2_rule BB10-00-000120 CCI-000056 MEDIUM BlackBerry 10 OS must retain the device lock until the user reestablishes access using established identification and authentication procedures. The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identificat
    SV-50093r2_rule BB10-00-000130 CCI-000057 MEDIUM BlackBerry 10 OS must lock the Work Space after no more than 15 minutes of inactivity. The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identificat
    SV-50094r2_rule BB10-00-000140 CCI-000057 MEDIUM BlackBerry 10 OS must prevent applications from extending the Work Space password lock time. The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identificat
    SV-50095r2_rule BB10-00-000150 CCI-000160 LOW BlackBerry 10 OS must synchronize the internal clock at least once every 24 hours with an authoritative time server or the Global Positioning System. Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events. Periodically synchronizing internal clocks with an authoritative time source is needed in ord
    SV-50096r2_rule BB10-00-000160 CCI-000192 MEDIUM BlackBerry 10 OS must disallow the Work Space unlock password from containing fewer than a specified minimum number of upper case alphabetic characters. Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Setting minimum numbers of certain types of characters increases password complexity, and therefore makes it more difficult for
    SV-50097r2_rule BB10-00-000170 CCI-000193 MEDIUM BlackBerry 10 OS must disallow the Work Space unlock password from containing fewer than a specified minimum number of lower case alphabetic characters. Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Setting minimum numbers of certain types of characters increases password complexity, and therefore makes it more difficult for
    SV-50098r2_rule BB10-00-000180 CCI-000194 MEDIUM BlackBerry 10 OS must disallow the Work Space unlock password from containing fewer than a specified minimum number of numeric characters. Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Setting minimum numbers of certain types of characters increases password complexity, and therefore makes it more difficult for
    SV-50101r2_rule BB10-00-000210 CCI-000205 MEDIUM BlackBerry 10 OS must enforce a minimum length for the Work Space unlock password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute force attacks. The ability to crack a password is a function of how many attempts are made to crack the password, how quickly the adversary c
    SV-50102r2_rule BB10-00-000220 CCI-000663 HIGH BlackBerry 10 OS must prevent a user from installing unapproved applications. The operating system must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what types of installations are prohibited (e.g., software whose p
    SV-50103r2_rule BB10-00-000230 CCI-000663 MEDIUM BlackBerry 10 OS must only permit download of software from a DoD approved source (e.g., DoD operated mobile device application store or MDM server). DoD can perform due diligence on sources of software to mitigate the risk that malicious software is introduced to those sources. Therefore, if software is downloaded from a DoD approved source, then it is less likely to be malicious than if it is downloa
    SV-50104r2_rule BB10-00-000240 CCI-000780 MEDIUM BlackBerry 10 OSs Wi-Fi module must use EAP-TLS authentication when authenticating to DoD WLAN authentication servers. Without strong mutual authentication, a mobile device may connect to an unauthorized network. In many cases, the user may falsely believe that the device is connected to an authorized network and then provide authentication credentials and other sensitive
    SV-50105r2_rule BB10-00-000250 CCI-000780 MEDIUM BlackBerry 10 OS VPN client must employ DoD approved PKI mechanisms for authentication when connecting to DoD networks. VPNs are vulnerable to attack if they are not supported by strong authentication. An adversary may be able to gain access to network resources and sensitive information if they can compromise the authentication process. Common Access Card (CAC) authentica
    SV-50107r2_rule BB10-00-000270 CCI-001130 MEDIUM BlackBerry 10 OSs VPN client must use either IPSec or SSL/TLS when connecting to DoD networks. Use of non-standard communications protocols can affect both the availability and confidentiality of communications. IPSec and SSL/TLS are both well-known and tested protocols that provide strong assurance with respect to both IA and interoperability.
    SV-50109r2_rule BB10-00-000290 CCI-001154 MEDIUM BlackBerry 10 OS must prohibit the use of non-DoD authorized instant messaging (IM) systems. Many instant messaging systems have known vulnerabilities, some of which allow an adversary to install malware on the device. This malware can then be used to obtain sensitive information or further compromise DoD information systems. Restricting IM traff
    SV-50111r2_rule BB10-00-000310 CCI-001159 HIGH Only DoD PKI issued or DoD approved software authentication certificates may be installed on the Work Space of the BlackBerry 10 OS. If unauthorized software authentication certificates are installed on the device, then the operating system would not block malware signed by the entity that published these certificates. Such malware could be used to obtain sensitive DoD information or t
    SV-50112r2_rule BB10-00-000320 CCI-001159 MEDIUM Only DoD PKI issued or DoD approved server authentication certificates may be installed on the Work Space of the BlackBerry 10 OS. If unauthorized device authentication certificates are installed on the device, there is the potential that the device may connect to a rogue device or network. Rogue devices can mimic the behavior of authorized equipment to trick the user into providing
    SV-50113r2_rule BB10-00-000330 CCI-001265 MEDIUM BlackBerry 10 OS must prevent a user from using a browser that does not direct its Wi-Fi traffic to a DoD proxy server. Proxy servers can inspect traffic for malware and other signs of a security attack. Allowing a mobile device to access the public Internet without proxy server inspection forgoes the protection that the proxy server would otherwise provide. Malware downlo
    SV-50114r2_rule BB10-00-000340 CCI-001265 MEDIUM BlackBerry 10 OS must prevent a user from using a browser that does not direct its VPN traffic to a DoD proxy server. Proxy servers can inspect traffic for malware and other signs of a security attack. Allowing a mobile device to access the public Internet without proxy server inspection forgoes the protection that the proxy server would otherwise provide. Malware downlo
    SV-50116r2_rule BB10-00-000360 CCI-000370 MEDIUM BlackBerry 10 OS must employ mobile device management services to centrally manage IT Policies. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of atta
    SV-50117r1_rule BB10-00-000370 CCI-000370 MEDIUM BlackBerry 10 OS must employ mobile device management services to centrally manage email settings. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of atta
    SV-50118r2_rule BB10-00-000380 CCI-000370 MEDIUM BlackBerry 10 OS must employ mobile device management services to centrally manage Wi-Fi profiles. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of atta
    SV-50119r2_rule BB10-00-000390 CCI-000370 MEDIUM BlackBerry 10 OS must employ mobile device management services to centrally manage VPN profiles. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of atta
    SV-50121r2_rule BB10-00-000410 CCI-000066 MEDIUM BlackBerry 10 OS must prohibit wireless remote access connections for storage. The device acts as a personal hotspot when it accepts remote connections on a local area network interface for the purposes of routing traffic to a wide area network interface. The most common implementation is to accept local area Wi-Fi connections to re
    SV-50122r2_rule BB10-00-000420 CCI-000066 MEDIUM BlackBerry 10 OS must prohibit wireless remote access connections for media sharing The device acts as a personal hotspot when it accepts remote connections on a local area network interface for the purposes of routing traffic to a wide area network interface. The most common implementation is to accept local area Wi-Fi connections to re
    SV-50123r2_rule BB10-00-000430 CCI-000366 LOW BlackBerry 10 OS must enable a system administrator to select which data fields will be available to applications outside of the contact database application. The contact database often contains a significant amount of information beyond each person's name and phone number. The records may contain addresses and other identifying or sensitive information that should not be revealed. There may be cases in which a
    SV-51135r1_rule BB10-00-000325 CCI-001237 MEDIUM BlackBerry 10 OS must be updated to the latest approved version of the operating system. Operating system updates contain new security related features and security patches that address known vulnerabilities. Running the latest DoD approved software version improves the security posture of the mobile device.
    SV-51136r1_rule BB10-00-003360 CCI-001090 LOW BlackBerry 10 OS must prevent DoD applications from accessing non-DoD data when the device supports multiple user environments (e.g., work and personal) if such access has not been approved. When a device is used for more than one purpose (e.g., work and personal) there is the potential for information from one environment to migrate inappropriately over into the other environment. Therefore, it is critical for DoD applications and informatio
    SV-51137r1_rule BB10-00-003320 CCI-000186 MEDIUM BlackBerry 10 OS must enforce complexity requirements for the authentication to access private keys saved in the key certificate stores. The cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the priva
    SV-51139r1_rule BB10-00-003400 CCI-000366 MEDIUM BlackBerry 10 OS must support both software-based and hardware-based asymmetric key technology (e.g., CAC/PIV). Software-based certificates are required to authenticate many web sites. Hardware-based tokens are embedded in the DoD Common Access Card (CAC). Without both software and hardware-based asymmetric key technology, there is the potential that critical authe
    SV-52711r1_rule BB10-00-000280 CCI-000366 MEDIUM BlackBerry 10 OS must have access to DoD root and intermediate PKI certificates when performing DoD PKI related transactions. DoD root and intermediate PKI certificates are used to verify the authenticity of PKI certificates of users and web services. If the root and intermediate certificates are not available, an adversary could falsely sign a certificate in such a way that it
    SV-52712r1_rule BB10-00-000300 CCI-000366 HIGH BlackBerry 10 OS must grant a downloaded application only the permissions that DoD has authorized for that application. Mobile operating system applications that are able to perform unintended functions may be able to obtain sensitive information or otherwise compromise system security. The permissions that an application requires to perform its function may be delineated
    SV-52716r1_rule BB10-00-000350 CCI-000366 MEDIUM BlackBerry 10 OS maximum number of consecutive unsuccessful unlock attempts must be configurable within a range from 5 to 10. The recommended setting for the maximum number of consecutive unsuccessful unlock attempts is 10. In some environments, a lower number may be needed to provide greater protection of sensitive information. Allowing for configuration enables the local comma
    SV-52717r1_rule BB10-00-000335 CCI-001265 MEDIUM BlackBerry 10 OS must use a DoD proxy server. Proxy servers can inspect traffic for malware and other signs of a security attack. Allowing a mobile device to access the public Internet without proxy server inspection forgoes the protection that the proxy server would otherwise provide. Malware downlo