BlackBerry Enterprise Service v10.1.x BlackBerry Device Service STIG

Developed by Research In Motion Ltd. in coordination with DISA for use in the DoD.

Details

Version / Release: V1R3

Published: 2014-10-06

Updated At: 2018-09-23 02:03:36

Actions

Download

Filter


Findings
Severity Open Not Reviewed Not Applicable Not a Finding
Overall 0 0 0 0
Low 0 0 0 0
Medium 0 0 0 0
High 0 0 0 0
Drop CKL or SCAP (XCCDF) results here.

    Vuln Rule Version CCI Severity Title Description Status Finding Details Comments
    SV-50737r2_rule BBDS-00-003120 CCI-000370 LOW The BlackBerry Device Service server must enforce the minimum password length for the Personal Space password to 4 digits via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50740r2_rule BBDS-00-003131 CCI-000370 HIGH The BlackBerry Device Service server must disallow mobile device applications the ability to reset the Work Space lock timer via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50742r2_rule BBDS-00-003176 CCI-000370 HIGH The BlackBerry Device Service server must disable any mobile OS service that connects to a cloud storage server via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50744r2_rule BBDS-00-003177 CCI-000370 HIGH The BlackBerry Device Service server must direct all Work Space application traffic through the BlackBerry Device Service server via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50745r2_rule BBDS-00-003178 CCI-000370 MEDIUM The BlackBerry Device Service server must disallow Personal Space applications access to the Work Space network connection via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50746r2_rule BBDS-00-003179 CCI-000370 MEDIUM The BlackBerry Device Service server must have the administrative functionality disallow hyperlinks within Work Space applications from opening within the Personal Space browser application via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50748r1_rule BBDS-00-003180 CCI-000370 LOW The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Set the number of allowed repeated characters in the mobile device unlock password. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50751r1_rule BBDS-00-003185 CCI-000370 LOW The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Disallow sequential numbers in the mobile device unlock password. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50753r2_rule BBDS-00-002541 CCI-000370 HIGH The BlackBerry Device Service server must disable copying data from inside a non-secure data area on a mobile device into the security container via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50754r2_rule BBDS-00-002542 CCI-000370 LOW The BlackBerry Device Service server must allow only Work Space contacts to be read from a native Personal Space application via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50756r2_rule BBDS-00-000100 CCI-000037 HIGH The BlackBerry Device Service server must implement separation of administrator duties by requiring a specific role be assigned to each administrator account. Separation of duties supports the management of individual accountability and reduces the power of one individual or administrative account. Employing a separation of duties model reduces the threat that one individual has the authority to make changes t
    SV-50757r1_rule BBDS-00-000105 CCI-000345 MEDIUM The BlackBerry Device Service server must deploy operating system and application updates via over-the-air (OTA) provisioning for managed mobile devices. Without the MDM ability to deploy operating systems and application updates over the air, it is possible for the mobile devices under the MDM's control to be susceptible to a zero day attack. The ability to apply updates OTA allows for rapid response to
    SV-50759r1_rule BBDS-00-000115 CCI-000370 HIGH BlackBerry accounts must not be assigned to the default IT policy on the BlackBerry Device Service server or any other non-STIG compliant IT policy. The BlackBerry default policy on the BDS server does not include many DoD required security policies for data encryption, authentication, and access control. DoD enclaves are at risk of data exposure and hacker attack if users are assigned the default (o
    SV-50764r2_rule BBDS-00-000132 CCI-001144 MEDIUM If the BlackBerry Device Service server includes a mobile email management capability, the email client S/MIME encryption algorithm must be 3DES or AES. When AES is used, AES-128 bit encryption key length is the minimum requirement; AES-256 is desired. Cryptography is only as strong as the encryption modules/algorithms that are employed to encrypt the data. Strong encryption must be used to protect the integrity and confidentiality of the data. In this case the requirement states that S/MIME must util
    SV-50769r2_rule BBDS-00-000155 CCI-000370 MEDIUM The BlackBerry Device Service server must disable Bluetooth Discoverable Mode via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50770r1_rule BBDS-00-000156 CCI-000370 HIGH The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable the transfer of any file-based data via Bluetooth. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50771r2_rule BBDS-00-000160 CCI-000370 MEDIUM The BlackBerry Device Service server must enable Bluetooth pairing using a randomly generated passkey size of at least 8 digits via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50772r2_rule BBDS-00-000165 CCI-000370 MEDIUM The BlackBerry Device Service server must enable Bluetooth 128-bit encryption via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50797r2_rule BBDS-00-000200 CCI-000370 MEDIUM BlackBerry Web Desktop Manager must be configured to permit users to activate new BlackBerry devices only. The overall security posture of the BlackBerry system is dependent on strict configuration management controls, including ensuring only authorized BlackBerry devices are being used and authorized devices are provisioned as required. When these configurat
    SV-50817r2_rule BBDS-00-000230 CCI-000370 MEDIUM The BlackBerry Device Service server must set the number of incorrect password attempts before a data wipe procedure is initiated to 10 via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50818r2_rule BBDS-00-000235 CCI-000370 MEDIUM The BlackBerry Device Service server must enable a Work Space password via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50819r2_rule BBDS-00-000240 CCI-000370 MEDIUM The BlackBerry Device Service server must set the number of uppercase letters in the Work Space password to at least one via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50820r2_rule BBDS-00-000245 CCI-000370 MEDIUM The BlackBerry Device Service server must set the number of numbers in the Work Space password to at least one via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50823r2_rule BBDS-00-000260 CCI-000370 MEDIUM The BlackBerry Device Service server must enable a Work Space password length of eight or more characters via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50827r2_rule BBDS-00-000270 CCI-000370 MEDIUM The BlackBerry Device Service server must set the Work Space inactivity timeout to 15 minutes via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50828r2_rule BBDS-00-000275 CCI-000370 MEDIUM The BlackBerry Device Service server must be configured to restrict the download of software within the Work Space to DoD-approved sources only (e.g., DoD-operated mobile device application store or BlackBerry Device Service server). DoD can perform due diligence on sources of software to mitigate the risk that malicious software is introduced to those sources. Therefore, if software is downloaded from a DoD approved source, then it is less likely to be malicious than if it is downlo
    SV-50831r2_rule BBDS-00-000285 CCI-000386 MEDIUM BlackBerry Web Desktop Manager must be configured to disable a users capability to perform self-service tasks. The overall security posture of the BlackBerry system is dependent on strict configuration management controls, including ensuring only authorized BlackBerry devices are being used and authorized devices are provisioned as required. When these configurat
    SV-50832r2_rule BBDS-00-000286 CCI-000386 LOW BlackBerry Web Desktop Manager must be configured to disable a users capability to perform a backup or restore of the Work Space. The overall security posture of the BlackBerry system is dependent on strict configuration management controls, including ensuring only authorized BlackBerry devices are being used and authorized devices are provisioned as required. When these configurat
    SV-50833r2_rule BBDS-00-000287 CCI-000386 LOW The BlackBerry Device Service server must disallow any native applications pertaining to billing via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50834r1_rule BBDS-00-000288 CCI-000386 LOW The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Disallow any native applications pertaining to billing on a managed mobile device. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-50836r2_rule BBDS-00-000290 CCI-000770 HIGH The BlackBerry Device Service server must require administrators to be authenticated with an individual authenticator prior to using a group authenticator. To assure individual accountability and prevent unauthorized access, MDM administrators and users (and any processes acting on behalf of users) must be individually identified and authenticated. Without individual accountability, there can be no traceabi
    SV-50837r2_rule BBDS-00-000295 CCI-000774 HIGH The BlackBerry Device Service server must use organization defined replay-resistant authentication mechanisms for network access to privileged accounts. An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Replay attacks, if successfully used against a MDM account could result in unfettere
    SV-50840r2_rule BBDS-00-000300 CCI-000781 MEDIUM The BlackBerry Device Service server must be configured to accept only trusted connections to back-office enclave application or web push servers. Push servers are set up to push content to BlackBerry users. Device authentication is a solution enabling an organization to manage both users and devices. This requirement applies to MDM servers that provide mobile device and user access to network shares, web servers, and other network resources located on the in
    SV-50841r2_rule BBDS-00-000305 CCI-000192 MEDIUM The BlackBerry Device Service server must support administrator authentication to the server via the Enterprise Authentication Mechanisms authentication. In the DoD, Administrator credential requirements for authentication are defined by CTO 07-115Rev1, which is usually enforced by the Enterprise Authentication Mechanism. Non-complaint credential enforcement mechanisms make the DoD IS vulnerable to attack
    SV-50842r2_rule BBDS-00-000310 CCI-000186 LOW The key store password for the certificate that the BlackBerry Administration Service (BAS) and BlackBerry Web Desktop Manager (BWDM) use must be changed from the default. The key store password protects the server digital authentication certificates from unauthorized use.
    SV-50843r2_rule BBDS-00-000315 CCI-000803 HIGH The BlackBerry Device Service server must use mechanisms for authentication to a cryptographic module meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication. MDM applications utilizing encryption are required to use approved encryption modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Encryption is only as good as the e
    SV-50844r2_rule BBDS-00-000320 CCI-000877 HIGH The BlackBerry Device Service server must employ strong identification and authentication techniques in the establishment of non-local maintenance and diagnostic sessions. Lack of authentication enables anyone to gain access to the MDM. Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Authorization for access to the MDM to perform maintenance a
    SV-50845r2_rule BBDS-00-000325 CCI-001159 LOW The server PKI digital certificate installed on the BlackBerry Device Service (BDS) Server to support BlackBerry Administration Service and BlackBerry Web Desktop Manager (BWDM) authentication must be a DoD PKI issued certificate. A self signed certificate will not be used. When a self signed PKI certificate is used, a rogue BDS server can impersonate the DoD BDS server during SA connections to the BAS or when a BlackBerry user uses BWDM to connect to the BAS. In addition, DoDI 8520-02 requires PKI certificates come from a
    SV-52732r1_rule BBDS-00-000146 CCI-000370 MEDIUM The BlackBerry Device Service server must disable the Advanced Audio Distribution Profile (A2DP) Bluetooth profile via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-52733r1_rule BBDS-00-000147 CCI-000370 MEDIUM The BlackBerry Device Service server must disable the Audio/Video Remote Control Profile (AVRCP) Bluetooth profile via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-52734r1_rule BBDS-00-000148 CCI-000370 MEDIUM The BlackBerry Device Service server must disable the Phone Book Access Profile (PBAP) Bluetooth profile via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-52735r1_rule BBDS-00-000149 CCI-000370 MEDIUM The BlackBerry Device Service server must disable the Hands-Free Profile (HFP) Bluetooth profile via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-52736r1_rule BBDS-00-000151 CCI-000370 MEDIUM The BlackBerry Device Service server must disable the Message Access Profile (MAP) Bluetooth profile via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-52737r1_rule BBDS-00-000152 CCI-000370 MEDIUM The BlackBerry Device Service server must disable the Personal Area Networking Profile (PAN) Bluetooth profile via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-52738r1_rule BBDS-00-003160 CCI-000370 MEDIUM The BlackBerry Device Service server must disable the mobile device users access to BlackBerry World for Work Space and only allow access to apps published from BlackBerry Device Service. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-52739r1_rule BBDS-00-003170 CCI-000370 MEDIUM The BlackBerry Device Service server must force the display of a warning banner on the lock screen of the mobile device via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-52740r1_rule BBDS-00-000156 CCI-000370 MEDIUM The BlackBerry Device Service server must disable the transfer of work files using Bluetooth OPP via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-52741r1_rule BBDS-00-000157 CCI-000370 MEDIUM The BlackBerry Device Service server must disable the transfer of work messages using Bluetooth MAP via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-52742r1_rule BBDS-00-000158 CCI-000370 MEDIUM The BlackBerry Device Service server must disable the transfer of work messages using Bluetooth MAP without a user prompt via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-52743r1_rule BBDS-00-000159 CCI-000370 MEDIUM The BlackBerry Device Service server must disable the Bluetooth transfer of Work Space contacts via centrally managed policy. Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of att
    SV-69227r1_rule BBDS-00-000500 CCI-000366 HIGH BlackBerry Device service 6.2 and BlackBerry Enterprise Service 10.1.x BlackBerry Device Service MDM servers that are no longer supported by the vendor for security updates must not be installed on a system. BlackBerry Device service 6.2 and BlackBerry Enterprise Service 10.1.x BlackBerry Device Service MDM servers that are no longer supported by BlackBerry for security updates are not evaluated or updated for vulnerabilities, leaving them open to potential a