BlackBerry Enterprise Mobility Server 2.x Security Technical Implementation Guide
| V1R2 | 2018-11-29 | U_BEMS_2-x_STIG_V1R2_Manual-xccdf.xml | |
|---|---|---|---|
| V1R1 | 2017-12-11 | U_BEMS_2-x_STIG_V1R1_Manual-xccdf.xml | |
| This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: [email protected] | |||
| Comparison |
|---|
| All 23 |
| No Change 22 |
| Updated 1 |
| Added 0 |
| Removed 0 |
V-79003
No Change
| Findings ID: | BEMS-00-002600 | Rule ID: | SV-93709r1_rule | Severity: | medium | CCI: | CCI-000162 |
|---|
Discussion
If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to log records provides information an attacker could potentially use to his or her advantage.Application servers contain admin interfaces that allow reading and manipulation of log records. Therefore, these interfaces should not allow unfettered access to those records. Application servers also write log data to log files which are stored on the OS, so appropriate file permissions must also be used to restrict access.
Log information includes all information (e.g., log records, log settings, transaction logs, and log reports) needed to successfully log information system activity. Application servers must protect log information from unauthorized read access.
Checks
Verify BEMS has been configured with the following administrator groups/roles, each group/role has required permissions, and at least one user has been assigned to each Administrator group/role: Server primary administrator, auditor.Procedure for Server Primary Administrator:
1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "Dashboard Administrators".
3. Confirm the Administrator role for the primary server administrator has been assigned the dashboard role of Admin.
4. Verify in AD at least one member has been assigned to the BEMS administrator group. (Note: Actual group name may be different.)
Procedure for Auditor:
1. Verify in AD an auditor group has been set up with at least one member.
2. Browse to the log repository.
3. Right-click on the folder.
4. Select "Properties".
5. Select the "Security" tab.
6. Confirm the auditor security group is listed.
If required administrator roles have not been set up on BEMS and at least one user has not been assigned to each role, this is a finding.
Fix
Configure BEMS to have at least one user in the following Administrator roles: Server primary administrator, auditor.1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "Dashboard Administrators".
3. Click "Add Group".
4. In the "Active Directory Security Group" field, type the name of the Microsoft Active Directory security group.
5. Click "Save".
6. Repeat steps 3 to 5 to add additional security groups.
7. For the server primary administrator, the default role of Admin meets the required roles and no additional configuration is needed.
8. For the Auditor role, complete the following steps:
- In active directory, create a domain auditor group and assign personnel designated as auditors to that group.
- Browse to the log repository.
- Right-click on the folder.
- Select "Properties".
- Select the "Security" tab.
- Click "Edit".
- Click "Add".
- Type in name of the user group.
- Confirm that only the necessary groups have rights to the folder (CREATOR OWNER, SYSTEM, Administrators, Auditors).
- Set proper permissions for auditors (Read, List folder contents, Read & Execute).
V-79005
No Change
| Findings ID: | BEMS-00-002700 | Rule ID: | SV-93711r1_rule | Severity: | medium | CCI: | CCI-000163 |
|---|
Discussion
If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to log records provides information an attacker could potentially use to his or her advantage.Application servers contain admin interfaces that allow reading and manipulation of log records. Therefore, these interfaces should not allow unfettered access to those records. Application servers also write log data to log files which are stored on the OS, so appropriate file permissions must also be used to restrict access.
Log information includes all information (e.g., log records, log settings, transaction logs and log reports) needed to successfully log information system activity. Application servers must protect log information from unauthorized modification.
Checks
Verify BEMS has been configured with the following administrator groups/roles, each group/role has required permissions, and at least one user has been assigned to each Administrator group/role: Server primary administrator, auditor.Procedure for Server Primary Administrator:
1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "Dashboard Administrators".
3. Confirm the Administrator role for the primary server administrator has been assigned the dashboard role of Admin.
4. Verify in AD at least one member has been assigned to the BEMS administrator group. (Note: Actual group name may be different.)
Procedure for Auditor:
1. Verify in AD an auditor group has been set up with at least one member.
2. Browse to the log repository.
3. Right-click on the folder.
4. Select "Properties".
5. Select the "Security" tab.
6. Confirm the auditor security group is listed.
If required administrator roles have not been set up on BEMS and at least one user has not been assigned to each role, this is a finding.
Fix
Configure BEMS to have at least one user in the following Administrator roles: Server primary administrator, auditor.1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "Dashboard Administrators".
3. Click "Add Group".
4. In the "Active Directory Security Group" field, type the name of the Microsoft Active Directory security group.
5. Click "Save".
6. Repeat steps 3 to 5 to add additional security groups.
7. For the server primary administrator, the default role of Admin meets the required roles and no additional configuration is needed.
8. For the Auditor role, complete the following steps:
- In active directory, create a domain auditor group and assign personnel designated as auditors to that group.
- Browse to the log repository.
- Right-click on the folder.
- Select "Properties".
- Select the "Security" tab.
- Click "Edit".
- Click "Add".
- Type in name of the user group.
- Confirm that only the necessary groups have rights to the folder (CREATOR OWNER, SYSTEM, Administrators, Auditors).
- Set proper permissions for auditors (Read, List folder contents, Read & Execute).
V-79007
No Change
| Findings ID: | BEMS-00-002800 | Rule ID: | SV-93713r1_rule | Severity: | medium | CCI: | CCI-000164 |
|---|
Discussion
If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve.Application servers contain admin interfaces that allow reading and manipulation of log records. Therefore, these interfaces should not allow for unfettered access to those records. Application servers also write log data to log files which are stored on the OS, so appropriate file permissions must also be used to restrict access.
Log information includes all information (e.g., log records, log settings, transaction logs, and log reports) needed to successfully log information system activity. Application servers must protect log information from unauthorized deletion.
Checks
Verify BEMS has been configured with the following administrator groups/roles, each group/role has required permissions, and at least one user has been assigned to each Administrator group/role: Server primary administrator, auditor.Procedure for Server Primary Administrator:
1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "Dashboard Administrators".
3. Confirm the Administrator role for the primary server administrator has been assigned the dashboard role of Admin.
4. Verify in AD at least one member has been assigned to the BEMS administrator group. (Note: Actual group name may be different.)
Procedure for Auditor:
1. Verify in AD an auditor group has been set up with at least one member.
2. Browse to the log repository.
3. Right-click on the folder.
4. Select "Properties".
5. Select the "Security" tab.
6. Confirm the auditor security group is listed.
If required administrator roles have not been set up on BEMS and at least one user has not been assigned to each role, this is a finding.
Fix
Configure BEMS to have at least one user in the following Administrator roles: Server primary administrator, auditor.1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "Dashboard Administrators".
3. Click "Add Group".
4. In the "Active Directory Security Group" field, type the name of the Microsoft Active Directory security group.
5. Click "Save".
6. Repeat steps 3 to 5 to add additional security groups.
7. For the server primary administrator, the default role of Admin meets the required roles and no additional configuration is needed.
8. For the Auditor role, complete the following steps:
- In active directory, create a domain auditor group and assign personnel designated as auditors to that group.
- Browse to the log repository.
- Right-click on the folder.
- Select "Properties".
- Select the "Security" tab.
- Click "Edit".
- Click "Add".
- Type in name of the user group.
- Confirm that only the necessary groups have rights to the folder (CREATOR OWNER, SYSTEM, Administrators, Auditors).
- Set proper permissions for auditors (Read, List folder contents, Read & Execute).
V-79009
No Change
| Findings ID: | BEMS-00-003800 | Rule ID: | SV-93715r1_rule | Severity: | medium | CCI: | CCI-000382 |
|---|
Discussion
Most information systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Unneeded services and processes provide additional threat vectors and avenues of attack to the information system. BEMS is a critical component of the mobility architecture and must be configured to enable only those ports, protocols, and services (PPS) necessary to support functionality. All others must be expressly disabled or removed. A DoD-approved firewall implements the required network restrictions. A host-based firewall is appropriate where BEMS runs on a standalone platform. Network firewalls or other architectures may be preferred where BEMS runs in a cloud or virtualized solution.Checks
Review the BEMS configuration to determine whether a DoD-approved firewall is installed or if the platform operating system provides a firewall service that can restrict both inbound and outbound traffic by TCP/UDP port and IP address.If there is not a host-based firewall present on BEMS, this is a finding.
Fix
Install a DoD-approved firewall.
V-79011
No Change
| Findings ID: | BEMS-00-003900 | Rule ID: | SV-93717r1_rule | Severity: | medium | CCI: | CCI-000382 |
|---|
Discussion
Most information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations. Since BEMS is a critical component of the mobility architecture and must be configured to enable only those ports, protocols, and services (PPS) necessary to support functionality, all others must be expressly disabled or removed. A firewall installed on BEMS provides a protection mechanism to ensure unwanted service requests do not reach BEMS and outbound traffic is limited to only BEMS functionality.Checks
Ask the BEMS administrator for a list of ports, protocols, and IP address ranges necessary to support BEMS functionality. A list can usually be found in the STIG Supplemental document or MDM product documentation.Compare the list against the configuration of the firewall and identify discrepancies.
If the host-based firewall is not configured to support only those ports, protocols, and IP address ranges necessary for operation, this is a finding.
Fix
Configure the firewall on BEMS to only permit ports, protocols, and IP address ranges necessary for operation.
V-79013
No Change
| Findings ID: | BEMS-00-004000 | Rule ID: | SV-93719r1_rule | Severity: | medium | CCI: | CCI-000382 |
|---|
Discussion
All ports, protocols, and services used on DoD networks must be approved and registered via the DoD PPSM process. This is to ensure that a risk assessment has been completed before a new port, protocol, or service is configured on a DoD network and has been approved by proper DoD authorities. Otherwise, the new port, protocol, or service could cause a vulnerability to the DoD network, which could be exploited by an adversary.Checks
Ask the BEMS administrator for a list of ports, protocols, and services that have been configured on the host-based firewall of BEMS or generate the list by inspecting the firewall. Verify all allowed ports, protocols, and services are included on the DoD PPSM CAL list.If any allowed ports, protocols, and services on the MDM host-based firewall are not included on the DoD PPSM CAL list, this is a finding.
Fix
Turn off any ports, protocols, and services on the BEMS host-based firewall that are not on the DoD PPSM CAL list.
V-79015
Updated
| Findings ID: | BEMS-00-011400 | Rule ID: | SV-93721r |
Severity: | medium | CCI: | CCI-002418 |
|---|
Discussion
Preventing the disclosure of transmitted information requires that the application server take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS).Transmission of data can take place between the application server and a large number of devices/applications external to the application server. Examples are a web client used by a user, a backend database, a log server, or other application servers in an application server cluster.
If data is transmitted unencrypted, the data then becomes vulnerable to disclosure. The disclosure may reveal user identifier/password combinations, website code revealing business logic, or other user personal information.
FIPS 140-2 approved TLS versions include TLS V1.0 or greater.
TLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems. Note, all versions of SSL are not authorized for use per SP 800-52.
Checks
Verify BEMS has been configured to use only approved versions of TLS as follows:1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "ExcludeProtocols" field.
3. Verify if unauthorized versions of SSL and TLS are listed in the "jetty.xml" file.
If BEMS has not been configured to use only approved versions of TLS, this is a finding.
Fix
Configure BEMS to use approved versions of TLS.1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "ExcludeProtocols" field and remove all unauthorized versions or SSL and TLS.
3. Save the file.
4. Restart the BEMS server.
V-79017
No Change
| Findings ID: | BEMS-00-011500 | Rule ID: | SV-93723r1_rule | Severity: | medium | CCI: | CCI-002418 |
|---|
Discussion
During the initial setup of a Transport Layer Security (TLS) connection to the application server, the client sends a list of supported cipher suites in order of preference. The application server will reply with the cipher suite it will use for communication from the client list. If an attacker can intercept the submission of cipher suites to the application server and place, as the preferred cipher suite, a weak export suite, the encryption used for the session becomes easy for the attacker to break, often within minutes to hours.Checks
Verify BEMS has been configured to remove all export ciphers:1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "ExcludeCiphersSuites" field.
3. Verify if any export ciphers are listed in the "jetty.xml" file.
If BEMS has been configured to use export ciphers, this is a finding.
Fix
Configure BEMS to remove all export ciphers.1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "ExcludeCiphersSuites" field and remove all export ciphers.
3. Save file.
4. Restart the BEMS server.
V-79019
No Change
| Findings ID: | BEMS-00-013300 | Rule ID: | SV-93725r1_rule | Severity: | medium | CCI: | CCI-000213 |
|---|
Discussion
Having several administrative roles for the BEMS supports separation of duties. This allows administrator-level privileges to be granted granularly, such as giving application management privileges to one group and security policy privileges to another group. This helps prevent administrators from intentionally or inadvertently altering other settings and configurations they may not understand or approve of, which can weaken overall security and increase the risk of compromise.- Server primary administrator: Responsible for server installation, initial configuration, and maintenance functions. Responsible for the setup and maintenance of security configuration administrator and auditor accounts.
- Auditor: Responsible for reviewing and maintaining server and mobile device audit logs.
Checks
Verify BEMS has been configured with the following administrator groups/roles, each group/role has required permissions, and at least one user has been assigned to each Administrator group/role: Server primary administrator, auditor.Procedure for Server Primary Administrator:
1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "Dashboard Administrators".
3. Confirm the Administrator role for the primary server administrator has been assigned the dashboard role of Admin.
4. Verify in AD at least one member has been assigned to the BEMS administrator group. (Note: Actual group name may be different.)
Procedure for Auditor:
1. Verify in AD an auditor group has been set up with at least one member.
2. Browse to the log repository.
3. Right-click on the folder.
4. Select "Properties".
5. Select the "Security" tab.
6. Confirm the auditor security group is listed.
If required administrator roles have not been set up on BEMS and at least one user has not been assigned to each role, this is a finding.
Fix
Configure BEMS to have at least one user in the following Administrator roles: Server primary administrator, auditor.1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "Dashboard Administrators".
3. Click "Add Group".
4. In the "Active Directory Security Group" field, type the name of the Microsoft Active Directory security group.
5. Click "Save".
6. Repeat steps 3 to 5 to add additional security groups.
7. For the server primary administrator, the default role of Admin meets the required roles and no additional configuration is needed.
8. For the Auditor role, complete the following steps:
- In active directory, create a domain auditor group and assign personnel designated as auditors to that group.
- Browse to the log repository.
- Right-click on the folder.
- Select "Properties".
- Select the "Security" tab.
- Click "Edit".
- Click "Add".
- Type in name of the user group.
- Confirm that only the necessary groups have rights to the folder (CREATOR OWNER, SYSTEM, Administrators, Auditors).
- Set proper permissions for auditors (Read, List folder contents, Read & Execute).
V-79021
No Change
| Findings ID: | BEMS-00-013400 | Rule ID: | SV-93727r1_rule | Severity: | medium | CCI: | CCI-000764 |
|---|
Discussion
To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.Checks
Verify BEMS is configured for Windows Authentication for the database connection as follows:In the Database Information dialog box, verify "Windows Authentication" is selected.
If "Windows Authentication" is not selected for the BEMS database connection, this is a finding.
Fix
Set up Windows Authentication for the database connection on the BEMS console. In the Database Information dialog box, perform the following actions:1. In the "Host" field, type the instance name of your SQL Server.
2. In the "Database" name field, type the name for the BEMS-Core database.
3. In the "Port" field, type the port number that connects to the SQL Server.
4. Select "Windows Authentication".
5. Click "Next".
V-79023
No Change
| Findings ID: | BEMS-00-013500 | Rule ID: | SV-93729r1_rule | Severity: | high | CCI: | CCI-000068 |
|---|
Discussion
Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission to web applications. This is usually achieved through the use of HTTPS.Checks
Verify BEMS has been configured to use HTTPS as follows:1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "BlackBerry Dynamics".
3. In the Protocol drop-down list, verify "HTTPS" is selected.
If HTTPS is not configured on BEMS, this is a finding.
Fix
Configure BEMS to use HTTPS as follows:1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "BlackBerry Dynamics".
3. In the Protocol drop-down list, select "HTTPS".
V-79025
No Change
| Findings ID: | BEMS-00-013600 | Rule ID: | SV-93731r1_rule | Severity: | medium | CCI: | CCI-002470 |
|---|
Discussion
Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoD-approved CA, trust of this CA has not been established.Checks
Verify a DoD SSL certificate has been installed on BEMS as follows:1. Open the browser.
2. Browse to the BEMS dashboard.
3. Select SSL certificate and view the certificate.
4. Verify the certificate is a DoD certificate (has the DoD CA listed in the certificate).
If the SSL certificate installed on BEMS is not a DoD certificate, this is a finding.
Fix
Replace the auto-generated BEMS SSL certificate with a DoD certificate as follows:1. Generate a CSR request and obtain a certificate from the DoD CA.
2. Import the certificate into the BEMS keystore.
3. Update the certificate passwords in BEMS.
V-79027
No Change
| Findings ID: | BEMS-00-013700 | Rule ID: | SV-93733r1_rule | Severity: | medium | CCI: | CCI-002361 |
|---|
Discussion
A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their application session prior to vacating the vicinity, applications need to be able to identify when a user's application session has idled and take action to initiate the session lock.Checks
Verify the BEMS inactivity timeout is set to 15 minutes or less as follows:1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "maxIdleTime" field.
3. Verify it is set to 900 or less (seconds).
If the BEMS inactivity timeout is not set to 15 minutes (900 seconds) or less, this is a finding.
Fix
Configure BEMS with an inactivity timeout of 15 minutes or less.1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "maxIdleTime" field and set it to 900 or less (seconds).
3. Save the file.
4. Restart the BEMS server.
V-79029
No Change
| Findings ID: | BEMS-00-013800 | Rule ID: | SV-93735r1_rule | Severity: | medium | CCI: | CCI-000764 |
|---|
Discussion
To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.Checks
This requirement is not applicable if the Mail service (Push Notifications support for BlackBerry Work) is not enabled on BEMS.Verify the mail service in BEMS is configured for Windows Authentication for the database connection as follows:
1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Mail".
2. Click "Database".
3. In the "Server" field, type the Microsoft SQL Server host name and instance.
4. In the "Database" field, type the database name.
5. In the Windows Authentication drop-down list, verify "Windows Authentication" is selected.
If "Windows Authentication" is not selected for the mail service database connection, this is a finding.
Fix
Set up Windows Authentication for the database connection for the mail service in BEMS:1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Mail".
2. Click "Database".
3. In the "Server" field, type the Microsoft SQL Server host name and instance.
4. In the "Database" field, type the database name.
5. In the Windows Authentication drop-down list, select "Windows Authentication".
6. Click "Save".
V-79031
No Change
| Findings ID: | BEMS-00-013900 | Rule ID: | SV-93737r1_rule | Severity: | medium | CCI: | CCI-000764 |
|---|
Discussion
To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.Checks
This requirement is not applicable if the Mail service (Push Notifications support for BlackBerry Work) is not enabled on BEMS.Verify Windows Integrated Authentication for the Exchange connection for the Mail service has been set up in BEMS as follows:
1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Mail".
2. Click "Microsoft Exchange".
3. Under "Enter Service Account Details", verify "Use Windows Integrated Authentication" has been selected.
If Windows Integrated Authentication for the Exchange connection for the Mail service has not been set up in BEMS, this is a finding.
Fix
Set up Windows Integrated Authentication for the Exchange connection for the Mail service in BEMS:1. Log on to BEMS with the service account that will be configured.
2. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Mail".
3. Click "Microsoft Exchange".
4. Under "Enter Service Account Details", select the "Use Windows Integrated Authentication" check box.
5. Click "Save".
V-79033
No Change
| Findings ID: | BEMS-00-014000 | Rule ID: | SV-93739r1_rule | Severity: | medium | CCI: | CCI-000068 |
|---|
Discussion
Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS) or SSL.Checks
This requirement is not applicable if the Mail service (Push Notifications support for BlackBerry Work) is not enabled on BEMS.Verify Enable SSL LDAP for LDAP Lookup for users for the Mail service is configured in BEMS as follows:
1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Mail".
2. Click "User Directory Lookup".
3. If the "Enable LDAP Lookup" has been selected, verify the "Enable SSL LDAP" check box is also selected.
When LDAP Lookup for user has been configured on BEMS, if Enable SSL LDAP is not configured, this is a finding.
Fix
Enable SSL LDAP when using LDAP Lookup for users for the Mail service in BEMS as follows:1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Mail".
2. Click "User Directory Lookup".
3. Select the "Enable LDAP Lookup" check box.
4. Select the "Enable SSL LDAP" check box.
5. Click "Save".
V-79035
No Change
| Findings ID: | BEMS-00-014100 | Rule ID: | SV-93741r1_rule | Severity: | medium | CCI: | CCI-000068 |
|---|
Discussion
Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS) or SSL.Checks
This requirement is not applicable if the Mail service (Push Notifications support for BlackBerry Work) is not enabled on BEMS.Verify Enable SSL LDAP for LDAP Lookup for certificates for the Mail service is configured in BEMS as follows:
1. In the BEMS Dashboard, under BlackBerry Services Configuration, click mail and then click Certificate Directory Lookup
2. If the Enable LDAP Lookup has been selected, verify the Enable SSL LDAP check box is also selected.
When LDAP Lookup for certificates has been configured on BEMS, if Enable SSL LDAP is not configured, this is a finding.
Fix
Enable SSL LDAP when using LDAP Lookup for certificates for the Mail service in BEMS as follows:1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Mail".
2. Click "Certificate Directory Lookup".
3. Select the "Enable LDAP Lookup" check box.
4. Select the "Enable SSL LDAP" check box.
5. Click "Save".
V-79037
No Change
| Findings ID: | BEMS-00-014200 | Rule ID: | SV-93743r1_rule | Severity: | medium | CCI: | CCI-000764 |
|---|
Discussion
To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.Checks
This requirement is not applicable if the BlackBerry Connect service is not enabled on BEMS.Verify the BlackBerry Connect service in BEMS is configured for Windows Authentication for the database connection as follows:
1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Connect".
2. Click "Database".
3. In the "Database" field, type the database name.
4. In the Windows Authentication drop-down list, verify "Windows Authentication" is selected.
If "Windows Authentication" is not selected for the BlackBerry Connect database connection, this is a finding.
Fix
Set up Windows Authentication for the database connection for the BlackBerry Connect service in BEMS:1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Connect".
2. Click "Database".
3. In the "Database" field, type the database name.
4. In the Windows Authentication drop-down list, select "Windows Authentication".
5. Click "Save".
V-79039
No Change
| Findings ID: | BEMS-00-014300 | Rule ID: | SV-93745r1_rule | Severity: | medium | CCI: | CCI-001453 |
|---|
Discussion
Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS) or SSL. Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoD-approved CA, trust of this CA has not been established.Checks
This requirement is not applicable if the BlackBerry Connect service is not enabled on BEMS.Verify SSL is enabled for the BlackBerry Connect service and a DoD certificate is used as follows:
1. Browse to FQDN of the BEMS Connect server(s) on port 8082.
2. Click on the SSL certificate to verify it has been issued by the DoD CA.
3. Repeat steps 1 and 2 for each BEMS server that has the Connect service added to it.
If SSL is not enabled for BlackBerry Connect and if the SSL certificate is not a DoD CA issued certificate, this is a finding.
Fix
Configure BlackBerry Connect to enable SSL with a DoD certificate.1. Submit a CSR request to the DoD CA.
2. Import the DoD certificate to the computer that hosts BEMS.
3. Bind the SSL certificate to the Connect SSL port.
4. Add the new certificate information to the BEMS configuration file.
5. Configure BlackBerry Connect to send requests over SSL.
6. Configure Connect to use SSL with BlackBerry Proxy.
V-79041
No Change
| Findings ID: | BEMS-00-014400 | Rule ID: | SV-93747r1_rule | Severity: | medium | CCI: | CCI-000764 |
|---|
Discussion
To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.Checks
This requirement is not applicable if the BlackBerry Docs service is not enabled on BEMS.Verify the BlackBerry Docs service in BEMS is configured for Windows Authentication for the database connection as follows:
1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Docs".
2. Click "Database".
3. In the "Database" field, type the database name.
4. In the Windows Authentication drop-down list, verify "Windows Authentication" is selected.
If "Windows Authentication" is not selected for the BlackBerry Docs database connection, this is a finding.
Fix
Set up Windows Authentication for the database connection for the BlackBerry Docs service in BEMS:1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Docs".
2. Click "Database".
3. In the "Database" field, type the database name.
4. In the Windows Authentication drop-down list, select "Windows Authentication".
5. Click "Save".
V-79043
No Change
| Findings ID: | BEMS-00-014500 | Rule ID: | SV-93749r1_rule | Severity: | medium | CCI: | CCI-000764 |
|---|
Discussion
To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.Checks
This requirement is not applicable if the BlackBerry Docs service is not enabled on BEMS.Verify NTLM authentication is enabled for the BlackBerry Docs service as follows:
1. In the BEMS Dashboard, under "Good Services Configuration", click "Docs".
2. Click "Web Proxy".
3. Select "Use Web Proxy".
4. In the Proxy Server Authentication Type drop-down list, verify "NTLM authentication" is selected.
If NTLM authentication is not enabled for the BlackBerry Docs service, this is a finding.
Fix
Configure NTLM authentication for the BlackBerry Docs service as follows:1. In the BEMS Dashboard, under "Good Services Configuration", click "Docs".
2. Click "Web Proxy".
3. Select the "Use Web Proxy".
4. In the Proxy Server Authentication Type drop-down list, select "NTLM authentication".
5. Click "Save".
V-79045
No Change
| Findings ID: | BEMS-00-014600 | Rule ID: | SV-93751r1_rule | Severity: | high | CCI: | CCI-001453 |
|---|
Discussion
Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS) or SSL.Checks
This requirement is not applicable if the BlackBerry Docs service is not enabled on BEMS.Verify the BlackBerry Docs service is configured to use SSL for LDAP Lookup to connect to the Office Web App Server (e.g., SharePoint) as follows:
1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Docs".
2. Click "Settings".
3. Verify "Use SSL for LDAP" is selected.
If SSL for LDAP is not enabled for the BlackBerry Docs service, this is a finding.
Fix
This requirement is not applicable if the BlackBerry Docs service is not enabled on BEMS.Configure the BlackBerry Docs service to use SSL for LDAP Lookup to connect to the Office Web App Server (e.g., SharePoint) as follows:
1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Docs".
2. Click "Settings".
3. Select the "Enable Kerberos Constrained Delegation" check box to allow Docs to use Kerberos constrained delegation.
4. Enter each of the Microsoft SharePoint Online domains you plan to make available.
5. Enter the URL for your approved Office Web App Server.
6. Provide your Microsoft Active Directory user domains (separated by commas) and then enter the corresponding LDAP Port.
7. Select the "Use SSL for LDAP" check box.
8. Click "Save".
V-79047
No Change
| Findings ID: | BEMS-00-014700 | Rule ID: | SV-93753r1_rule | Severity: | medium | CCI: | CCI-000067 |
|---|
Discussion
Logging must be used in order to track system activity, assist in diagnosing system issues, and provide evidence needed for forensic investigations post security incident.Checks
This requirement is not applicable if the BlackBerry Docs service is not enabled on BEMS.Verify audit logging is enabled for the BlackBerry Docs service as follows:
1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Docs".
2. Click "Audit".
3. On the "Audit Settings" tab, verify "Enable Audit Logs" is selected.
If audit logging is not enabled for the BlackBerry Docs service, this is a finding.
Fix
Enable audit logging for the BlackBerry Docs service as follows:1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Docs".
2. Click "Audit".
3. On the "Audit Settings" tab, select the "Enable Audit Logs" check box.
4. Click "Save".