Cyber Trackr - BlackBerry Enterprise Mobility Server 2.x Security Technical Implementation Guide

Warning: Incompatible Browser

Incompatible Browser Detected - Internet Explorer

This web site uses advanced JavaScript for several data processing functions. Internet Explorer has severe deficiencies in it's JavaScript engine. Please use a modern day browser, such as Chrome or Edge, in order to take full advantage of this web site.

V-79003 No Change

Findings ID:	BEMS-00-002600	Rule ID:	SV-93709r1_rule	Severity:	medium	CCI:	CCI-000162

Discussion

If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to log records provides information an attacker could potentially use to his or her advantage.

Application servers contain admin interfaces that allow reading and manipulation of log records. Therefore, these interfaces should not allow unfettered access to those records. Application servers also write log data to log files which are stored on the OS, so appropriate file permissions must also be used to restrict access.

Log information includes all information (e.g., log records, log settings, transaction logs, and log reports) needed to successfully log information system activity. Application servers must protect log information from unauthorized read access.

Checks

Verify BEMS has been configured with the following administrator groups/roles, each group/role has required permissions, and at least one user has been assigned to each Administrator group/role: Server primary administrator, auditor.

Procedure for Server Primary Administrator:
1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "Dashboard Administrators".
3. Confirm the Administrator role for the primary server administrator has been assigned the dashboard role of Admin.
4. Verify in AD at least one member has been assigned to the BEMS administrator group. (Note: Actual group name may be different.)

Procedure for Auditor:
1. Verify in AD an auditor group has been set up with at least one member.
2. Browse to the log repository.
3. Right-click on the folder.
4. Select "Properties".
5. Select the "Security" tab.
6. Confirm the auditor security group is listed.

If required administrator roles have not been set up on BEMS and at least one user has not been assigned to each role, this is a finding.

Fix

Configure BEMS to have at least one user in the following Administrator roles: Server primary administrator, auditor.

1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "Dashboard Administrators".
3. Click "Add Group".
4. In the "Active Directory Security Group" field, type the name of the Microsoft Active Directory security group.
5. Click "Save".
6. Repeat steps 3 to 5 to add additional security groups.
7. For the server primary administrator, the default role of Admin meets the required roles and no additional configuration is needed.
8. For the Auditor role, complete the following steps:
- In active directory, create a domain auditor group and assign personnel designated as auditors to that group.
- Browse to the log repository.
- Right-click on the folder.
- Select "Properties".
- Select the "Security" tab.
- Click "Edit".
- Click "Add".
- Type in name of the user group.
- Confirm that only the necessary groups have rights to the folder (CREATOR OWNER, SYSTEM, Administrators, Auditors).
- Set proper permissions for auditors (Read, List folder contents, Read & Execute).

V-79005 No Change

Findings ID:	BEMS-00-002700	Rule ID:	SV-93711r1_rule	Severity:	medium	CCI:	CCI-000163

Discussion

If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to log records provides information an attacker could potentially use to his or her advantage.

Application servers contain admin interfaces that allow reading and manipulation of log records. Therefore, these interfaces should not allow unfettered access to those records. Application servers also write log data to log files which are stored on the OS, so appropriate file permissions must also be used to restrict access.

Log information includes all information (e.g., log records, log settings, transaction logs and log reports) needed to successfully log information system activity. Application servers must protect log information from unauthorized modification.

Checks

Verify BEMS has been configured with the following administrator groups/roles, each group/role has required permissions, and at least one user has been assigned to each Administrator group/role: Server primary administrator, auditor.

Procedure for Server Primary Administrator:
1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "Dashboard Administrators".
3. Confirm the Administrator role for the primary server administrator has been assigned the dashboard role of Admin.
4. Verify in AD at least one member has been assigned to the BEMS administrator group. (Note: Actual group name may be different.)

Procedure for Auditor:
1. Verify in AD an auditor group has been set up with at least one member.
2. Browse to the log repository.
3. Right-click on the folder.
4. Select "Properties".
5. Select the "Security" tab.
6. Confirm the auditor security group is listed.

If required administrator roles have not been set up on BEMS and at least one user has not been assigned to each role, this is a finding.

Fix

Configure BEMS to have at least one user in the following Administrator roles: Server primary administrator, auditor.

1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "Dashboard Administrators".
3. Click "Add Group".
4. In the "Active Directory Security Group" field, type the name of the Microsoft Active Directory security group.
5. Click "Save".
6. Repeat steps 3 to 5 to add additional security groups.
7. For the server primary administrator, the default role of Admin meets the required roles and no additional configuration is needed.
8. For the Auditor role, complete the following steps:
- In active directory, create a domain auditor group and assign personnel designated as auditors to that group.
- Browse to the log repository.
- Right-click on the folder.
- Select "Properties".
- Select the "Security" tab.
- Click "Edit".
- Click "Add".
- Type in name of the user group.
- Confirm that only the necessary groups have rights to the folder (CREATOR OWNER, SYSTEM, Administrators, Auditors).
- Set proper permissions for auditors (Read, List folder contents, Read & Execute).

V-79007 No Change

Findings ID:	BEMS-00-002800	Rule ID:	SV-93713r1_rule	Severity:	medium	CCI:	CCI-000164

Discussion

If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve.

Application servers contain admin interfaces that allow reading and manipulation of log records. Therefore, these interfaces should not allow for unfettered access to those records. Application servers also write log data to log files which are stored on the OS, so appropriate file permissions must also be used to restrict access.

Log information includes all information (e.g., log records, log settings, transaction logs, and log reports) needed to successfully log information system activity. Application servers must protect log information from unauthorized deletion.

Checks

Verify BEMS has been configured with the following administrator groups/roles, each group/role has required permissions, and at least one user has been assigned to each Administrator group/role: Server primary administrator, auditor.

Procedure for Server Primary Administrator:
1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "Dashboard Administrators".
3. Confirm the Administrator role for the primary server administrator has been assigned the dashboard role of Admin.
4. Verify in AD at least one member has been assigned to the BEMS administrator group. (Note: Actual group name may be different.)

Procedure for Auditor:
1. Verify in AD an auditor group has been set up with at least one member.
2. Browse to the log repository.
3. Right-click on the folder.
4. Select "Properties".
5. Select the "Security" tab.
6. Confirm the auditor security group is listed.

If required administrator roles have not been set up on BEMS and at least one user has not been assigned to each role, this is a finding.

Fix

Configure BEMS to have at least one user in the following Administrator roles: Server primary administrator, auditor.

1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "Dashboard Administrators".
3. Click "Add Group".
4. In the "Active Directory Security Group" field, type the name of the Microsoft Active Directory security group.
5. Click "Save".
6. Repeat steps 3 to 5 to add additional security groups.
7. For the server primary administrator, the default role of Admin meets the required roles and no additional configuration is needed.
8. For the Auditor role, complete the following steps:
- In active directory, create a domain auditor group and assign personnel designated as auditors to that group.
- Browse to the log repository.
- Right-click on the folder.
- Select "Properties".
- Select the "Security" tab.
- Click "Edit".
- Click "Add".
- Type in name of the user group.
- Confirm that only the necessary groups have rights to the folder (CREATOR OWNER, SYSTEM, Administrators, Auditors).
- Set proper permissions for auditors (Read, List folder contents, Read & Execute).

V-79009 No Change

Findings ID:	BEMS-00-003800	Rule ID:	SV-93715r1_rule	Severity:	medium	CCI:	CCI-000382

Discussion

Most information systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Unneeded services and processes provide additional threat vectors and avenues of attack to the information system. BEMS is a critical component of the mobility architecture and must be configured to enable only those ports, protocols, and services (PPS) necessary to support functionality. All others must be expressly disabled or removed. A DoD-approved firewall implements the required network restrictions. A host-based firewall is appropriate where BEMS runs on a standalone platform. Network firewalls or other architectures may be preferred where BEMS runs in a cloud or virtualized solution.

Checks

Review the BEMS configuration to determine whether a DoD-approved firewall is installed or if the platform operating system provides a firewall service that can restrict both inbound and outbound traffic by TCP/UDP port and IP address.

If there is not a host-based firewall present on BEMS, this is a finding.

Fix

Install a DoD-approved firewall.

V-79011 No Change

Findings ID:	BEMS-00-003900	Rule ID:	SV-93717r1_rule	Severity:	medium	CCI:	CCI-000382

Discussion

Most information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations. Since BEMS is a critical component of the mobility architecture and must be configured to enable only those ports, protocols, and services (PPS) necessary to support functionality, all others must be expressly disabled or removed. A firewall installed on BEMS provides a protection mechanism to ensure unwanted service requests do not reach BEMS and outbound traffic is limited to only BEMS functionality.

Checks

Ask the BEMS administrator for a list of ports, protocols, and IP address ranges necessary to support BEMS functionality. A list can usually be found in the STIG Supplemental document or MDM product documentation.

Compare the list against the configuration of the firewall and identify discrepancies.

If the host-based firewall is not configured to support only those ports, protocols, and IP address ranges necessary for operation, this is a finding.

Fix

Configure the firewall on BEMS to only permit ports, protocols, and IP address ranges necessary for operation.

V-79013 No Change

Findings ID:	BEMS-00-004000	Rule ID:	SV-93719r1_rule	Severity:	medium	CCI:	CCI-000382

Discussion

All ports, protocols, and services used on DoD networks must be approved and registered via the DoD PPSM process. This is to ensure that a risk assessment has been completed before a new port, protocol, or service is configured on a DoD network and has been approved by proper DoD authorities. Otherwise, the new port, protocol, or service could cause a vulnerability to the DoD network, which could be exploited by an adversary.

Checks

Ask the BEMS administrator for a list of ports, protocols, and services that have been configured on the host-based firewall of BEMS or generate the list by inspecting the firewall. Verify all allowed ports, protocols, and services are included on the DoD PPSM CAL list.

If any allowed ports, protocols, and services on the MDM host-based firewall are not included on the DoD PPSM CAL list, this is a finding.

Fix

Turn off any ports, protocols, and services on the BEMS host-based firewall that are not on the DoD PPSM CAL list.

V-79015 Updated

Findings ID:	BEMS-00-011400	Rule ID:	SV-93721r12_rule	Severity:	medium	CCI:	CCI-002418

Discussion

Preventing the disclosure of transmitted information requires that the application server take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS).

Transmission of data can take place between the application server and a large number of devices/applications external to the application server. Examples are a web client used by a user, a backend database, a log server, or other application servers in an application server cluster.

If data is transmitted unencrypted, the data then becomes vulnerable to disclosure. The disclosure may reveal user identifier/password combinations, website code revealing business logic, or other user personal information.

FIPS 140-2 approved TLS versions include TLS V1.0 or greater.

TLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems. Note, all versions of SSL are not authorized for use per SP 800-52.

Checks

Verify BEMS has been configured to use only approved versions of TLS as follows:

1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "ExcludeProtocols" field.
3. Verify if unauthorized versions of SSL and TLS are listed in the "jetty.xml" file.

If BEMS has not been configured to use only approved versions of TLS, this is a finding.

Fix

Configure BEMS to use approved versions of TLS.

1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "ExcludeProtocols" field and remove all unauthorized versions or SSL and TLS.
3. Save the file.
4. Restart the BEMS server.

V-79017 No Change

Findings ID:	BEMS-00-011500	Rule ID:	SV-93723r1_rule	Severity:	medium	CCI:	CCI-002418

Discussion

During the initial setup of a Transport Layer Security (TLS) connection to the application server, the client sends a list of supported cipher suites in order of preference. The application server will reply with the cipher suite it will use for communication from the client list. If an attacker can intercept the submission of cipher suites to the application server and place, as the preferred cipher suite, a weak export suite, the encryption used for the session becomes easy for the attacker to break, often within minutes to hours.

Checks

Verify BEMS has been configured to remove all export ciphers:

1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "ExcludeCiphersSuites" field.
3. Verify if any export ciphers are listed in the "jetty.xml" file.

If BEMS has been configured to use export ciphers, this is a finding.

Fix

Configure BEMS to remove all export ciphers.

1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "ExcludeCiphersSuites" field and remove all export ciphers.
3. Save file.
4. Restart the BEMS server.

V-79019 No Change

Findings ID:	BEMS-00-013300	Rule ID:	SV-93725r1_rule	Severity:	medium	CCI:	CCI-000213

Discussion

Having several administrative roles for the BEMS supports separation of duties. This allows administrator-level privileges to be granted granularly, such as giving application management privileges to one group and security policy privileges to another group. This helps prevent administrators from intentionally or inadvertently altering other settings and configurations they may not understand or approve of, which can weaken overall security and increase the risk of compromise.

- Server primary administrator: Responsible for server installation, initial configuration, and maintenance functions. Responsible for the setup and maintenance of security configuration administrator and auditor accounts.
- Auditor: Responsible for reviewing and maintaining server and mobile device audit logs.

Checks

Verify BEMS has been configured with the following administrator groups/roles, each group/role has required permissions, and at least one user has been assigned to each Administrator group/role: Server primary administrator, auditor.

Procedure for Server Primary Administrator:
1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "Dashboard Administrators".
3. Confirm the Administrator role for the primary server administrator has been assigned the dashboard role of Admin.
4. Verify in AD at least one member has been assigned to the BEMS administrator group. (Note: Actual group name may be different.)

Procedure for Auditor:
1. Verify in AD an auditor group has been set up with at least one member.
2. Browse to the log repository.
3. Right-click on the folder.
4. Select "Properties".
5. Select the "Security" tab.
6. Confirm the auditor security group is listed.

If required administrator roles have not been set up on BEMS and at least one user has not been assigned to each role, this is a finding.

Fix

Configure BEMS to have at least one user in the following Administrator roles: Server primary administrator, auditor.

1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "Dashboard Administrators".
3. Click "Add Group".
4. In the "Active Directory Security Group" field, type the name of the Microsoft Active Directory security group.
5. Click "Save".
6. Repeat steps 3 to 5 to add additional security groups.
7. For the server primary administrator, the default role of Admin meets the required roles and no additional configuration is needed.
8. For the Auditor role, complete the following steps:
- In active directory, create a domain auditor group and assign personnel designated as auditors to that group.
- Browse to the log repository.
- Right-click on the folder.
- Select "Properties".
- Select the "Security" tab.
- Click "Edit".
- Click "Add".
- Type in name of the user group.
- Confirm that only the necessary groups have rights to the folder (CREATOR OWNER, SYSTEM, Administrators, Auditors).
- Set proper permissions for auditors (Read, List folder contents, Read & Execute).

V-79021 No Change

Findings ID:	BEMS-00-013400	Rule ID:	SV-93727r1_rule	Severity:	medium	CCI:	CCI-000764

Discussion

To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.

Checks

Verify BEMS is configured for Windows Authentication for the database connection as follows:

In the Database Information dialog box, verify "Windows Authentication" is selected.

If "Windows Authentication" is not selected for the BEMS database connection, this is a finding.

Fix

Set up Windows Authentication for the database connection on the BEMS console. In the Database Information dialog box, perform the following actions:

1. In the "Host" field, type the instance name of your SQL Server.
2. In the "Database" name field, type the name for the BEMS-Core database.
3. In the "Port" field, type the port number that connects to the SQL Server.
4. Select "Windows Authentication".
5. Click "Next".

V-79023 No Change

Findings ID:	BEMS-00-013500	Rule ID:	SV-93729r1_rule	Severity:	high	CCI:	CCI-000068

Discussion

Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission to web applications. This is usually achieved through the use of HTTPS.

Checks

Verify BEMS has been configured to use HTTPS as follows:

1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "BlackBerry Dynamics".
3. In the Protocol drop-down list, verify "HTTPS" is selected.

If HTTPS is not configured on BEMS, this is a finding.

Fix

Configure BEMS to use HTTPS as follows:

1. In the BEMS Dashboard, under "BEMS System Settings", click "BEMS Configuration".
2. Click "BlackBerry Dynamics".
3. In the Protocol drop-down list, select "HTTPS".

V-79025 No Change

Findings ID:	BEMS-00-013600	Rule ID:	SV-93731r1_rule	Severity:	medium	CCI:	CCI-002470

Discussion

Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoD-approved CA, trust of this CA has not been established.

Checks

Verify a DoD SSL certificate has been installed on BEMS as follows:

1. Open the browser.
2. Browse to the BEMS dashboard.
3. Select SSL certificate and view the certificate.
4. Verify the certificate is a DoD certificate (has the DoD CA listed in the certificate).

If the SSL certificate installed on BEMS is not a DoD certificate, this is a finding.

Fix

Replace the auto-generated BEMS SSL certificate with a DoD certificate as follows:

1. Generate a CSR request and obtain a certificate from the DoD CA.
2. Import the certificate into the BEMS keystore.
3. Update the certificate passwords in BEMS.

V-79027 No Change

Findings ID:	BEMS-00-013700	Rule ID:	SV-93733r1_rule	Severity:	medium	CCI:	CCI-002361

Discussion

A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their application session prior to vacating the vicinity, applications need to be able to identify when a user's application session has idled and take action to initiate the session lock.

Checks

Verify the BEMS inactivity timeout is set to 15 minutes or less as follows:

1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "maxIdleTime" field.
3. Verify it is set to 900 or less (seconds).

If the BEMS inactivity timeout is not set to 15 minutes (900 seconds) or less, this is a finding.

Fix

Configure BEMS with an inactivity timeout of 15 minutes or less.

1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "maxIdleTime" field and set it to 900 or less (seconds).
3. Save the file.
4. Restart the BEMS server.

V-79029 No Change

Findings ID:	BEMS-00-013800	Rule ID:	SV-93735r1_rule	Severity:	medium	CCI:	CCI-000764

Discussion

To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.

Checks

This requirement is not applicable if the Mail service (Push Notifications support for BlackBerry Work) is not enabled on BEMS.

Verify the mail service in BEMS is configured for Windows Authentication for the database connection as follows:

1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Mail".
2. Click "Database".
3. In the "Server" field, type the Microsoft SQL Server host name and instance.
4. In the "Database" field, type the database name.
5. In the Windows Authentication drop-down list, verify "Windows Authentication" is selected.

If "Windows Authentication" is not selected for the mail service database connection, this is a finding.

Fix

Set up Windows Authentication for the database connection for the mail service in BEMS:

1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Mail".
2. Click "Database".
3. In the "Server" field, type the Microsoft SQL Server host name and instance.
4. In the "Database" field, type the database name.
5. In the Windows Authentication drop-down list, select "Windows Authentication".
6. Click "Save".

V-79031 No Change

Findings ID:	BEMS-00-013900	Rule ID:	SV-93737r1_rule	Severity:	medium	CCI:	CCI-000764

Discussion

To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.

Checks

This requirement is not applicable if the Mail service (Push Notifications support for BlackBerry Work) is not enabled on BEMS.

Verify Windows Integrated Authentication for the Exchange connection for the Mail service has been set up in BEMS as follows:

1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Mail".
2. Click "Microsoft Exchange".
3. Under "Enter Service Account Details", verify "Use Windows Integrated Authentication" has been selected.

If Windows Integrated Authentication for the Exchange connection for the Mail service has not been set up in BEMS, this is a finding.

Fix

Set up Windows Integrated Authentication for the Exchange connection for the Mail service in BEMS:

1. Log on to BEMS with the service account that will be configured.
2. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Mail".
3. Click "Microsoft Exchange".
4. Under "Enter Service Account Details", select the "Use Windows Integrated Authentication" check box.
5. Click "Save".

V-79033 No Change

Findings ID:	BEMS-00-014000	Rule ID:	SV-93739r1_rule	Severity:	medium	CCI:	CCI-000068

Discussion

Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS) or SSL.

Checks

This requirement is not applicable if the Mail service (Push Notifications support for BlackBerry Work) is not enabled on BEMS.

Verify Enable SSL LDAP for LDAP Lookup for users for the Mail service is configured in BEMS as follows:

1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Mail".
2. Click "User Directory Lookup".
3. If the "Enable LDAP Lookup" has been selected, verify the "Enable SSL LDAP" check box is also selected.

When LDAP Lookup for user has been configured on BEMS, if Enable SSL LDAP is not configured, this is a finding.

Fix

Enable SSL LDAP when using LDAP Lookup for users for the Mail service in BEMS as follows:

1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Mail".
2. Click "User Directory Lookup".
3. Select the "Enable LDAP Lookup" check box.
4. Select the "Enable SSL LDAP" check box.
5. Click "Save".

V-79035 No Change

Findings ID:	BEMS-00-014100	Rule ID:	SV-93741r1_rule	Severity:	medium	CCI:	CCI-000068

Discussion

Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS) or SSL.

Checks

This requirement is not applicable if the Mail service (Push Notifications support for BlackBerry Work) is not enabled on BEMS.

Verify Enable SSL LDAP for LDAP Lookup for certificates for the Mail service is configured in BEMS as follows:

1. In the BEMS Dashboard, under BlackBerry Services Configuration, click mail and then click Certificate Directory Lookup
2. If the Enable LDAP Lookup has been selected, verify the Enable SSL LDAP check box is also selected.

When LDAP Lookup for certificates has been configured on BEMS, if Enable SSL LDAP is not configured, this is a finding.

Fix

Enable SSL LDAP when using LDAP Lookup for certificates for the Mail service in BEMS as follows:

1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Mail".
2. Click "Certificate Directory Lookup".
3. Select the "Enable LDAP Lookup" check box.
4. Select the "Enable SSL LDAP" check box.
5. Click "Save".

V-79037 No Change

Findings ID:	BEMS-00-014200	Rule ID:	SV-93743r1_rule	Severity:	medium	CCI:	CCI-000764

Discussion

To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.

Checks

This requirement is not applicable if the BlackBerry Connect service is not enabled on BEMS.

Verify the BlackBerry Connect service in BEMS is configured for Windows Authentication for the database connection as follows:

1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Connect".
2. Click "Database".
3. In the "Database" field, type the database name.
4. In the Windows Authentication drop-down list, verify "Windows Authentication" is selected.

If "Windows Authentication" is not selected for the BlackBerry Connect database connection, this is a finding.

Fix

Set up Windows Authentication for the database connection for the BlackBerry Connect service in BEMS:

1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Connect".
2. Click "Database".
3. In the "Database" field, type the database name.
4. In the Windows Authentication drop-down list, select "Windows Authentication".
5. Click "Save".

V-79039 No Change

Findings ID:	BEMS-00-014300	Rule ID:	SV-93745r1_rule	Severity:	medium	CCI:	CCI-001453

Discussion

Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS) or SSL. Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoD-approved CA, trust of this CA has not been established.

Checks

This requirement is not applicable if the BlackBerry Connect service is not enabled on BEMS.

Verify SSL is enabled for the BlackBerry Connect service and a DoD certificate is used as follows:

1. Browse to FQDN of the BEMS Connect server(s) on port 8082.
2. Click on the SSL certificate to verify it has been issued by the DoD CA.
3. Repeat steps 1 and 2 for each BEMS server that has the Connect service added to it.

If SSL is not enabled for BlackBerry Connect and if the SSL certificate is not a DoD CA issued certificate, this is a finding.

Fix

Configure BlackBerry Connect to enable SSL with a DoD certificate.

1. Submit a CSR request to the DoD CA.
2. Import the DoD certificate to the computer that hosts BEMS.
3. Bind the SSL certificate to the Connect SSL port.
4. Add the new certificate information to the BEMS configuration file.
5. Configure BlackBerry Connect to send requests over SSL.
6. Configure Connect to use SSL with BlackBerry Proxy.

V-79041 No Change

Findings ID:	BEMS-00-014400	Rule ID:	SV-93747r1_rule	Severity:	medium	CCI:	CCI-000764

Discussion

To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.

Checks

This requirement is not applicable if the BlackBerry Docs service is not enabled on BEMS.

Verify the BlackBerry Docs service in BEMS is configured for Windows Authentication for the database connection as follows:

1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Docs".
2. Click "Database".
3. In the "Database" field, type the database name.
4. In the Windows Authentication drop-down list, verify "Windows Authentication" is selected.

If "Windows Authentication" is not selected for the BlackBerry Docs database connection, this is a finding.

Fix

Set up Windows Authentication for the database connection for the BlackBerry Docs service in BEMS:

1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Docs".
2. Click "Database".
3. In the "Database" field, type the database name.
4. In the Windows Authentication drop-down list, select "Windows Authentication".
5. Click "Save".

V-79043 No Change

Findings ID:	BEMS-00-014500	Rule ID:	SV-93749r1_rule	Severity:	medium	CCI:	CCI-000764

Discussion

To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.

Checks

This requirement is not applicable if the BlackBerry Docs service is not enabled on BEMS.

Verify NTLM authentication is enabled for the BlackBerry Docs service as follows:

1. In the BEMS Dashboard, under "Good Services Configuration", click "Docs".
2. Click "Web Proxy".
3. Select "Use Web Proxy".
4. In the Proxy Server Authentication Type drop-down list, verify "NTLM authentication" is selected.

If NTLM authentication is not enabled for the BlackBerry Docs service, this is a finding.

Fix

Configure NTLM authentication for the BlackBerry Docs service as follows:

1. In the BEMS Dashboard, under "Good Services Configuration", click "Docs".
2. Click "Web Proxy".
3. Select the "Use Web Proxy".
4. In the Proxy Server Authentication Type drop-down list, select "NTLM authentication".
5. Click "Save".

V-79045 No Change

Findings ID:	BEMS-00-014600	Rule ID:	SV-93751r1_rule	Severity:	high	CCI:	CCI-001453

Discussion

Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS) or SSL.

Checks

This requirement is not applicable if the BlackBerry Docs service is not enabled on BEMS.

Verify the BlackBerry Docs service is configured to use SSL for LDAP Lookup to connect to the Office Web App Server (e.g., SharePoint) as follows:

1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Docs".
2. Click "Settings".
3. Verify "Use SSL for LDAP" is selected.

If SSL for LDAP is not enabled for the BlackBerry Docs service, this is a finding.

Fix

This requirement is not applicable if the BlackBerry Docs service is not enabled on BEMS.

Configure the BlackBerry Docs service to use SSL for LDAP Lookup to connect to the Office Web App Server (e.g., SharePoint) as follows:

1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Docs".
2. Click "Settings".
3. Select the "Enable Kerberos Constrained Delegation" check box to allow Docs to use Kerberos constrained delegation.
4. Enter each of the Microsoft SharePoint Online domains you plan to make available.
5. Enter the URL for your approved Office Web App Server.
6. Provide your Microsoft Active Directory user domains (separated by commas) and then enter the corresponding LDAP Port.
7. Select the "Use SSL for LDAP" check box.
8. Click "Save".

V-79047 No Change

Findings ID:	BEMS-00-014700	Rule ID:	SV-93753r1_rule	Severity:	medium	CCI:	CCI-000067

Discussion

Logging must be used in order to track system activity, assist in diagnosing system issues, and provide evidence needed for forensic investigations post security incident.

Checks

This requirement is not applicable if the BlackBerry Docs service is not enabled on BEMS.

Verify audit logging is enabled for the BlackBerry Docs service as follows:

1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Docs".
2. Click "Audit".
3. On the "Audit Settings" tab, verify "Enable Audit Logs" is selected.

If audit logging is not enabled for the BlackBerry Docs service, this is a finding.

Fix

Enable audit logging for the BlackBerry Docs service as follows:

1. In the BEMS Dashboard, under "BlackBerry Services Configuration", click "Docs".
2. Click "Audit".
3. On the "Audit Settings" tab, select the "Enable Audit Logs" check box.
4. Click "Save".

Incompatible Browser Detected - Internet Explorer

BlackBerry Enterprise Mobility Server 2.x Security Technical Implementation Guide

STIG Details

Comparison Details

Compare/View Releases

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix

Discussion

Checks

Fix