Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

BlackBerry 10.2.x OS Security Technical Implementation Guide

V1R6 · · · Released 24 Jul 2015 · 28 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

Developed by BlackBerry Ltd. in coordination with DISA for use in the DoD. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.
Digest of Updates vs. V1R3 · 24 Oct 2014 −6 ⚠ 2 ✎ 23

Comparison against the immediately-prior release (V1R3). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.

Removed rules 6

  • V-47209 Medium BlackBerry 10 OS must prevent a user from using a browser that does not direct its traffic to a DoD proxy server.
  • V-47211 Medium BlackBerry 10 OS must use a DoD proxy server.
  • V-47213 Medium BlackBerry 10 OS must prevent a user from using a browser that does not direct its traffic to a DoD proxy server.
  • V-47225 Medium BlackBerry 10 OS must prohibit wireless remote access connection for storage.
  • V-47227 Medium BlackBerry 10 OS must prohibit wireless remote access connection for media sharing.
  • V-47237 Low BlackBerry 10 OS must prevent DoD applications from accessing non-DoD data when the device supports multiple user environments (e.g., work and personal) if such access has not been approved.

Severity changes 2

  • V-47183 High Medium BlackBerry 10 OS must prevent a user from installing unapproved applications.
  • V-47187 High Medium BlackBerry 10 OS must prevent a user from installing unapproved applications from other sources.

Content changes 23

  • V-47171 Medium check BlackBerry 10 OS must retain the lock on the Work Space until the user reestablishes access using established identification and authentication procedures.
  • V-47173 Medium checkfix BlackBerry 10 OS must retain the device lock until the user reestablishes access using established identification and authentication procedures.
  • V-47175 Medium checkfix BlackBerry 10 OS must lock the Work Space after no more than 15 minutes of inactivity.
  • V-47177 Medium checkfix BlackBerry 10 OS must prevent applications from extending the Work Space password lock time.
  • V-47179 Low checkfix BlackBerry 10 OS must synchronize the internal clock on an organizationally-defined periodic basis with an authoritative time server or the Global Positioning System.
  • V-47181 Medium checkfix BlackBerry 10 OS must enforce a minimum length for the Work Space unlock password.
  • V-47185 High descriptioncheckfix BlackBerry 10 OS must prevent a user from installing unapproved applications in the Work Space.
  • V-47189 Medium descriptionfix BlackBerry 10 OS must only permit downloading of software from a DoD-approved source (e.g., DoD-operated mobile device application store or MDM server).
  • V-47191 Medium check BlackBerry 10 OSs Wi-Fi module must use EAP-TLS authentication when authenticating to DoD WLAN authentication servers.
  • V-47193 Medium descriptioncheckfix BlackBerry 10 OS VPN client must employ DoD PKI-approved mechanisms for authentication when connecting to DoD networks.
  • V-47197 Medium checkfix BlackBerry 10 OS must have access to DoD root and intermediate PKI certificates when performing DoD PKI-related transactions.
  • V-47199 Medium descriptioncheckfix BlackBerry 10 OS must block both the inbound and outbound traffic between instant messaging clients that are independently configured by end users and external service providers or other unapproved DoD systems.
  • V-47201 High checkfix BlackBerry 10 OS must grant a downloaded application only the permissions the AO has authorized for that application.
  • V-47203 High checkfix The BlackBerry 10 OS Work Space must only install and use DoD PKI-issued or DoD-approved software authentication certificates.
  • V-47205 Medium checkfix The BlackBerry 10 OS Work Space must only install and use DoD PKI-issued or DoD-approved server authentication certificates.
  • V-47207 Medium descriptioncheckfix BlackBerry 10 OS must be updated to the latest approved version of the operating system.
  • V-47215 Medium checkfix BlackBerry 10 OS maximum number of consecutive unsuccessful unlock attempts must be less than 10.
  • V-47217 Medium checkfix BlackBerry 10 OS must employ mobile device management services to centrally manage IT Policies.
  • V-47219 Medium checkfix BlackBerry 10 OS must employ mobile device management services to centrally manage email settings.
  • V-47221 Medium checkfix BlackBerry 10 OS must employ mobile device management services to centrally manage Wi-Fi profiles.
  • V-47229 Low checkfix BlackBerry 10 OS must enable a system administrator to (i) select which data fields will be available to applications outside of the contact database application and (ii) limit the number of contact database fields accessible outside of a work persona in the case of dual persona phones.
  • V-47233 Low checkfix BlackBerry 10 OS, for PKI-based authentication must validate certificates by querying the certification authority for revocation status of the certificate.
  • V-48597 Medium check BlackBerry 10 OSs VPN client must use either IPsec or SSL/TLS when connecting to DoD networks.
Sort by
b
BlackBerry 10 OS must display the DoD warning banner exactly as specified at start-up device unlock.
AC-8 - Medium - CCI-000048 - V-47169 - SV-60041r3_rule
RMF Control
AC-8
Severity
M
CCI
CCI-000048
Version
BB10-2X-000100
Vuln IDs
  • V-47169
Rule IDs
  • SV-60041r3_rule
The operating system is required to display the DoD-approved system use notification message or banner before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. This ensures the legal requirements for auditing and monitoring are met. System use notification messages must be displayed when individuals log in to the information system. The approved DoD text must be used as specified in the DoD Instruction 8500.01 dated March 14, 2014.
Checks: C-49995r2_chk

From either the Work Space or Personal Space, while holding the Power button, select "Lock" to lock the device. Ensure " I've read & consent to terms in IS user agreem't." is displayed on the lock screen. Otherwise, this is a finding.

Fix: F-50873r2_fix

On BlackBerry Device Service server, set "Owner Information" IT Policy rule to " I've read & consent to terms in IS user agreem't." NOTE: This fix procedure affects both Personal and Work Spaces.

b
BlackBerry 10 OS must retain the lock on the Work Space until the user reestablishes access using established identification and authentication procedures.
AC-11 - Medium - CCI-000056 - V-47171 - SV-60043r2_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000056
Version
BB10-2X-000110
Vuln IDs
  • V-47171
Rule IDs
  • SV-60043r2_rule
The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identification and authentication procedures. A device lock is a temporary action taken when a user stops work but does not want to log out because of the temporary nature of the hiatus. During the device lock a publicly viewable pattern is visible on the associated display, hiding what was previously visible on the screen. Once invoked, the device lock shall remain in place until the user re-authenticates. No other system activity aside from re-authentication can unlock the system. The operating system must enforce a device lock function. This prevents others from gaining access to the device when not in the user's possession and accessing sensitive DoD information. The identification and authentication procedure configuration must be set by a Mobile Device Management (MDM) service and be sufficiently complex to protect sensitive data.
Checks: C-49997r2_chk

From either the Work Space or Personal Space, navigate to "Settings >> BlackBerry Balance" and ensure "Work Password" is set to "On" and grayed out. Otherwise, this is a finding.

Fix: F-50875r1_fix

On BlackBerry Device Service, set "Password Required for Work Space" IT Policy rule to "Yes".

b
BlackBerry 10 OS must retain the device lock until the user reestablishes access using established identification and authentication procedures.
AC-11 - Medium - CCI-000056 - V-47173 - SV-60045r2_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000056
Version
BB10-2X-000120
Vuln IDs
  • V-47173
Rule IDs
  • SV-60045r2_rule
The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identification and authentication procedures. A device lock is a temporary action taken when a user stops work but does not want to log out because of the temporary nature of the hiatus. During the device lock a publicly viewable pattern is visible on the associated display, hiding what was previously visible on the screen. Once invoked, the device lock shall remain in place until the user re-authenticates. No other system activity aside from re-authentication can unlock the system. The operating system must enforce a device lock function. This prevents others from gaining access to the device when not in the user's possession and accessing sensitive DoD information. The identification and authentication procedure configuration must be set by a Mobile Device Management (MDM) service and be sufficiently complex to protect sensitive data.
Checks: C-49999r3_chk

This requirement must meet one of the options below: Option 1: From either the Work Space or Personal Space, navigate to "Settings >> Security and Privacy >> Device Password" and ensure "Device Password" is set to "On". Otherwise, this is a finding. Option 2: From either the Work Space or Personal Space, navigate to "Settings >> BlackBerry Balance" and ensure "Use as my device password" is set to "On" and greyed out. Otherwise, this is a finding.

Fix: F-50877r3_fix

Select one option to fix this requirement: Option 1: From either the Work Space or Personal Space, navigate to "Settings >> Security and Privacy >> Device Password" and set "Enable Device Password" to "On". Create a 4-digit password for device lock. Option 2: On BlackBerry Device Service, set "Apply Work Space Password to Full Device" rule to "Yes". Note: This fix procedure affects the Personal Space.

b
BlackBerry 10 OS must lock the Work Space after no more than 15 minutes of inactivity.
AC-11 - Medium - CCI-000057 - V-47175 - SV-60047r3_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000057
Version
BB10-2X-000130
Vuln IDs
  • V-47175
Rule IDs
  • SV-60047r3_rule
The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identification and authentication procedures. A device lock is a temporary action taken when a user stops work but does not want to shut down because of the temporary nature of the hiatus. During the device lock a publicly viewable pattern is visible on the associated display, hiding what was previously visible on the screen. Once invoked, the device lock shall remain in place until the user re-authenticates. No other system activity aside from re-authentication can unlock the system. The operating system must lock the device after the organization defined time period. This prevents others from gaining access to the device when not in the user's possession and accessing sensitive DoD information. A device lock mitigates the risk that an adversary can access data on an unattended mobile device but only after the maximum of 15 minute period of inactivity.
Checks: C-50001r2_chk

From either the Work Space or Personal Space, navigate to "Settings >> BlackBerry Balance". Verify "Lock Work Space After" is set to "15 Minutes", with higher values hidden. Otherwise, this is a finding.

Fix: F-50879r2_fix

On BlackBerry Device Service, set the IT Policy rule "Lock Device After" to "15 minutes".

b
BlackBerry 10 OS must prevent applications from extending the Work Space password lock time.
AC-11 - Medium - CCI-000057 - V-47177 - SV-60049r3_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000057
Version
BB10-2X-000140
Vuln IDs
  • V-47177
Rule IDs
  • SV-60049r3_rule
The Work Space lock function prevents further access to the Work Space by initiating a session lock after a period of inactivity on the device or upon receiving a request from a user. The lock is retained until the user reestablishes access using established identification and authentication procedures. When using a personal app designed to extend the timeout in configurations with both personal and work areas, the device will not lock but the Work Space will lock after 15 minutes. Locking the Work Space after 15 minutes ensures that an adversary acquiring a DoD device may have access to the personal space but only a limited window to gain information from the Work Space. A device lock is a temporary action taken when a user stops work but does not want to shut down because of the temporary nature of the hiatus. During the device lock a publicly viewable pattern is visible on the associated display, hiding what was previously visible on the screen. Once invoked, the device lock shall remain in place until the user re-authenticates. No other system activity aside from re-authentication can unlock the system. The operating system must lock the device after the organization defined time period. This prevents others from gaining access to the device when not in the user's possession and accessing sensitive DoD information. A device lock mitigates the risk that an adversary can access data on an unattended mobile device but only after the maximum of 15 minute period of inactivity.
Checks: C-50003r2_chk

On BlackBerry Device Service, verify the IT Policy rule "Application Security Timer Reset" is set to "Disallow". Otherwise, this is a finding.

Fix: F-50881r2_fix

On BlackBerry Device Service, set the IT Policy rule "Application Security Timer Reset" to "Disallow".

a
BlackBerry 10 OS must synchronize the internal clock on an organizationally-defined periodic basis with an authoritative time server or the Global Positioning System.
AU-8 - Low - CCI-000160 - V-47179 - SV-60051r2_rule
RMF Control
AU-8
Severity
L
CCI
CCI-000160
Version
BB10-2X-000150
Vuln IDs
  • V-47179
Rule IDs
  • SV-60051r2_rule
Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events. Periodically synchronizing internal clocks with an authoritative time source is needed in order to correctly correlate the timing of events that occur across the enterprise. The two authoritative time sources for mobile operating systems are an authoritative time server which is synchronized with redundant United States Naval Observatory (USNO) time servers as designated for the appropriate DoD network (NIPRNet or SIPRNet) or the Global Positioning System (GPS). Timestamps generated by the audit system in mobile operating systems shall include both date and time. The time may be expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.
Checks: C-50005r2_chk

From either the Work Space or Personal Space, navigate to "Settings >> Date and Time" and verify "Set Date and Time Automatically" is set to "On". Otherwise, this is a finding.

Fix: F-50883r2_fix

From either the Work Space or Personal Space, navigate to "Settings >> Date and Time" and set "Set Date and Time Automatically" to "On". NOTE: This fix procedure affects both Personal and Work Spaces.

b
BlackBerry 10 OS must enforce a minimum length for the Work Space unlock password.
IA-5 - Medium - CCI-000205 - V-47181 - SV-60053r3_rule
RMF Control
IA-5
Severity
M
CCI
CCI-000205
Version
BB10-2X-000210
Vuln IDs
  • V-47181
Rule IDs
  • SV-60053r3_rule
Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute force attacks. The ability to crack a password is a function of how many times an attempt to crack the password, how quickly the adversary can do each attempt, and the size of the password space. The longer the minimum length of the password is, the larger the password space.
Checks: C-50007r2_chk

From either the Work Space or Personal Space, navigate to "Settings >> BlackBerry Balance" and select "Change Password". Authenticate using the current password. Select "Password Rules" and verify "Your password must be at least 6 characters." Otherwise, this is a finding.

Fix: F-50885r2_fix

On BlackBerry Device Service, set the IT Policy rule "Minimum Password Length" to 6.

b
BlackBerry 10 OS must prevent a user from installing unapproved applications.
SA-7 - Medium - CCI-000663 - V-47183 - SV-60055r5_rule
RMF Control
SA-7
Severity
M
CCI
CCI-000663
Version
BB10-2X-000220
Vuln IDs
  • V-47183
Rule IDs
  • SV-60055r5_rule
The operating system must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what types of installations are prohibited (e.g., software whose pedigree with regard to being potentially malicious is unknown or suspect) by the organization. The installation and execution of unauthorized software on an operating system may allow the application to obtain sensitive information or further compromise the system. Preventing a user from installing unapproved applications mitigates this risk. When the Development Mode is enabled on BlackBerry 10 OS devices, the user has the capability to sideload apps to either the Work Space or Personal Space. Disabling this feature removes the capability for a user to sideload apps.
Checks: C-50009r2_chk

From either the Work Space or Personal Space, navigate to "Settings >> Security and Privacy >> Development Mode" and verify "Use Development Mode" is set to "OFF" and grayed out. Otherwise, this is a finding.

Fix: F-50887r3_fix

On BlackBerry Device Service, set the IT Policy rule "Restrict Development Mode" to "Yes".

c
BlackBerry 10 OS must prevent a user from installing unapproved applications in the Work Space.
SA-7 - High - CCI-000663 - V-47185 - SV-60057r3_rule
RMF Control
SA-7
Severity
H
CCI
CCI-000663
Version
BB10-2X-000224
Vuln IDs
  • V-47185
Rule IDs
  • SV-60057r3_rule
The operating system must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what types of installations are prohibited (e.g., software whose pedigree with regard to being potentially malicious is unknown or suspect) by the organization. The installation and execution of unauthorized software on an operating system may allow the application to obtain sensitive information or further compromise the system. Preventing a user from installing unapproved applications mitigates this risk. When the Development Mode is enabled for the Work Space on BlackBerry 10 OS devices, the user has the capability to sideload apps to the Work Space. Disabling this feature removes the capability for a user to sideload apps.
Checks: C-50011r4_chk

If requirement BB10-2X-000220 is met, this requirement is not applicable. On BlackBerry Device Service, verify the IT Policy rule "Development Mode Access to Work Space" is set to "Disallow". Otherwise, this is a finding.

Fix: F-50889r2_fix

On BlackBerry Device Service, set the IT Policy rule "Development Mode Access to Work Space" to "Disallow".

b
BlackBerry 10 OS must prevent a user from installing unapproved applications from other sources.
SA-7 - Medium - CCI-000663 - V-47187 - SV-60059r4_rule
RMF Control
SA-7
Severity
M
CCI
CCI-000663
Version
BB10-2X-000228
Vuln IDs
  • V-47187
Rule IDs
  • SV-60059r4_rule
The operating system must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what types of installations are prohibited (e.g., software whose pedigree with regard to being potentially malicious is unknown or suspect) by the organization. The installation and execution of unauthorized software on an operating system may allow the application to obtain sensitive information or further compromise the system. Preventing a user from installing unapproved applications mitigates this risk.
Checks: C-50013r3_chk

On BlackBerry Device Service, verify the IT Policy rule "Install Apps From Other Sources" is set to "Disallow". Otherwise, this is a finding.

Fix: F-50891r3_fix

On BlackBerry Device Service, set the IT Policy rule "Install Apps From Other Sources" to "Disallow".

b
BlackBerry 10 OS must only permit downloading of software from a DoD-approved source (e.g., DoD-operated mobile device application store or MDM server).
SA-7 - Medium - CCI-000663 - V-47189 - SV-60061r3_rule
RMF Control
SA-7
Severity
M
CCI
CCI-000663
Version
BB10-2X-000230
Vuln IDs
  • V-47189
Rule IDs
  • SV-60061r3_rule
DoD can perform due diligence on sources of software to mitigate the risk that malicious software is introduced to those sources. Therefore, if software is downloaded from a DoD-approved source, then it is less likely to be malicious than if it is downloaded from an unapproved source. To prevent access to unapproved sources, the operating system, in most cases, can be configured to disable user access to public application stores. However, in some cases, DoD may approve downloads directly from the OS vendor.
Checks: C-50015r1_chk

From the Work Space, open "BlackBerry World - Work" and select "Public". If any apps are listed under "Public", this is a finding.

Fix: F-50893r2_fix

On BlackBerry Device Service, on the BlackBerry solution management menu, expand "Software >> Applications", click "Manage applications", and delete all applications under "BlackBerry World Applications".

b
BlackBerry 10 OSs Wi-Fi module must use EAP-TLS authentication when authenticating to DoD WLAN authentication servers.
IA-3 - Medium - CCI-000780 - V-47191 - SV-60063r2_rule
RMF Control
IA-3
Severity
M
CCI
CCI-000780
Version
BB10-2X-000240
Vuln IDs
  • V-47191
Rule IDs
  • SV-60063r2_rule
Without strong mutual authentication a mobile device may connect to an unauthorized network. In many cases, the user may falsely believe that the device is connected to an authorized network and then provide authentication credentials and other sensitive information. EAP-TLS is strong mutual authentication leveraging a public key infrastructure. Its use greatly mitigates risk associated with authentication transactions.
Checks: C-50017r2_chk

From either the Work Space or Personal Space, navigate to "Settings >> Network Connections >> Wi-Fi >> Saved" and select a saved DoD Wi-Fi profile to check. Verify "Security Type" is set to "WPA Enterprise" or "WPA2 Enterprise" and "Security Sub Type" is set to "EAP-TLS". These options should be grayed out. Otherwise, this is a finding. NOTE: Wi-Fi profiles, other than those connecting to DoD Wi-Fi networks, are not a finding. If no DoD Wi-Fi networks are saved, this requirement is NA.

Fix: F-50895r2_fix

On BlackBerry Device Service, select the affected Wi-Fi Profile(s), and set "EAP Security Setting" to "TLS".

b
BlackBerry 10 OS VPN client must employ DoD PKI-approved mechanisms for authentication when connecting to DoD networks.
IA-3 - Medium - CCI-000780 - V-47193 - SV-60065r3_rule
RMF Control
IA-3
Severity
M
CCI
CCI-000780
Version
BB10-2X-000250
Vuln IDs
  • V-47193
Rule IDs
  • SV-60065r3_rule
VPNs are vulnerable to attack if they are not supported by strong authentication. An adversary may be able to gain access to network resources and sensitive information if they can compromise the authentication process. Common Access Card (CAC) authentication is a strong cryptographic two-factor authentication that greatly mitigates the risk of VPN authentication breaches. Other DoD-approved PKI mechanisms provide similar levels of assurance. Reference the DoD CIO memorandum regarding interim guidance on the use of derived PKI credentials (2015-05-06 DoD Interim Guidance for Implementing Derived PKI Credentials on Unclass CMDs) for BlackBerry certificate configuration information.
Checks: C-50019r4_chk

From either the Work Space or Personal Space, navigate to "Settings >> Network Connections >> VPN ". Select and hold a VPN profile to check, and select "Edit Profile" to edit the VPN Profile. For each VPN Profile connecting to DoD networks: - Select the VPN Profile to edit. - Verify "Authentication Type" is set to "PKI" or "XAUTH-PKI" and grayed out. Otherwise, this is a finding. NOTE: If the VPN Profile listed under "Settings >> Network Connections >> VPN" has a brief case logo on the right side, it was created on BlackBerry Device Service published to the device. "Authentication Type" for this VPN Profile will be grayed out and enforced. If no VPN profiles are saved, this requirement is NA.

Fix: F-50897r3_fix

On BlackBerry Device Service, select the applicable VPN Profile and set "Authentication Type" to "PKI" or "XAUTH-PKI".

b
BlackBerry 10 OS must have access to DoD root and intermediate PKI certificates when performing DoD PKI-related transactions.
CM-6 - Medium - CCI-000366 - V-47197 - SV-60069r4_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
BB10-2X-000280
Vuln IDs
  • V-47197
Rule IDs
  • SV-60069r4_rule
DoD root and intermediate PKI certificates are used to verify the authenticity of PKI certificates of users and web services. If the root and intermediate certificates are not available, an adversary could falsely sign a certificate in such a way that it could not be detected. Providing access to the DoD root and intermediate PKI certificates greatly diminishes the risk of this attack.
Checks: C-50023r3_chk

From the Work Space, navigate to "Settings >> Security and Privacy >> Certificates", and inspect "Enterprise Root Certificates" and "Enterprise Intermediate Certificates" stores. If DoD root and intermediate PKI certificates are not in the stores, this is a finding.

Fix: F-50901r3_fix

On BlackBerry Device Service, ensure the required ".pem" files are present in this folder: <drive>:\<shared_network_folder>\Shared\Certificates\<ENTERPRISE/VPN/WIFI/www>

b
BlackBerry 10 OS must block both the inbound and outbound traffic between instant messaging clients that are independently configured by end users and external service providers or other unapproved DoD systems.
SC-15 - Medium - CCI-001154 - V-47199 - SV-60071r4_rule
RMF Control
SC-15
Severity
M
CCI
CCI-001154
Version
BB10-2X-000290
Vuln IDs
  • V-47199
Rule IDs
  • SV-60071r4_rule
Many instant messaging systems have known vulnerabilities, some of which allow an adversary to install malware on the device. This malware can then be used to obtain sensitive information or further compromise DoD information systems. Restricting IM traffic to DoD-authorized IM systems mitigates the risk of using IM technology.
Checks: C-50025r3_chk

On BlackBerry Device Service, in the BlackBerry Administration Service, on the BlackBerry solution management menu, expand "Software &gt;&gt; Applications &gt;&gt; Manage applications". If there are any unauthorized instant messaging systems listed, this is a finding.

Fix: F-50903r2_fix

On BlackBerry Device Service: In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand "Software >> Applications >> Manage applications". Delete the unauthorized IM system application.

c
BlackBerry 10 OS must grant a downloaded application only the permissions the AO has authorized for that application.
CM-6 - High - CCI-000366 - V-47201 - SV-60073r3_rule
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
BB10-2X-000300
Vuln IDs
  • V-47201
Rule IDs
  • SV-60073r3_rule
Mobile operating system applications that are able to perform unintended functions may be able to obtain sensitive information or otherwise compromise system security. The permissions that an application requires to perform its function may be delineated in a permissions manifest or in entitlements that are either bound to the application or embedded in its code. Enforcing these permissions limitations is necessary to ensure the application is not permitted to perform unintended functions.
Checks: C-50027r3_chk

From the Work Space, navigate to "Settings &gt;&gt; Security and Privacy &gt;&gt; Application Permissions" and select "All" in the "Permissions" dropdown box. For each application, ensure the requested permissions (e.g., Location, Contacts, Shared Files, etc.) are set to "On" only for AO authorized permissions. Otherwise, this is a finding. NOTE: If no applications are installed, this requirement is NA.

Fix: F-50905r5_fix

From the Work Space, navigate to "Settings >> Security and Privacy >> Application Permissions" and select "All" in "Permissions" dropdown box. For each application, set requested permission (e.g. Location, Contacts, Shared Files, etc.) to "On" or "Off" as identified by the AO.

c
The BlackBerry 10 OS Work Space must only install and use DoD PKI-issued or DoD-approved software authentication certificates.
SC-17 - High - CCI-001159 - V-47203 - SV-60075r3_rule
RMF Control
SC-17
Severity
H
CCI
CCI-001159
Version
BB10-2X-000310
Vuln IDs
  • V-47203
Rule IDs
  • SV-60075r3_rule
If unauthorized software authentication certificates are installed on the device, then the operating system would not block malware signed by the entity that published these certificates. Such malware could be used to obtain sensitive DoD information or to further breach system security. Eliminating unapproved software authentication certificates greatly mitigates the risk of malware passing authentication controls.
Checks: C-50029r3_chk

From the Work Space, navigate to "Settings &gt;&gt; Security and Privacy &gt;&gt; Certificates", and throughout different enterprise certificate stores ("Enterprise Root Certificates", "Enterprise Intermediate Certificates", and "Enterprise Client Certificates"). Verify the certificates listed originated from the BDS server. If the certificates do not originate from a DoD BDS server, this is a finding. NOTE: Certificates in stores other than enterprise certificate stores do not apply.

Fix: F-50907r2_fix

On BlackBerry Device Service, remove the corresponding .pem file from this folder: <drive>:\<shared_network_folder>\Shared\Certificates\<ENTERPRISE/VPN/WIFI/www>

b
The BlackBerry 10 OS Work Space must only install and use DoD PKI-issued or DoD-approved server authentication certificates.
SC-17 - Medium - CCI-001159 - V-47205 - SV-60077r3_rule
RMF Control
SC-17
Severity
M
CCI
CCI-001159
Version
BB10-2X-000320
Vuln IDs
  • V-47205
Rule IDs
  • SV-60077r3_rule
If unauthorized device authentication certificates are installed on the device, there is the potential that the device may connect to a rogue device or network. Rogue devices can mimic the behavior of authorized equipment to trick the user into providing authentication credentials, which could then in turn be used to compromise DoD information and networks. Restricting device authentication certificates to an authorized list mitigates the risk of attaching to rogue devices and networks.
Checks: C-50031r3_chk

From the Work Space, navigate to "Settings &gt;&gt; Security and Privacy &gt;&gt; Certificates", and throughout different enterprise certificate stores ("Enterprise Root Certificates", "Enterprise Intermediate Certificates", and "Enterprise Client Certificates"). Verify the certificates listed originated from the BDS server. If the certificates do not originate from a DoD BDS server, this is a finding. NOTE: Certificates in stores other than enterprise certificate stores do not apply.

Fix: F-50909r2_fix

On BlackBerry Device Service, remove the corresponding .pem file from this folder: <drive>:\<shared_network_folder>\Shared\Certificates\<ENTERPRISE/VPN/WIFI/www>

b
BlackBerry 10 OS must be updated to the latest approved version of the operating system.
SI-2 - Medium - CCI-001237 - V-47207 - SV-60079r2_rule
RMF Control
SI-2
Severity
M
CCI
CCI-001237
Version
BB10-2X-000325
Vuln IDs
  • V-47207
Rule IDs
  • SV-60079r2_rule
Operating system updates contain new security related features and security patches that address known vulnerabilities. Running the latest DoD-approved software version improves the security posture of the mobile device.
Checks: C-50033r3_chk

From either the Work Space or Personal Space, navigate to "Settings &gt;&gt; About" and verify "Software Release" indicates version 10.2.1.1925, or higher. Otherwise, this is a finding.

Fix: F-50911r3_fix

From either the Work Space or Personal Space, navigate to "Settings >> Software Updates" and select "Check for Updates". NOTE: This fix procedure affects both Personal and Work Spaces.

b
BlackBerry 10 OS maximum number of consecutive unsuccessful unlock attempts must be less than 10.
CM-6 - Medium - CCI-000366 - V-47215 - SV-60087r2_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
BB10-2X-000350
Vuln IDs
  • V-47215
Rule IDs
  • SV-60087r2_rule
The recommended setting for the maximum number of consecutive unsuccessful unlock attempts is 10. In some environments, a lower number may be needed to provide greater protection of sensitive information. Allowing for configuration enables the local command to enforce greater protection when it is deemed necessary. If the limit is not configurable, then it is permissible for a site to procure and deploy devices that enforce the limit specified by the organization, so long as that limit does not exceed 10.
Checks: C-50041r3_chk

From either the Work Space or Personal Space, navigate to "Settings &gt;&gt; BlackBerry Balance”. Under "Work Password", ensure the maximum value in the "Password attempt limit" drop down box is less than 10, otherwise, this is a finding.

Fix: F-50919r2_fix

On BlackBerry Device Service, set the IT Policy rule "Maximum Password Attempts" to be less than 10.

b
BlackBerry 10 OS must employ mobile device management services to centrally manage IT Policies.
CM-6 - Medium - CCI-000370 - V-47217 - SV-60089r2_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000370
Version
BB10-2X-000360
Vuln IDs
  • V-47217
Rule IDs
  • SV-60089r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of mobile device management (MDM) allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-50043r2_chk

From either the Work Space or Personal Space, navigate to "Settings &gt;&gt; About &gt;&gt; Work Space". Under "IT Policy", verify "Policy Name" value is identical to the name of the IT Policy assigned from BDS. Otherwise, this is a finding.

Fix: F-50921r3_fix

On BlackBerry Device Service, navigate to "BlackBerry solution management >> User >> Manage users >> <affected user's device PIN>". Select "Resend IT Policy to a device".

b
BlackBerry 10 OS must employ mobile device management services to centrally manage email settings.
CM-6 - Medium - CCI-000370 - V-47219 - SV-60091r2_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000370
Version
BB10-2X-000370
Vuln IDs
  • V-47219
Rule IDs
  • SV-60091r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of mobile device management (MDM) allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-50045r3_chk

From the Work Space, navigate to "Settings &gt;&gt; Accounts". Verify all required work email accounts (with a briefcase icon) are present. Otherwise, this is a finding.

Fix: F-50923r3_fix

On BlackBerry Device Service, navigate to "BlackBerry solution management >> Profiles >> Manage email profiles". Verify all required profiles are listed. If not, create necessary profiles by navigating to "BlackBerry solution management >> Profiles >> Create email profiles". Assign all required email profiles to affected user, or a group the user is a part of.

b
BlackBerry 10 OS must employ mobile device management services to centrally manage Wi-Fi profiles.
CM-6 - Medium - CCI-000370 - V-47221 - SV-60093r2_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000370
Version
BB10-2X-000380
Vuln IDs
  • V-47221
Rule IDs
  • SV-60093r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of mobile device management (MDM) allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-50047r2_chk

From either the Work Space or Personal Space, navigate to "Settings &gt;&gt; Network Connections &gt;&gt; Wi-Fi &gt;&gt; Saved". Verify all required work Wi-Fi profiles (with a briefcase icon) are present. Otherwise, this is a finding. NOTE: Additional profiles without the briefcase icon are permitted and are not a finding.

Fix: F-50925r3_fix

On BlackBerry Device Service, navigate to "BlackBerry solution management >> Profiles >> Manage Wi-Fi Profiles". Verify all required profiles are listed. If not, create necessary profiles by navigating to "BlackBerry solution management >> Profiles >> Create Wi-Fi Profiles". Assign all required Wi-Fi profiles to affected user, or a group the user is a part of.

b
BlackBerry 10 OS must employ mobile device management services to centrally manage VPN profiles.
CM-6 - Medium - CCI-000370 - V-47223 - SV-60095r2_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000370
Version
BB10-2X-000390
Vuln IDs
  • V-47223
Rule IDs
  • SV-60095r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of mobile device management (MDM) allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-50049r1_chk

From either the Work Space or Personal Space, navigate to "Settings -&gt; Network Connections -&gt; VPN". Verify all required work VPN profiles (with a briefcase icon) are present. Otherwise, this is a finding.

Fix: F-50927r2_fix

On BlackBerry Device Service, navigate to "BlackBerry solution management -> Profiles -> Manage VPN Profiles". Ensure all required profiles are listed. If not, create necessary profiles by navigating to "BlackBerry solution management -> Profiles -> Create VPN Profiles". Assign all required VPN profiles to affected user, or a group the user is a part of.

a
BlackBerry 10 OS must enable a system administrator to (i) select which data fields will be available to applications outside of the contact database application and (ii) limit the number of contact database fields accessible outside of a work persona in the case of dual persona phones.
CM-6 - Low - CCI-000366 - V-47229 - SV-60101r2_rule
RMF Control
CM-6
Severity
L
CCI
CCI-000366
Version
BB10-2X-000430
Vuln IDs
  • V-47229
Rule IDs
  • SV-60101r2_rule
The contact database often contains a significant amount of information beyond each person's name and phone number. The records may contain addresses and other identifying or sensitive information that should not be revealed. There may be cases in which an organization has determined it is an acceptable risk to distribute parts of a person's contact record but not others. Enabling the system administrator to select which fields are available outside the contact database application (or to applications outside the work persona in the case of a dual persona device) assists with management of the risk.
Checks: C-50055r2_chk

On BlackBerry Device Service: Ensure the IT Policy rule "Personal Apps Access to Work Contacts" is set to "Only BlackBerry Apps". Otherwise, this is a finding.

Fix: F-50933r2_fix

On BlackBerry Device Service, set the IT Policy rule "Personal Apps Access to Work Contacts" to "Only BlackBerry Apps". NOTE: This fix procedure affects both Personal and Work Spaces.

b
BlackBerry 10 OS device lock, when activated on a device, must place a publicly viewable pattern onto the associated display, hiding what was previously visible on the screen.
AC-11 - Medium - CCI-000060 - V-47231 - SV-60103r1_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000060
Version
BB10-2X-002140
Vuln IDs
  • V-47231
Rule IDs
  • SV-60103r1_rule
The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identification and authentication procedures. A device lock is a temporary action taken when a user stops work but does not want to log out because of the temporary nature of the hiatus. During the device lock a publicly viewable pattern is visible on the associated display, hiding what was previously visible on the screen. Once invoked, the device lock shall remain in place until the user re-authenticates. No other system activity aside from re-authentication can unlock the system. The operating system must lock the device with a publicly viewable pattern visible on the associated display, hiding what was previously visible on the screen. This prevents others from gaining access to the device when not in the user's possession and accessing sensitive DoD information. Publicly viewable patterns can include screen saver patterns, photographic images, solid colors, or a blank screen, so long as none of those patterns convey sensitive information. Non-sensitive device information, such as battery life, signal strength, and time/date, may be viewable as part of a publically viewable pattern. However, system notifications, user or contact information must not be viewable because they may reveal owner or organizational information.
Checks: C-50057r1_chk

While holding the Power button from either the Work Space or Personal Space, select "Lock" to lock the device. Ensure the Work Space content is not visible on the lock screen. Otherwise, this is a finding.

Fix: F-50935r1_fix

On BlackBerry Device Service, set "Lock Screen Preview of Work Content" to "Disallow".

a
BlackBerry 10 OS, for PKI-based authentication must validate certificates by querying the certification authority for revocation status of the certificate.
IA-5 - Low - CCI-000185 - V-47233 - SV-60105r2_rule
RMF Control
IA-5
Severity
L
CCI
CCI-000185
Version
BB10-2X-002160
Vuln IDs
  • V-47233
Rule IDs
  • SV-60105r2_rule
Status information for certification paths includes certificate revocation lists or online certificate status protocol responses. Failure to verify a certificate's revocation status can result in the system accepting a revoked or otherwise unauthorized certificate resulting in installation of unauthorized software or connection to rogue networks. Querying for certificate revocation mitigates the risk that the system will accept an unauthorized certificate.
Checks: C-50059r2_chk

On BlackBerry Device Service, navigate to "Devices &gt;&gt; Device settings &gt;&gt; Certificate retrieval settings &gt;&gt; Edit Settings &gt;&gt; OCSP" and verify "Service URL" field is populated with the correct value. Otherwise, this is a finding.

Fix: F-50937r2_fix

On BlackBerry Device Service, navigate to "Devices >> Device settings >> Certificate retrieval settings >> Edit Settings >> OCSP" and set "Service URL" field to appropriate URL of the OCSP server.

b
BlackBerry 10 OSs VPN client must use either IPsec or SSL/TLS when connecting to DoD networks.
SC-9 - Medium - CCI-001130 - V-48597 - SV-61473r2_rule
RMF Control
SC-9
Severity
M
CCI
CCI-001130
Version
BB10-2X-000270
Vuln IDs
  • V-48597
Rule IDs
  • SV-61473r2_rule
Use of non-standard communications protocols can affect both the availability and confidentiality of communications. IPsec and SSL/TLS are both well-known and tested protocols that provide strong assurance with respect to both IA and interoperability.
Checks: C-50923r2_chk

From either the Work Space or Personal Space, navigate to "Settings &gt;&gt; Network Connections &gt;&gt; VPN". Select "Edit" to edit a VPN Profile. For each VPN Profile connecting to DoD networks: - Select the VPN Profile to edit. - Ensure "Gateway Type" is set to a type which supports and utilizes IPsec and SSL/TLS. Otherwise, this is a finding. NOTE: If no VPN profiles are saved, this requirement is NA.

Fix: F-52203r1_fix

On BlackBerry Device Service, select the affected VPN Profile for edit, and set "Gateway Type" to a type which supports and utilizes IPsec and SSL/TLS.