Cyber Trackr - Free Compliance Library
Cyber Trackr
The Free Compliance Library

BlackBerry Enterprise Service v10.1.x BlackBerry Device Service STIG

  • Version/Release: V1R3
  • Published: 2014-10-06
  • Released: 2014-10-24
  • Expand All:
  • Severity:
  • Sort:
Compare

Select any two versions of this STIG to compare the individual requirements

View

Select any old version/release of this STIG to view the previous requirements

Developed by Research In Motion Ltd. in coordination with DISA for use in the DoD.
a
The BlackBerry Device Service server must enforce the minimum password length for the Personal Space password to 4 digits via centrally managed policy.
CM-6 - Low - CCI-000370 - V-38932 - SV-50737r2_rule
RMF Control
CM-6
Severity
Low
CCI
CCI-000370
Version
BBDS-00-003120
Vuln IDs
  • V-38932
Rule IDs
  • SV-50737r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46487r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether a device unlock password with a minimum length of 4 characters has been enabled. If there are multiple policies, they must all be reviewed. This requirement can be met via one of two methods: Method #1: Train users to set the following device unlock/personal area password feature on a PlayBook 2.0 or BlackBerry 10 device: Navigate to "Options/Settings -> Security ->Password" and set "Enable Password" to "ON". Create a 4-digit passcode for the device lock. **************************************************************************************** Method #2: The BDS IT policy rule "Apply Work Space Password to Full Device" can be applied to force the Work Space password to be used for both Work and Personal Spaces. IT policy rules can be specified per group or per user. To add an IT policy to a group: 1. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side, expand "Group". 2. Click "Manage groups". 3. Click the name of the group. 4. Click "Edit group". 5. Click the "Policies" tab. 6. In the "IT policy list", select the IT policy. 7. Click "Save all". To add an IT policy to a user account: 1. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side, expand "User". 2. Click "Manage users". 3. Search for a user account. 4. In the search results, select the check box for the user account. 5. In the "Add to user configuration" list, click "Set IT policy". 6. In the "IT policy" drop-down list, select the IT policy. 7. Click "Save". For more details and information, see the "Setting up device controls" section of the BlackBerry Enterprise Service 10 BlackBerry Device Service, Version: 10.1.1 Administration Guide.

Fix: F-44020r2_fix

Configure the BlackBerry Device Service server to enable a device unlock password with a minimum length of 4 characters. Method #1: Train users to set a 4-digit device unlock/personal area password feature on a PlayBook 2.0 or BlackBerry 10 device. **************************************************************************************** Method #2: Configure the centrally managed BlackBerry Device Service server policy rule to apply the Work Space password to the entire device.

c
The BlackBerry Device Service server must disallow mobile device applications the ability to reset the Work Space lock timer via centrally managed policy.
CM-6 - High - CCI-000370 - V-38935 - SV-50740r2_rule
RMF Control
CM-6
Severity
High
CCI
CCI-000370
Version
BBDS-00-003131
Vuln IDs
  • V-38935
Rule IDs
  • SV-50740r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46421r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether the mobile device applications' ability to reset the device lock timer has been disabled. If there are multiple policies, they must all be reviewed. The "Application Security Timer Reset" rule on the BlackBerry Device Service server specifies whether apps can reset the security timer on a BlackBerry device to prevent the device from locking after either 1) the period of user inactivity that is specified in the Security Timeout rule elapses, or 2) the period of inactivity that the user specifies in the Password Lock settings on the device elapses. If this rule is set to disallow, the device will lock without user interaction when running apps that attempt to reset the security timer, such as apps that display navigation information, slideshows, and videos. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Security" and verify "Application Security Timer Reset" is set to "Disallow". Otherwise, this is a finding.

Fix: F-43891r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disallow mobile device applications the ability to reset the device lock timer.

c
The BlackBerry Device Service server must disable any mobile OS service that connects to a cloud storage server via centrally managed policy.
CM-6 - High - CCI-000370 - V-38937 - SV-50742r2_rule
RMF Control
CM-6
Severity
High
CCI
CCI-000370
Version
BBDS-00-003176
Vuln IDs
  • V-38937
Rule IDs
  • SV-50742r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46422r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether any mobile OS service that connects to a cloud storage server has been disabled. If there are multiple policies, they must all be reviewed. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Software" and verify "Cloud Storage Access from Work Space" is set to "Disallow". Otherwise, this is a finding. Note: The above is applicable for EMM-Corporate (BlackBerry Balance) devices only. Devices with EMM-Corporate (Work Space only) inherently meet this requirement.

Fix: F-43892r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disable any mobile OS service that connects to a cloud storage server.

c
The BlackBerry Device Service server must direct all Work Space application traffic through the BlackBerry Device Service server via centrally managed policy.
CM-6 - High - CCI-000370 - V-38939 - SV-50744r2_rule
RMF Control
CM-6
Severity
High
CCI
CCI-000370
Version
BBDS-00-003177
Vuln IDs
  • V-38939
Rule IDs
  • SV-50744r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46423r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether all Work Space application traffic is routed through the BlackBerry Device Service server. If there are multiple policies, they must all be reviewed. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Security" and verify "Network Access Control for Work Apps" is set to "Yes". Otherwise, this is a finding.

Fix: F-43896r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to direct all Work Space application traffic through the BlackBerry Device Service server.

b
The BlackBerry Device Service server must disallow Personal Space applications access to the Work Space network connection via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-38940 - SV-50745r2_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-003178
Vuln IDs
  • V-38940
Rule IDs
  • SV-50745r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46424r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether Personal Space applications' access to the Work Space network connection has been disallowed. If there are multiple policies, they must all be reviewed. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Security" and verify "Work Network Usage for Personal Apps" is set to "Disallow". Otherwise, this is a finding. NOTE: Check text is applicable for EMM-Corporate (BlackBerry Balance) devices only. This requirement is N/A for EMM-Regulated (Work Space only) devices.

Fix: F-43897r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disallow hyperlinks within Work Space applications from opening within the Personal Space browser application.

b
The BlackBerry Device Service server must have the administrative functionality disallow hyperlinks within Work Space applications from opening within the Personal Space browser application via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-38941 - SV-50746r2_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-003179
Vuln IDs
  • V-38941
Rule IDs
  • SV-50746r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46425r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether hyperlinks within Work Space applications can open within the Personal Space browser application. If there are multiple policies, they must all be reviewed. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Software" and verify "Open Links in Work Email Messages in the Personal Browser" is set to "Disallow". Otherwise, this is a finding.

Fix: F-43898r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disallow Personal Space applications access to the Work Space network connection.

a
The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Set the number of allowed repeated characters in the mobile device unlock password.
CM-6 - Low - CCI-000370 - V-38943 - SV-50748r1_rule
RMF Control
CM-6
Severity
Low
CCI
CCI-000370
Version
BBDS-00-003180
Vuln IDs
  • V-38943
Rule IDs
  • SV-50748r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46426r1_chk

Review the BlackBerry Device Service server configuration to determine whether there is administrative functionality to centrally manage the managed mobile device security policy rule to set the number of allowed repeated characters in the mobile device unlock password. If this function is not present, this is a finding. This requirement can be met via one of two methods: Method #1: Train users to set the following device unlock/personal area password feature on a PlayBook 2.0 or BlackBerry 10 device: Navigate to "Options -> Security ->Password" and set "Enable Password" is set to "ON". Create a 4 digit passcode for the device lock that does not contain any repeated characters. **************************************************************************************** Method #2: The BDS IT policy rule "Apply Work Space Password to Full Device" can be applied to force the work space password to be used for both work and personal personas. IT policy rules can be specified per group or per user. To add an IT policy to a group: 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Group. 2. Click Manage groups. 3. Click the name of the group. 4. Click Edit group. 5. Click the Policies tab. 6. In the IT policy list, select the IT policy. 7. Click Save all. To add an IT policy to a user account: 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand User. 2. Click Manage users. 3. Search for a user account. 4. In the search results, select the check box for the user account. 5. In the Add to user configuration list, click Set IT policy. 6. In the IT policy drop-down list, select the IT policy. 7. Click Save. For more details and information, please see the “Setting up device controls” section of the BlackBerry Enterprise Service 10 BlackBerry Device Service, Version: 6.2 Administration Guide.

Fix: F-43899r1_fix

Method #1: Train users to set a 4-digit device unlock/personal area password that does not contain any repeated characters on a PlayBook 2.0 or BlackBerry 10 device. **************************************************************************************** Method #2: Configure the centrally managed BlackBerry Device Service server security policy rule to apply the work space password to the entire device.

a
The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Disallow sequential numbers in the mobile device unlock password.
CM-6 - Low - CCI-000370 - V-38946 - SV-50751r1_rule
RMF Control
CM-6
Severity
Low
CCI
CCI-000370
Version
BBDS-00-003185
Vuln IDs
  • V-38946
Rule IDs
  • SV-50751r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46427r1_chk

Review the BlackBerry Device Service server configuration to determine whether there is administrative functionality to centrally manage the managed mobile device security policy rule to disallow sequential numbers in the mobile device unlock password. If this function is not present, this is a finding. This requirement can be met via one of two methods: Method #1: Train users to set the following device unlock/personal area password feature on a PlayBook 2.0 or BlackBerry 10 device: Navigate to "Options -> Security ->Password" and set "Enable Password" is set to "ON". Create a 4 digit passcode for the device lock that does not contain any sequential numbers. **************************************************************************************** Method #2: The BDS IT policy rule "Apply Work Space Password to Full Device" can be applied to force the work space password to be used for both work and personal personas. IT policy rules can be specified per group or per user. To add an IT policy to a group: 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Group. 2. Click Manage groups. 3. Click the name of the group. 4. Click Edit group. 5. Click the Policies tab. 6. In the IT policy list, select the IT policy. 7. Click Save all. To add an IT policy to a user account: 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand User. 2. Click Manage users. 3. Search for a user account. 4. In the search results, select the check box for the user account. 5. In the Add to user configuration list, click Set IT policy. 6. In the IT policy drop-down list, select the IT policy. 7. Click Save. For more details and information, please see the “Setting up device controls” section of the BlackBerry Enterprise Service 10 BlackBerry Device Service, Version: 6.2 Administration Guide.

Fix: F-43902r1_fix

Method #1: Train users to set a 4-digit device unlock/personal area password that does not contain any sequential numbers on a PlayBook 2.0 or BlackBerry 10 device. **************************************************************************************** Method #2: Configure the centrally managed BlackBerry Device Service server security policy rule to apply the work space password to the entire device.

c
The BlackBerry Device Service server must disable copying data from inside a non-secure data area on a mobile device into the security container via centrally managed policy.
CM-6 - High - CCI-000370 - V-38948 - SV-50753r2_rule
RMF Control
CM-6
Severity
High
CCI
CCI-000370
Version
BBDS-00-002541
Vuln IDs
  • V-38948
Rule IDs
  • SV-50753r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately. If this control is not available, sensitive DoD data stored inside the security container could be exposed if it is copied to a non-secure area on the device.
Checks: C-46429r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether copying data from inside a non-secure data area on a mobile device into the security container has been disabled. If there are multiple policies, they must all be reviewed. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Security" and verify "Work App Access to Shared Files in the Personal Space" is set to "Disallow". Otherwise, this is a finding. NOTE: Check text is applicable for EMM-Corporate (BlackBerry Balance) devices only. This requirement is N/A for EMM-Regulated (Work Space only) devices.

Fix: F-43905r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disable copying data from inside a non-secure data area on a mobile device into the security container.

a
The BlackBerry Device Service server must allow only Work Space contacts to be read from a native Personal Space application via centrally managed policy.
CM-6 - Low - CCI-000370 - V-38949 - SV-50754r2_rule
RMF Control
CM-6
Severity
Low
CCI
CCI-000370
Version
BBDS-00-002542
Vuln IDs
  • V-38949
Rule IDs
  • SV-50754r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately. If this control is not available, sensitive DoD data stored inside the security container could be exposed if it is copied to a non-secure area on the device.
Checks: C-46430r3_chk

Review the BlackBerry Device Service server policy configuration to determine whether only work persona contacts can be read from a native personal persona application. If there are multiple policies, they must all be reviewed. The "Personal Apps Access to Work Contacts" rule on the BlackBerry Device Service server specifies whether personal apps can access work contacts on a BlackBerry device. If this rule is set to Only RIM Apps, some apps developed by Research In Motion (BlackBerry Messenger, Text Messages, visual voice mail, and voice dialing) can access work contacts. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Security" and verify "Personal Apps Access to Work Contacts" is set to "Only RIM Apps". Otherwise, this is a finding. NOTE: Check text is applicable for EMM-Corporate (BlackBerry Balance) devices only. This requirement is N/A for EMM-Regulated (Work Space only) devices.

Fix: F-43906r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to allow only work persona contacts to be read from a native personal space application.

c
The BlackBerry Device Service server must implement separation of administrator duties by requiring a specific role be assigned to each administrator account.
AC-5 - High - CCI-000037 - V-38951 - SV-50756r2_rule
RMF Control
AC-5
Severity
High
CCI
CCI-000037
Version
BBDS-00-000100
Vuln IDs
  • V-38951
Rule IDs
  • SV-50756r2_rule
Separation of duties supports the management of individual accountability and reduces the power of one individual or administrative account. Employing a separation of duties model reduces the threat that one individual has the authority to make changes to a system, and the authority to delete any record of those changes. This requirement is intended to limit exposure due to operating from within a privileged account or role. The inclusion of a role is intended to address those situations where an access control policy, such as Role Based Access Control (RBAC), is being implemented and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account. It is recommended that the following or similar roles be supported: - MDM administrative account administrator: responsible for server installation, initial configuration, and maintenance functions. - Security configuration policy administrator (IA technical professional): responsible for security configuration of the server and setting up and maintenance of mobile device security policies. - Device management administrator (Technical operator): responsible for maintenance of mobile device accounts, including setup, change of account configurations, and account deletion. - Auditor (internal auditor or reviewer): responsible for reviewing and maintaining server and mobile device audit logs.
Checks: C-46432r2_chk

Review the BlackBerry Device Service server configuration to ensure there are accounts associated with the following roles: Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Administrator users > Manage users > <User Name> > Roles" and verify the roles required by the site are assigned. Otherwise, this is a finding. Note: The roles in BlackBerry Device services are as follows: Security Administrator - This role has permission to perform all tasks in the BlackBerry Device Service. Enterprise Administrator - This role has permission to perform all tasks in the BlackBerry Device Service except changing role assignments. This role can only view role assignments. Senior Helpdesk Administrator - This role has permission to perform advanced administrative tasks in the BlackBerry Device Service. Junior Helpdesk Administrator - This role has permission to perform basic administrative tasks in the BlackBerry Device Service. Server Only Administrator - This role has permissions to perform system management tasks in the BlackBerry Device Service. User Only Administrator - This role has permission to perform user management tasks in the BlackBerry Device Service.

Fix: F-43908r1_fix

Create and configure accounts to be aligned with the following roles: - MDM administrative account administrator: responsible for server installation, initial configuration, and maintenance functions. - Security configuration policy administrator (IA technical professional): responsible for security configuration of the server and setting up and maintenance of mobile device security policies. - Device management administrator (Technical operator): responsible for maintenance of mobile device accounts, including setup, change of account configurations, and account deletion. - Auditor (internal auditor or reviewer): responsible for reviewing and maintaining server and mobile device audit logs.

b
The BlackBerry Device Service server must deploy operating system and application updates via over-the-air (OTA) provisioning for managed mobile devices.
CM-5 - Medium - CCI-000345 - V-38952 - SV-50757r1_rule
RMF Control
CM-5
Severity
Medium
CCI
CCI-000345
Version
BBDS-00-000105
Vuln IDs
  • V-38952
Rule IDs
  • SV-50757r1_rule
Without the MDM ability to deploy operating systems and application updates over the air, it is possible for the mobile devices under the MDM's control to be susceptible to a zero day attack. The ability to apply updates OTA allows for rapid response to patching.
Checks: C-46433r1_chk

The BlackBerry Device Service server has the capability to deploy mobile operation system and application updates via an over-the-air (OTA) session. Specific versions of applications can be sent to the device, or applications can be updated. OS updates are made available to the user for download. The user is notified when new updates are available. Create a software configuration: 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Software. 2. Click Create a software configuration. 3. In the Configuration information section, in the Name field, type a name for the software configuration. 4. Click Save. Add an app to a software configuration: You must add an app to a software configuration to send the app to BlackBerry devices. If you want to upgrade an app, you must add the new version of the app to the appropriate software configuration. 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Software. 2. Click Manage software configurations. 3. Click the software configuration that you want to add an app to. 4. Click Edit software configuration. 5. On the Applications tab, click Add applications to software configuration. 6. Search for the app that you want to add to the software configuration. 7. In the search results, select an app that you want to add to the software configuration. 8. For apps in the applications repository, in the Disposition drop-down list for the app, perform one of the following actions: * To install the app automatically on devices, and to prevent users from removing the app, select Required. * To permit users to install and remove the app, and to add the app to the Work tab in the BlackBerry World storefront, select Optional. 9. Repeat steps 6 to 8 for each app that you want to add to the software configuration. 10. Click Add to software configuration. 11. Click Save all. See the "Managing app availability on devices" section of the BlackBerry Enterprise Service 10 BlackBerry Device Service Version: 6.2 Administration Guide for further details and other available options. If the BlackBerry Device Service server cannot be configured to send MOS and MAP updates OTA, this is a finding.

Fix: F-43909r1_fix

Configure the BlackBerry Device Service server to deploy MOS and MAP updates via an OTA session.

c
BlackBerry accounts must not be assigned to the default IT policy on the BlackBerry Device Service server or any other non-STIG compliant IT policy.
CM-6 - High - CCI-000370 - V-38954 - SV-50759r1_rule
RMF Control
CM-6
Severity
High
CCI
CCI-000370
Version
BBDS-00-000115
Vuln IDs
  • V-38954
Rule IDs
  • SV-50759r1_rule
The BlackBerry default policy on the BDS server does not include many DoD required security policies for data encryption, authentication, and access control. DoD enclaves are at risk of data exposure and hacker attack if users are assigned the default (or other non-STIG compliant) IT policy.
Checks: C-46435r2_chk

Detailed Policy Requirements: 1. Separate STIG compliant IT policies will be set up on the BDS server: one for users that have been issued an approved Bluetooth headset/hands free device and one for users that have not been issued an approved Bluetooth headset/hands free device. 2. All user accounts will be assigned to a STIG compliant IT policy. Check Procedures: Interview the BlackBerry system administrator. Ask the administrator to identify the default IT policy on the BDS (usually labeled "Default" and any other non-STIG compliant IT policies set up on the BDS. View the list of IT policies set up on the BDS as follows: BDS -> BlackBerry solution management -> Policy -> Manage IT Policies Verify no users are assigned the default IT Policy or any other non-STIG IT policy by performing the following steps for each policy. For the default IT policy and other non-STIG IT policies, look at each IT policy listed under "Manage IT policies" to be checked. - Click on the policy name. - Click on "View Users with reconciled IT Policy." - A list of all users assigned to the selected IT policy will be shown. - Determine if any user has been assigned to the default IT Policy or any other non-STIG IT policy. If yes, this is a finding.

Fix: F-43911r1_fix

User accounts will only be assigned a STIG compliant IT policy.

b
If the BlackBerry Device Service server includes a mobile email management capability, the email client S/MIME encryption algorithm must be 3DES or AES. When AES is used, AES-128 bit encryption key length is the minimum requirement; AES-256 is desired.
SC-13 - Medium - CCI-001144 - V-38959 - SV-50764r2_rule
RMF Control
SC-13
Severity
Medium
CCI
CCI-001144
Version
BBDS-00-000132
Vuln IDs
  • V-38959
Rule IDs
  • SV-50764r2_rule
Cryptography is only as strong as the encryption modules/algorithms that are employed to encrypt the data. Strong encryption must be used to protect the integrity and confidentiality of the data. In this case the requirement states that S/MIME must utilize a 3DES or AES encryption algorithm.
Checks: C-46439r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether the encryption algorithms used to encrypt S/MIME protected email messages are 3DES or AES-256. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Profiles > Manage email profiles > <Profile Name> > Email profile settings" and verify "Allowed content ciphers" is set to "AES (256-bit)", or "Triple DES". Otherwise, this is a finding.

Fix: F-43915r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to specify the encryption algorithms used to encrypt S/MIME protected email messages.

b
The BlackBerry Device Service server must disable Bluetooth Discoverable Mode via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-38964 - SV-50769r2_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000155
Vuln IDs
  • V-38964
Rule IDs
  • SV-50769r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46444r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether Bluetooth Discoverable Mode has been disabled. If there are multiple policies, they must all be reviewed. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Hardware" and verify "Bluetooth Discoverable Mode" is set to "Disallow". Otherwise, this is a finding. Note: Check text is applicable for devices with EMM-Regulated (Work Space only).

Fix: F-43920r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disable Bluetooth Discoverable Mode.

c
The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable the transfer of any file-based data via Bluetooth.
CM-6 - High - CCI-000370 - V-38965 - SV-50770r1_rule
RMF Control
CM-6
Severity
High
CCI
CCI-000370
Version
BBDS-00-000156
Vuln IDs
  • V-38965
Rule IDs
  • SV-50770r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46445r1_chk

Review the BlackBerry Device Service server configuration to determine whether there is administrative functionality to enable or disable the transfer of any file-based data via Bluetooth. If this function is not present, this is a finding. The "Transfer Work Contacts Using Bluetooth PBAP or HFP" rule on the BlackBerry Device Service server specifies whether a BlackBerry device can send work contacts to another Bluetooth enabled device using the Bluetooth PBAP or HFP. If this rule is set to disallow, users cannot transfer work contacts using Bluetooth PBAP or HFP. Setting this rule to disallow also prevents users from transferring work messages using the Bluetooth MAP. The "Transfer Work Files Using Bluetooth OPP" rule on the BlackBerry Device Service server specifies whether a BlackBerry device can send work files and objects such as contacts to another Bluetooth-enabled or NFC-enabled device using the Bluetooth OPP. IT policy rules can be specified per group or per user. To add an IT policy to a group: 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Group. 2. Click Manage groups. 3. Click the name of the group. 4. Click Edit group. 5. Click the Policies tab. 6. In the IT policy list, select the IT policy. 7. Click Save all. To add an IT policy to a user account: 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand User. 2. Click Manage users. 3. Search for a user account. 4. In the search results, select the check box for the user account. 5. In the Add to user configuration list, click Set IT policy. 6. In the IT policy drop-down list, select the IT policy. 7. Click Save. For more details and information, please see the "Setting up device controls" section of the BlackBerry Enterprise Service 10 BlackBerry Device Service, Version: 6.2 Administration Guide.

Fix: F-43921r1_fix

Configure the centrally managed BlackBerry Device Service server security policy rule to enable or disable the transfer of any file-based data via Bluetooth.

b
The BlackBerry Device Service server must enable Bluetooth pairing using a randomly generated passkey size of at least 8 digits via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-38966 - SV-50771r2_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000160
Vuln IDs
  • V-38966
Rule IDs
  • SV-50771r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46446r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether Bluetooth pairing using a randomly generated passkey size of at least 8 digits has been enabled. If there are multiple policies, they must all be reviewed. The "Enforce Minimum Bluetooth Passkey Length" rule on the BlackBerry Device Service server specifies whether a BlackBerry device can connect to another Bluetooth-enabled device if the passkey that the Bluetooth-enabled device requests from or provides to the BlackBerry device is less than 8 digits. If this rule is set to Yes, the BlackBerry device cannot connect to another Bluetooth-enabled device if the passkey that the Bluetooth-enabled device requests from or provides to the BlackBerry device is less than 8 digits. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Hardware" and verify "Enforce Minimum Bluetooth Passkey Length" is set to "Yes". Otherwise, this is a finding. Note: Check text is applicable for devices with EMM-Regulated (Work Space only).

Fix: F-43922r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to enable Bluetooth pairing using a randomly generated passkey size of at least 8 digits.

b
The BlackBerry Device Service server must enable Bluetooth 128-bit encryption via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-38967 - SV-50772r2_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000165
Vuln IDs
  • V-38967
Rule IDs
  • SV-50772r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46447r2_chk

Review the BlackBerry Device Service server configuration to determine whether Bluetooth 128-bit encryption is enabled. If there are multiple policies, they must all be reviewed. The "Minimum Bluetooth Encryption Key Length" rule on the BlackBerry Device Service server specifies the minimum encryption key length that a BlackBerry device uses to encrypt Bluetooth connections. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Hardware" and verify "Minimum Bluetooth Encryption Key Length" is set to "16 Bytes". Otherwise, this is a finding. Note: Check text is applicable for devices with EMM-Regulated (Work Space only).

Fix: F-43923r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to enable Bluetooth 128-bit encryption.

b
BlackBerry Web Desktop Manager must be configured to permit users to activate new BlackBerry devices only.
CM-6 - Medium - CCI-000370 - V-38992 - SV-50797r2_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000200
Vuln IDs
  • V-38992
Rule IDs
  • SV-50797r2_rule
The overall security posture of the BlackBerry system is dependent on strict configuration management controls, including ensuring only authorized BlackBerry devices are being used and authorized devices are provisioned as required. When these configurations are not set as required, users may have the capability to activate unauthorized BlackBerry devices.
Checks: C-46455r2_chk

Verify the BlackBerry Administration Service (BAS) has been configured to permit users to activate new BlackBerry devices only. Log into the BAS as an administrator with Security Administrator role. Under "Organization Administration", expand "Organization". - Click "My organization". - Click the "BlackBerry Web Desktop Manager Information" tab. - On the "Allowed user operations", verify "Allow user wireline activation:" is set to "Activate unused PIN only." This is a finding if not set as required.

Fix: F-43948r2_fix

Configure BlackBerry Administration Service to permit users to activate new BlackBerry devices only via BlackBerry Web Desktop Manager.

b
The BlackBerry Device Service server must set the number of incorrect password attempts before a data wipe procedure is initiated to 10 via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-39012 - SV-50817r2_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000230
Vuln IDs
  • V-39012
Rule IDs
  • SV-50817r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46461r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether the number of incorrect password attempts before a data wipe procedure is initiated is set to 10. If there are multiple policies, they must all be reviewed. The "Maximum Password Attempt" rule allows the administrator to enforce data wipe upon maximum number of incorrect passwords. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Password" and verify "Maximum Password Attempts" is set to "10." Otherwise, this is a finding.

Fix: F-43968r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to set the number of incorrect password attempts before a data wipe procedure is initiated to 10.

b
The BlackBerry Device Service server must enable a Work Space password via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-39013 - SV-50818r2_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000235
Vuln IDs
  • V-39013
Rule IDs
  • SV-50818r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately
Checks: C-46462r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether a Work Space password has been enabled. If there are multiple policies, they must all be reviewed. The "Password Required for Work Space" rule specifies whether a BlackBerry device requires a password for the Work Space. If this rule is set to Yes, a BlackBerry device user must set a password for the Work Space on the device. For devices with the BlackBerry PlayBook OS, if this rule is not set, a default value of "No" will be used. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Password" and verify "Password Required for Work Space" is set to "Yes." Otherwise, this is a finding. Note: The above is only for devices with EMM-Corporate (BlackBerry Balance) devices. This check is not applicable to EMM-Regulated (Work Space only) devices.

Fix: F-43969r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to enable a Work Space password.

b
The BlackBerry Device Service server must set the number of uppercase letters in the Work Space password to at least one via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-39014 - SV-50819r2_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000240
Vuln IDs
  • V-39014
Rule IDs
  • SV-50819r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46463r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether the number of uppercase letters in the Work Space password is at least one. If there are multiple policies, they must all be reviewed. The "Minimum Password Complexity" rule allows the administrator of the BlackBerry Device Service server to force at least 1 uppercase letter in the device unlock password. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Password" and verify "Password Complexity" is set to "At least one uppercase letter, one lowercase letter, one number, and one special character". Otherwise, this is a finding.

Fix: F-43970r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to set the number of uppercase letters in the Work Space password to at least one.

b
The BlackBerry Device Service server must set the number of numbers in the Work Space password to at least one via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-39015 - SV-50820r2_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000245
Vuln IDs
  • V-39015
Rule IDs
  • SV-50820r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46464r3_chk

Review the BlackBerry Device Service server policy configuration to determine whether the number of numbers in the Work Space password is at least one. If there are multiple policies, they must all be reviewed. The "Minimum Password Complexity" rule allows the administrator of the BlackBerry Device Service server to force at least one number in the device unlock password. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Password" and verify "Password Complexity" is set to "At least one uppercase letter, one lowercase letter, one number, and one special character." Otherwise, this is a finding.

Fix: F-43971r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to set the number of numbers in the Work Space password to at least one.

b
The BlackBerry Device Service server must enable a Work Space password length of eight or more characters via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-39018 - SV-50823r2_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000260
Vuln IDs
  • V-39018
Rule IDs
  • SV-50823r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46467r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether the Work Space password length is at least eight characters. If there are multiple policies, they must all be reviewed. The "Minimum Password Length" rule enforces a minimum number of characters for the device password. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Password" and verify "Minimum Password Length" is set to "8". Otherwise, this is a finding.

Fix: F-43975r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to set the Work Space password length of eight or more characters.

b
The BlackBerry Device Service server must set the Work Space inactivity timeout to 15 minutes via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-39022 - SV-50827r2_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000270
Vuln IDs
  • V-39022
Rule IDs
  • SV-50827r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46469r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether the Work Space inactivity timeout is set to 15 minutes. If there are multiple policies, they must all be reviewed. The "Security Timeout" rule forces the Work Space to lock after a specified period of inactivity. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Password" and verify "Security Timeout" is set to "15 minutes". Otherwise, this is a finding.

Fix: F-43978r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to set the Work Space inactivity timeout to 15 minutes.

b
The BlackBerry Device Service server must be configured to restrict the download of software within the Work Space to DoD-approved sources only (e.g., DoD-operated mobile device application store or BlackBerry Device Service server).
CM-6 - Medium - CCI-000370 - V-39023 - SV-50828r2_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000275
Vuln IDs
  • V-39023
Rule IDs
  • SV-50828r2_rule
DoD can perform due diligence on sources of software to mitigate the risk that malicious software is introduced to those sources. Therefore, if software is downloaded from a DoD approved source, then it is less likely to be malicious than if it is downloaded from an unapproved source. To prevent access to unapproved sources, the operating system in most cases can be configured to disable user access to public application stores.
Checks: C-46470r2_chk

Review the BlackBerry Device Service server configuration to ensure the BlackBerry Device Service server is configured to restrict the download of software within the Work Space to DoD-approved sources only (e.g., DoD-operated mobile device application store or BlackBerry Device Service server). Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Security" and verify "Restrict Development Mode" is set to "Yes". Otherwise, this is a finding. Note: The above is only for EMM-Corporate (BlackBerry Balance) devices. EMM-Regulated (Work Space only) devices inherently meet this requirement.

Fix: F-43979r2_fix

Configure the BlackBerry Device Service server to restrict the download of software within the Work Space to DoD-approved sources only.

b
BlackBerry Web Desktop Manager must be configured to disable a users capability to perform self-service tasks.
CM-7 - Medium - CCI-000386 - V-39026 - SV-50831r2_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000386
Version
BBDS-00-000285
Vuln IDs
  • V-39026
Rule IDs
  • SV-50831r2_rule
The overall security posture of the BlackBerry system is dependent on strict configuration management controls, including ensuring only authorized BlackBerry devices are being used and authorized devices are provisioned as required. When these configurations are not set as required, users may have the capability to activate unauthorized BlackBerry devices.
Checks: C-46472r2_chk

Review the BlackBerry Device Service server configuration to ensure the BlackBerry Administration Service (BAS) has been configured to disable users from performing administrative tasks on the BlackBerry Device Service server. Log into the BlackBerry Administration Service as an administrator with a Security Administrator role. Under "Organization Administration", expand "Organization". - Click "My organization". - Click the "BlackBerry Web Desktop Manager Information" tab. - On the "Allowed user operations", verify "Allow users to perform self service tasks:" is set to No. If not set as required, this is a finding.

Fix: F-43982r1_fix

Configure the BlackBerry Administration Service to disable a user from performing self-service tasks via BlackBerry Web Desktop Manager.

a
BlackBerry Web Desktop Manager must be configured to disable a users capability to perform a backup or restore of the Work Space.
CM-7 - Low - CCI-000386 - V-39027 - SV-50832r2_rule
RMF Control
CM-7
Severity
Low
CCI
CCI-000386
Version
BBDS-00-000286
Vuln IDs
  • V-39027
Rule IDs
  • SV-50832r2_rule
The overall security posture of the BlackBerry system is dependent on strict configuration management controls, including ensuring only authorized BlackBerry devices are being used and authorized devices are provisioned as required. When these configurations are not set as required, users may have the capability to activate unauthorized BlackBerry devices.
Checks: C-46473r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether a user-initiated backup or restore of the Work Space of a managed mobile device has been disabled. If there are multiple policies, they must all be reviewed. For EMM-Corporate (BlackBerry Balance) devices, log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Security" and verify "Backup and Restore Work Space" is set to "Disallow". Otherwise, this is a finding. For EMM-Regulated (Work Space only) devices, log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Security" and verify "Backup and Restore Device" is set to "Disallow". Otherwise, this is a finding.

Fix: F-43983r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disallow a user initiated backup or restore of the Work Space of a managed mobile device.

a
The BlackBerry Device Service server must disallow any native applications pertaining to billing via centrally managed policy.
CM-7 - Low - CCI-000386 - V-39028 - SV-50833r2_rule
RMF Control
CM-7
Severity
Low
CCI
CCI-000386
Version
BBDS-00-000287
Vuln IDs
  • V-39028
Rule IDs
  • SV-50833r2_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46474r2_chk

Review the BlackBerry Device Service server policy configuration to determine whether any native applications pertaining to billing on a managed mobile device have been disallowed. If there are multiple policies, they must all be reviewed. The "Wireless Service Provider Billing" rule prevents users from buying wireless service plans that are available from the Plans app. If this rule is set to Disallow, the Wireless Service Provider Billing is disabled on the device. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > General" and verify "Wireless Service Provider Billing" is set to "Disallow". Otherwise, this is a finding.

Fix: F-43985r2_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disallow any native applications pertaining to billing on a managed mobile device.

a
The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Disallow any native applications pertaining to billing on a managed mobile device.
CM-7 - Low - CCI-000386 - V-39029 - SV-50834r1_rule
RMF Control
CM-7
Severity
Low
CCI
CCI-000386
Version
BBDS-00-000288
Vuln IDs
  • V-39029
Rule IDs
  • SV-50834r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46475r1_chk

Review the BlackBerry Device Service server configuration to determine whether there is administrative functionality to disallow any native applications pertaining to billing on a managed mobile device. If this function is not present, this is a finding. The "Wireless Service Provider Billing" rule specifies whether a BlackBerry device user can purchase paid apps from the BlackBerry World storefront and the BlackBerry World for Work storefront using the purchasing plan for your organization's wireless service provider. If this rule is set to disallow, users must pay for app purchases using another payment method. IT policy rules can be specified per group or per user. To add an IT policy to a group: 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand Group. 2. Click Manage groups. 3. Click the name of the group. 4. Click Edit group. 5. Click the Policies tab. 6. In the IT policy list, select the IT policy. 7. Click Save all. To add an IT policy to a user account: 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand User. 2. Click Manage users. 3. Search for a user account. 4. In the search results, select the check box for the user account. 5. In the Add to user configuration list, click Set IT policy. 6. In the IT policy drop-down list, select the IT policy. 7. Click Save. For more details and information, please see the "Setting up device controls" section of the BlackBerry Enterprise Service 10 BlackBerry Device Service, Version: 6.2 Administration Guide

Fix: F-43986r1_fix

Configure the centrally managed BlackBerry Device Service server security policy rule to disallow any native applications pertaining to billing on a managed mobile device.

c
The BlackBerry Device Service server must require administrators to be authenticated with an individual authenticator prior to using a group authenticator.
IA-2 - High - CCI-000770 - V-39031 - SV-50836r2_rule
RMF Control
IA-2
Severity
High
CCI
CCI-000770
Version
BBDS-00-000290
Vuln IDs
  • V-39031
Rule IDs
  • SV-50836r2_rule
To assure individual accountability and prevent unauthorized access, MDM administrators and users (and any processes acting on behalf of users) must be individually identified and authenticated. Without individual accountability, there can be no traceability back to an individual if there were a security incident on the system. In addition, group accounts can be shared with individuals who do not have authorized access.
Checks: C-46476r3_chk

Review the BlackBerry Device Service server configuration to ensure the system is authenticating through the Enterprise Authentication Mechanism that requires administrators to be authenticated with an individual authenticator prior to using a group authenticator. To ensure correct configuration, have the BlackBerry Device Service (BDS) Administrator log on to the BDS Server and ensure authentication was performed via Active Directory. If access to the server is not being authenticated via this method, this is a finding. To configure the BDS server to authenticate via Active Directory, the following process can be used: Local authentication rules are handled by the host operating system. Remote connection via web browser can be configured to use Microsoft Active Directory authentication during the installation of the BlackBerry Device Server. Configure permissions for the service account: The service account is a Windows account that runs the services for the BlackBerry Device Service. On the computer that you want to install the BlackBerry Device Service on, you must configure permissions for the service account. Without the correct permissions, the BlackBerry Device Service cannot run. If your organization's environment includes the BlackBerry Enterprise Server, you can use the BlackBerry Enterprise Server service account to install the BlackBerry Device Service. If you do not have a BlackBerry Enterprise Server service account, in Microsoft Active Directory, create a service account that you name BDSAdmin. During the installation of the BlackBerry Device Service, steps 16 and 17 describe the setup of the Active Directory login, as follows: 16. In the Microsoft Active Directory settings dialog box, specify information for the reader account that the BlackBerry Administration Service uses to authenticate with Microsoft Active Directory. By default, the setup application uses the service account that you used in step 1. If you want to use a different account as the reader account, you must specify the username, password, and Windows domain for a Microsoft Active Directory account. The account must have permission to read the user information that is stored in the global catalog servers that the BlackBerry Administration Service can access. 17. In the Create an administrator account dialog box, perform one of the following actions: * If you select Use Microsoft Active Directory authentication, you can choose to use the Microsoft Active Directory account that you used in step 16, or you can specify the username and Windows domain for a different Microsoft Active Directory account. * If you select Use BlackBerry Administration Service authentication, type and confirm a password for the BlackBerry Administration Service administrator account. You use the account information that you specify to log in to the BlackBerry Administration Service for the first time. Log in to the BlackBerry Administration Service: When you install the BlackBerry Administration Service, you specify the credentials that you use to log in to the BlackBerry Administration Service for the first time. 1. In the browser, type "https://<server_name>/webconsole/login", where <server_name> is the name of the computer that hosts the BlackBerry Administration Service. 2. In the "User name" field, type your username. 3. In the "Password" field, type your password. 4. Perform one of the following actions: * In the "Log in using" drop-down list, click "BlackBerry Administration Service". * In the "Log in using" drop-down list, click "Active Directory" and type the Microsoft Active Directory domain in the "Domain" field. 5. Click "Log in". 6. Install the RIMWebComponents.cab add-on if you are prompted to do so. For further details regarding the BlackBerry Device Service Installation and configuration, see the accompanying Overview Document, and the "Install the BlackBerry Device Service software" section of the BlackBerry Enterprise Service 10 BlackBerry Device Service Version: 6.2, Installation and Configuration Guide.

Fix: F-43987r1_fix

Configure the BlackBerry Device Service server to authenticate through the Enterprise Authentication Mechanism prior to performing group authentication.

c
The BlackBerry Device Service server must use organization defined replay-resistant authentication mechanisms for network access to privileged accounts.
IA-2 - High - CCI-000774 - V-39032 - SV-50837r2_rule
RMF Control
IA-2
Severity
High
CCI
CCI-000774
Version
BBDS-00-000295
Vuln IDs
  • V-39032
Rule IDs
  • SV-50837r2_rule
An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Replay attacks, if successfully used against a MDM account could result in unfettered access to the MDM settings and data records.
Checks: C-46477r3_chk

Review the BlackBerry Device Service server configuration to ensure the system is authenticating through the Enterprise Authentication Mechanism that employs replay-resistant features. To ensure correct configuration, have the BlackBerry Device Service (BDS) Administrator log on to the BDS Server and ensure authentication was performed via Active Directory. If access to the server is not being authenticated via this method, this is a finding. To configure the BDS server to authenticate via Active Directory, the following process can be used: Local authentication rules are handled by the host operating system. Remote connection via web browser can be configured to use Microsoft Active Directory authentication during the installation of the BlackBerry Device Server. Configure permissions for the service account: The service account is a Windows account that runs the services for the BlackBerry Device Service. On the computer that you want to install the BlackBerry Device Service on, you must configure permissions for the service account. Without the correct permissions, the BlackBerry Device Service cannot run. If your organization's environment includes the BlackBerry Enterprise Server, you can use the BlackBerry Enterprise Server service account to install the BlackBerry Device Service. If you do not have a BlackBerry Enterprise Server service account, in Microsoft Active Directory, create a service account that you name BDSAdmin. During the installation of the BlackBerry Device Service, steps 16 and 17 describe the setup of the Active Directory login, as follows: 16. In the Microsoft Active Directory settings dialog box, specify information for the reader account that the BlackBerry Administration Service uses to authenticate with Microsoft Active Directory. By default, the setup application uses the service account that you used in step 1. If you want to use a different account as the reader account, you must specify the username, password, and Windows domain for a Microsoft Active Directory account. The account must have permission to read the user information that is stored in the global catalog servers that the BlackBerry Administration Service can access. 17. In the Create an administrator account dialog box, perform one of the following actions: * If you select Use Microsoft Active Directory authentication, you can choose to use the Microsoft Active Directory account that you used in step 16, or you can specify the username and Windows domain for a different Microsoft Active Directory account. * If you select Use BlackBerry Administration Service authentication, type and confirm a password for the BlackBerry Administration Service administrator account. You use the account information that you specify to log in to the BlackBerry Administration Service for the first time. Log in to the BlackBerry Administration Service: When you install the BlackBerry Administration Service, you specify the credentials that you use to log in to the BlackBerry Administration Service for the first time. 1. In the browser, type "https://<server_name>/webconsole/login", where <server_name> is the name of the computer that hosts the BlackBerry Administration Service. 2. In the "User name" field, type your username. 3. In the "Password" field, type your password. 4. Perform one of the following actions: * In the "Log in using" drop-down list, click "BlackBerry Administration Service". * In the "Log in using" drop-down list, click "Active Directory" and type the Microsoft Active Directory domain in the "Domain" field. 5. Click "Log in". 6. Install the RIMWebComponents.cab add-on if you are prompted to do so. For further details regarding the BlackBerry Device Service Installation and configuration, see the accompanying Overview Document, and the "Install the BlackBerry Device Service software" section of the BlackBerry Enterprise Service 10 BlackBerry Device Service Version: 6.2, Installation and Configuration Guide.

Fix: F-43989r1_fix

Configure the BlackBerry Device Service server to authenticate through the Enterprise Authentication Mechanism.

b
The BlackBerry Device Service server must be configured to accept only trusted connections to back-office enclave application or web push servers. Push servers are set up to push content to BlackBerry users.
IA-3 - Medium - CCI-000781 - V-39035 - SV-50840r2_rule
RMF Control
IA-3
Severity
Medium
CCI
CCI-000781
Version
BBDS-00-000300
Vuln IDs
  • V-39035
Rule IDs
  • SV-50840r2_rule
Device authentication is a solution enabling an organization to manage both users and devices. This requirement applies to MDM servers that provide mobile device and user access to network shares, web servers, and other network resources located on the internal enclave (back-office servers, etc.). This connection bypasses user network authentication mechanisms (i.e., CAC authentication). Therefore, the MDM server must allow connections to only back-office network resources that support CAC authentication with the mobile device user. In this case, a trusted connection refers to mutual PKI based authentication between the MDM server and the network server.
Checks: C-46478r4_chk

Verify the site has configured the BDS to require trusted connections to push enclave applications or web servers, using the following procedure. Log into BlackBerry Administration Service, and under "Servers and components" on the left side of the screen, navigate to "'BlackBerry Solution topology > BlackBerry Domain > Component view > MDS Connection Service > <MDS Connection Service Instance>". - On the "Instance information" tab, click "Edit instance". - In the "Access control" section, verify "Push authentication:" is set to "Yes". If not set as required, this is a finding.

Fix: F-43991r1_fix

Configure the BlackBerry Device Service server to push content to BlackBerry devices.

b
The BlackBerry Device Service server must support administrator authentication to the server via the Enterprise Authentication Mechanisms authentication.
IA-5 - Medium - CCI-000192 - V-39036 - SV-50841r2_rule
RMF Control
IA-5
Severity
Medium
CCI
CCI-000192
Version
BBDS-00-000305
Vuln IDs
  • V-39036
Rule IDs
  • SV-50841r2_rule
In the DoD, Administrator credential requirements for authentication are defined by CTO 07-115Rev1, which is usually enforced by the Enterprise Authentication Mechanism. Non-complaint credential enforcement mechanisms make the DoD IS vulnerable to attack.
Checks: C-46479r3_chk

Review the BlackBerry Device Service server configuration to ensure the system is authenticating through the Enterprise Authentication Mechanism. To ensure correct configuration, have the BlackBerry Device Service (BDS) Administrator log on to the BDS Server and ensure authentication was performed via Active Directory. If access to the server is not being authenticated via this method, this is a finding. To configure the BDS server to authenticate via Active Directory, the following process can be used: Local authentication rules are handled by the host operating system. Remote connection via web browser can be configured to use Microsoft Active Directory authentication during the installation of the BlackBerry Device Server. Configure permissions for the service account: The service account is a Windows account that runs the services for the BlackBerry Device Service. On the computer that you want to install the BlackBerry Device Service on, you must configure permissions for the service account. Without the correct permissions, the BlackBerry Device Service cannot run. If your organization's environment includes the BlackBerry Enterprise Server, you can use the BlackBerry Enterprise Server service account to install the BlackBerry Device Service. If you do not have a BlackBerry Enterprise Server service account, in Microsoft Active Directory, create a service account that you name BDSAdmin. During the installation of the BlackBerry Device Service, steps 16 and 17 describe the setup of the Active Directory login, as follows: 16. In the Microsoft Active Directory settings dialog box, specify information for the reader account that the BlackBerry Administration Service uses to authenticate with Microsoft Active Directory. By default, the setup application uses the service account that you used in step 1. If you want to use a different account as the reader account, you must specify the username, password, and Windows domain for a Microsoft Active Directory account. The account must have permission to read the user information that is stored in the global catalog servers that the BlackBerry Administration Service can access. 17. In the Create an administrator account dialog box, perform one of the following actions: * If you select Use Microsoft Active Directory authentication, you can choose to use the Microsoft Active Directory account that you used in step 16, or you can specify the username and Windows domain for a different Microsoft Active Directory account. * If you select Use BlackBerry Administration Service authentication, type and confirm a password for the BlackBerry Administration Service administrator account. You use the account information that you specify to log in to the BlackBerry Administration Service for the first time. Log in to the BlackBerry Administration Service: When you install the BlackBerry Administration Service, you specify the credentials that you use to log in to the BlackBerry Administration Service for the first time. 1. In the browser, type "https://<server_name>/webconsole/login", where <server_name> is the name of the computer that hosts the BlackBerry Administration Service. 2. In the "User name" field, type your username. 3. In the "Password" field, type your password. 4. Perform one of the following actions: * In the "Log in using" drop-down list, click "BlackBerry Administration Service". * In the "Log in using" drop-down list, click "Active Directory" and type the Microsoft Active Directory domain in the "Domain" field. 5. Click "Log in". 6. Install the RIMWebComponents.cab add-on if you are prompted to do so. For further details regarding the BlackBerry Device Service Installation and configuration, see the accompanying Overview Document, and the "Install the BlackBerry Device Service software" section of the BlackBerry Enterprise Service 10 BlackBerry Device Service Version: 6.2, Installation and Configuration Guide.

Fix: F-43992r2_fix

Configure the BlackBerry Device Service server to support administrator authentication to the server via the Enterprise Authentication Mechanism's authentication.

a
The key store password for the certificate that the BlackBerry Administration Service (BAS) and BlackBerry Web Desktop Manager (BWDM) use must be changed from the default.
IA-5 - Low - CCI-000186 - V-39037 - SV-50842r2_rule
RMF Control
IA-5
Severity
Low
CCI
CCI-000186
Version
BBDS-00-000310
Vuln IDs
  • V-39037
Rule IDs
  • SV-50842r2_rule
The key store password protects the server digital authentication certificates from unauthorized use.
Checks: C-46480r3_chk

Review the BlackBerry Device Service server configuration to ensure key store password for the certificate that the BlackBerry Administration Service (BAS) and BlackBerry Web Desktop Manager (BWDM) use has been changed from the default. When the BlackBerry Administration Service is installed, the setup application generates a password for the web.keystore file. The web.keystore file stores the SSL certificate that the BlackBerry Administration Service uses to authenticate with browsers. You can change the web keystore password after the installation process completes. All BlackBerry Administration Service instances in a BlackBerry Device Service domain must use the same web keystore password. Consult the system administrator to determine whteher the default password was changed. If the default password has not been changed, this is a finding. To change the web.keystore password, use the following procedure: Before you begin: To verify the current password for the web.keystore file, log in to the BlackBerry Administration Service using an administrator account with the Security Administrator role. Under "Servers and components" on the left side, navigate to "BlackBerry Solution topology > BlackBerry Domain> Component view > BlackBerry Administration Service", and check the "Security settings" section. 1. From the Windows machine with BlackBerry Enterprise Service 10, navigate to "Start > All Programs > BlackBerry Enterprise Service 10" and open "Configuration Tool for BlackBerry Enterprise Service 10". 2. On the "Administration Service - Web Keystore" tab, type the current password. 3. Type a new password and confirm the new password. 4. Click "OK". 5. In the Windows Services, restart the BlackBerry Administration Service services. 6. Repeat steps 1 to 5 on each computer that hosts a BlackBerry Administration Service instance.

Fix: F-43994r1_fix

Change the key store password for the certificate that the BlackBerry Administration Service (BAS) and BlackBerry Web Desktop Manager (BWDM) use from the default.

c
The BlackBerry Device Service server must use mechanisms for authentication to a cryptographic module meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
IA-7 - High - CCI-000803 - V-39038 - SV-50843r2_rule
RMF Control
IA-7
Severity
High
CCI
CCI-000803
Version
BBDS-00-000315
Vuln IDs
  • V-39038
Rule IDs
  • SV-50843r2_rule
MDM applications utilizing encryption are required to use approved encryption modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Encryption is only as good as the encryption modules utilized. Unapproved cryptographic module algorithms cannot be verified, and cannot be relied upon to provide confidentiality or integrity and DoD data may be compromised due to weak algorithms.
Checks: C-46481r2_chk

Review the BlackBerry Device Service server configuration to ensure the system is authenticating through the Enterprise Authentication Mechanism that utilizes a cryptographic module meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication. To ensure correct configuration, have the BlackBerry Device Service (BDS) Administrator log on to the BDS Server and ensure authentication was performed via Active Directory. If access to the server is not being authenticated via this method, this is a finding. To configure the BDS server to authenticate via Active Directory, the following process can be used: Local authentication rules are handled by the host operating system. Remote connection via web browser can be configured to use Microsoft Active Directory authentication during the installation of the BlackBerry Device Server. Configure permissions for the service account: The service account is a Windows account that runs the services for the BlackBerry Device Service. On the computer that you want to install the BlackBerry Device Service on, you must configure permissions for the service account. Without the correct permissions, the BlackBerry Device Service cannot run. If your organization's environment includes the BlackBerry Enterprise Server, you can use the BlackBerry Enterprise Server service account to install the BlackBerry Device Service. If you do not have a BlackBerry Enterprise Server service account, in Microsoft Active Directory, create a service account that you name BDSAdmin. During the installation of the BlackBerry Device Service, steps 16 and 17 describe the setup of the Active Directory login, as follows: 16. In the Microsoft Active Directory settings dialog box, specify information for the reader account that the BlackBerry Administration Service uses to authenticate with Microsoft Active Directory. By default, the setup application uses the service account that you used in step 1. If you want to use a different account as the reader account, you must specify the username, password, and Windows domain for a Microsoft Active Directory account. The account must have permission to read the user information that is stored in the global catalog servers that the BlackBerry Administration Service can access. 17. In the Create an administrator account dialog box, perform one of the following actions: * If you select Use Microsoft Active Directory authentication, you can choose to use the Microsoft Active Directory account that you used in step 16, or you can specify the username and Windows domain for a different Microsoft Active Directory account. * If you select Use BlackBerry Administration Service authentication, type and confirm a password for the BlackBerry Administration Service administrator account. You use the account information that you specify to log in to the BlackBerry Administration Service for the first time. Log in to the BlackBerry Administration Service: When you install the BlackBerry Administration Service, you specify the credentials that you use to log in to the BlackBerry Administration Service for the first time. 1. In the browser, type "https://<server_name>/webconsole/login", where <server_name> is the name of the computer that hosts the BlackBerry Administration Service. 2. In the "User name" field, type your username. 3. In the "Password" field, type your password. 4. Perform one of the following actions: * In the "Log in using" drop-down list, click "BlackBerry Administration Service". * In the "Log in using" drop-down list, click "Active Directory" and type the Microsoft Active Directory domain in the "Domain" field. 5. Click "Log in". 6. Install the RIMWebComponents.cab add-on if you are prompted to do so. For further details regarding the BlackBerry Device Service Installation and configuration, see the accompanying Overview Document, and the "Install the BlackBerry Device Service software" section of the BlackBerry Enterprise Service 10 BlackBerry Device Service Version: 6.2, Installation and Configuration Guide.

Fix: F-43995r1_fix

Configure the BlackBerry Device Service server to authenticate through the Enterprise Authentication Mechanism utilizing a cryptographic module meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

c
The BlackBerry Device Service server must employ strong identification and authentication techniques in the establishment of non-local maintenance and diagnostic sessions.
MA-4 - High - CCI-000877 - V-39039 - SV-50844r2_rule
RMF Control
MA-4
Severity
High
CCI
CCI-000877
Version
BBDS-00-000320
Vuln IDs
  • V-39039
Rule IDs
  • SV-50844r2_rule
Lack of authentication enables anyone to gain access to the MDM. Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Authorization for access to the MDM to perform maintenance and diagnostics requires an individual account identifier that has been approved, assigned, and configured. Authentication of non-local maintenance and diagnostics sessions must be accomplished through two-factor authentication via the combination of passwords, tokens, and biometrics.
Checks: C-46482r3_chk

Review the BlackBerry Device Service server configuration to ensure the system is authenticating through the Enterprise Authentication Mechanism that employs strong identification and authentication techniques in the establishment of non-local maintenance and diagnostic sessions. To ensure correct configuration, have the BlackBerry Device Service (BDS) Administrator log on to the BDS Server and ensure authentication was performed via Active Directory. If access to the server is not being authenticated via this method, this is a finding. To configure the BDS server to authenticate via Active Directory, the following process can be used: Local authentication rules are handled by the host operating system. Remote connection via web browser can be configured to use Microsoft Active Directory authentication during the installation of the BlackBerry Device Server. Configure permissions for the service account: The service account is a Windows account that runs the services for the BlackBerry Device Service. On the computer that you want to install the BlackBerry Device Service on, you must configure permissions for the service account. Without the correct permissions, the BlackBerry Device Service cannot run. If your organization's environment includes the BlackBerry Enterprise Server, you can use the BlackBerry Enterprise Server service account to install the BlackBerry Device Service. If you do not have a BlackBerry Enterprise Server service account, in Microsoft Active Directory, create a service account that you name BDSAdmin. During the installation of the BlackBerry Device Service, steps 16 and 17 describe the setup of the Active Directory login, as follows: 16. In the Microsoft Active Directory settings dialog box, specify information for the reader account that the BlackBerry Administration Service uses to authenticate with Microsoft Active Directory. By default, the setup application uses the service account that you used in step 1. If you want to use a different account as the reader account, you must specify the username, password, and Windows domain for a Microsoft Active Directory account. The account must have permission to read the user information that is stored in the global catalog servers that the BlackBerry Administration Service can access. 17. In the Create an administrator account dialog box, perform one of the following actions: * If you select Use Microsoft Active Directory authentication, you can choose to use the Microsoft Active Directory account that you used in step 16, or you can specify the username and Windows domain for a different Microsoft Active Directory account. * If you select Use BlackBerry Administration Service authentication, type and confirm a password for the BlackBerry Administration Service administrator account. You use the account information that you specify to log in to the BlackBerry Administration Service for the first time. Log in to the BlackBerry Administration Service: When you install the BlackBerry Administration Service, you specify the credentials that you use to log in to the BlackBerry Administration Service for the first time. 1. In the browser, type "https://<server_name>/webconsole/login", where <server_name> is the name of the computer that hosts the BlackBerry Administration Service. 2. In the "User name" field, type your username. 3. In the "Password" field, type your password. 4. Perform one of the following actions: * In the "Log in using" drop-down list, click "BlackBerry Administration Service". * In the "Log in using" drop-down list, click "Active Directory" and type the Microsoft Active Directory domain in the "Domain" field. 5. Click "Log in". 6. Install the RIMWebComponents.cab add-on if you are prompted to do so. For further details regarding the BlackBerry Device Service Installation and configuration, see the accompanying Overview Document, and the "Install the BlackBerry Device Service software" section of the BlackBerry Enterprise Service 10 BlackBerry Device Service Version: 6.2, Installation and Configuration Guide.

Fix: F-43996r1_fix

Configure the BlackBerry Device Service server to authenticate through an Enterprise Authentication Mechanism that employs strong identification and authentication techniques in the establishment of non-local maintenance and diagnostic sessions.

a
The server PKI digital certificate installed on the BlackBerry Device Service (BDS) Server to support BlackBerry Administration Service and BlackBerry Web Desktop Manager (BWDM) authentication must be a DoD PKI issued certificate. A self signed certificate will not be used.
SC-17 - Low - CCI-001159 - V-39040 - SV-50845r2_rule
RMF Control
SC-17
Severity
Low
CCI
CCI-001159
Version
BBDS-00-000325
Vuln IDs
  • V-39040
Rule IDs
  • SV-50845r2_rule
When a self signed PKI certificate is used, a rogue BDS server can impersonate the DoD BDS server during SA connections to the BAS or when a BlackBerry user uses BWDM to connect to the BAS. In addition, DoDI 8520-02 requires PKI certificates come from a trusted DoD PKI.
Checks: C-46483r4_chk

Examine the server configuration to determine whether a DoD PKI issued certificate has been installed. Open Internet Explorer, and navigate to BlackBerry Administration Service. Click on the Lock icon located to the right of the Address bar (or click "Certificate error", if the certificate is untrusted) and select "View certificates". Ensure the certificate is issued by a valid DoD CA. Otherwise, this is a finding. Steps to replace self-signed or non-DoD certificate: Log into the server as the BlackBerry Enterprise Server (BES) service account and complete the following tasks to replace the self-signed Secure Socket Layer (SSL) certificate used by the BAS and the BWDM with a custom certificate (such as one from VeriSign or from a Windows certificate authority). Task 1 - Retrieve your keystore password: 1. Log in to the BAS as an administrator with the Security Administrator role. 2. Under "BlackBerry Solution topology" on the left side, navigate to "BlackBerry Domain > Component view > BlackBerry Administration Service". 3. In the "Security settings", check the value for "Default password to encrypt the web.keystore file" and note it. Task 2 - Back up the web.keystore file: 1. Open a Windows Command prompt as an Administrator 2. Type: copy "c:\Program Files (x86)\Research In Motion\BlackBerry Device Service\BAS\bin\web.keystore" "c:\Program Files (x86)\Research In Motion\BlackBerry Device Service\bas\bin\web.keystore.OLD" Note: Do not remove or rename the existing web.keystore file. Task 3 - Delete the self-signed SSL certificate from inside the keystore file: 1. Open a Command prompt as an Administrator. 2. Type "c:\Program Files\Java\jre1.6.0_31\bin\keytool.exe" -delete -alias httpssl -keystore "C:\Program Files (x86)\Research In Motion\BlackBerry Device Service\bas\bin\web.keystore" -storepass "<password>" Note: The -storepass parameter must be the password you retrieved from step 1. The quotes are required due to special characters. Task 4 - Generate the BlackBerry Administration Service certificate key pair: * Type "c:\Program Files\Java\jre1.6.0_31\bin\keytool.exe" -genkey -alias httpssl -keystore "C:\Program Files (x86)\Research In Motion\BlackBerry Device Service\bas\bin\web.keystore" -storepass "<password>" -dname "CN=<BAS Server or BAS Pool full name>, OU=BAS, O=Company, L=City, ST=ST, C=US" Note: Some Certificate Authority (CA) servers require RSA encryption of the certificate request. If this is the case, add -keyalg RSA to this keytool command. Also, the -keyalg RSA switch defaults to 1024 as a keysize. For environments that require 2048 as a keysize, use the -keysize 2048 command switch, e.g., -keyalg RSA -keysize 2048 STOP: After following this step, the web.keystore file now contains a private key entry. This exact private key MUST be matched with the reply generated from your Certificate Authority below in order for this process to succeed. It is highly recommended that the web.keystore file be backed up after this step has been performed, so that this private key is retained. If this is not done, and any of the following steps are not successful, then it will be necessary to clear out the keystore and start again from Task 1. This is especially important to note for environments with manual certificate request processes. Task 5 - Generate a certificate request to the certification authority: * Type "c:\Program Files\Java\jre1.6.0_31\bin\keytool" -certreq -alias httpssl -keystore "C:\Program Files (x86)\Research in Motion\BlackBerry Device Service\BAS\bin\web.keystore" -file "C:\certreq.csr" -storepass "<password>" Note: If the -keyalg switch was used in Task 3 for a CA that requires RSA encryption, it is recommended to also use it here. Also, the -keyalg RSA switch defaults to 1024 as a keysize. For environments that require 2048 as a keysize, use the -keysize 2048 command switch. e.g. -keyalg RSA -keysize 2048 * "c:\Program Files\Java\jre1.6.0_31\bin\keytool" -certreq -alias httpssl -keystore "C:\Program Files (x86)\Research in Motion\BlackBerry Device Service\BAS\bin\web.keystore" -file "C:\certreq.csr" -storepass "<passwprd>" -keyalg RSA -keysize 2048 Task 6 - Request the certificate from the certificate authority (CA): Note: The steps in this task are based on the steps required to request a certificate from a Windows certificate authority. If requesting a certificate from a third-party certificate authority, see the information in the Additional Information section. Domain administrator permission is required to complete this task. 1. Log off the server as the BlackBerry Enterprise Server service account. 2. Log into the server with a domain account with domain administrator permissions or permissions to submit a webserver template request. 3. Browse to the organization's certificate server using Windows Internet Explorer. (For example: http://<certificate_server_name>/certsrv) 4. Click "Request a certificate". 5. Click "Advanced certificate request". 6. Click "Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file", or "submit a renewal request by using a base-64-encoded PKCS#7 file". 7. Paste the full contents of the certreq.csr file into the "Saved Request" field. 8. Choose "Web Server" from the "Certificate Template" drop-down list. 9. Click "Submit". 10. Click "Download certificate". 11. Save the file to c:\bascert.cer when prompted. Note: If the error "The certificate is not valid for the requested usage" appears, choose Subordinates Certification Authority from the Certificate Template drop-down list instead of Web Server. Task 7 - Download the CA certificate from the certificate authority: 1. Browse to the organization's certificate server using Windows Internet Explorer. (For example: http://<certificate_server_name>/certsrv) 2. Click "Download a CA certificate, certificate chain, or CRL". 3. Click "Download CA certificate". Save it as c:\certnewCA.cer. Task 8 - Import the CA certificate into the BlackBerry Administration Service key store: 1. Log off the server as the domain account used in Tasks 6 and 7 above to request the certificate from the certificate authority (CA). 2. Log onto the server as BES service account. 3. Open a command prompt window as Administrator in the same manner as used in Task 2. 4. Type: "c:\Program Files\Java\jre1.6.0_31\bin\keytool" -import -alias cacert -keystore "C:\Program Files (x86)\Research in Motion\BlackBerry Device Service\BAS\bin\web.keystore" -file "C:\certnewCA.cer" -storepass "<password>" If the BlackBerry Administration Service certificate is issued by an Intermediate CA, perform step 4 to import certificates of every Intermediate CA in the certificate chain. Use a unique alias name for every imported certificate. If the error "keytool error: java.lang.Exception: Failed to establish chain from reply" is displayed when performing Task 9 below, this step needs to be completed. To import an Intermediate Certificate Authority certificate: "c:\Program Files\Java\jre1.6.0_31\bin\keytool" -import -alias cacert2 -keystore "C:\Program Files (x86)\Research in Motion\BlackBerry Device Service\BAS\bin\web.keystore" -file "C:\certnewCA2.cer" -storepass "<password>" Task 9 - Import the BlackBerry Administration Service certificate to the BlackBerry Administration Service key store: * In the command prompt window used in Task 8, type: "c:\Program Files\Java\jre1.6.0_31\bin\keytool" -import -alias httpssl -keystore "C:\Program Files (x86)\Research in Motion\BlackBerry Device Service\BAS\bin\web.keystore" -file "C:\bascert.cer" -storepass "<password>" Task 10 - Restart the BlackBerry Administration Service.

Fix: F-43997r1_fix

Use a DoD issued digital certificate on the BES to support BAS and BlackBerry Web Desktop Manager authentication.

b
The BlackBerry Device Service server must disable the Advanced Audio Distribution Profile (A2DP) Bluetooth profile via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-40718 - SV-52732r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000146
Vuln IDs
  • V-40718
Rule IDs
  • SV-52732r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-47060r1_chk

Review the BlackBerry Device Service server policy configuration to determine whether the Advanced Audio Distribution Profile (A2DP) Bluetooth profile has been disabled. If there are multiple policies, they must all be reviewed. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Hardware" and verify "Bluetooth A2DP" is set to "Disallow". Otherwise, this is a finding. Note: Check text is applicable for devices with EMM-Regulated (Work Space only).

Fix: F-45657r1_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disable the Advanced Audio Distribution Profile (A2DP) Bluetooth profile.

b
The BlackBerry Device Service server must disable the Audio/Video Remote Control Profile (AVRCP) Bluetooth profile via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-40719 - SV-52733r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000147
Vuln IDs
  • V-40719
Rule IDs
  • SV-52733r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-47061r1_chk

Review the BlackBerry Device Service server policy configuration to determine whether the Audio/Video Remote Control Profile (AVRCP) Bluetooth profile has been disabled. If there are multiple policies, they must all be reviewed. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Hardware" and verify "Bluetooth AVRCP" is set to "Disallow". Otherwise, this is a finding. Note: Check text is applicable for devices with EMM-Regulated (Work Space only).

Fix: F-45658r1_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disable the Audio/Video Remote Control Profile (AVRCP) Bluetooth profile.

b
The BlackBerry Device Service server must disable the Phone Book Access Profile (PBAP) Bluetooth profile via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-40720 - SV-52734r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000148
Vuln IDs
  • V-40720
Rule IDs
  • SV-52734r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-47062r1_chk

Review the BlackBerry Device Service server policy configuration to determine whether the Phone Book Access Profile (PBAP) Bluetooth profile has been disabled. If there are multiple policies, they must all be reviewed. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Hardware" and verify both "Transfer Work Contacts Using Bluetooth PBAP or HFP" and "Bluetooth Contacts Transfer Using PBAP" are set to "Disallow". Otherwise, this is a finding.

Fix: F-45659r1_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disable the Phone Book Access Profile (PBAP) Bluetooth profile.

b
The BlackBerry Device Service server must disable the Hands-Free Profile (HFP) Bluetooth profile via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-40721 - SV-52735r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000149
Vuln IDs
  • V-40721
Rule IDs
  • SV-52735r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-47063r1_chk

Review the BlackBerry Device Service server policy configuration to determine whether the Hands-Free Profile (HFP) Bluetooth profile has been disabled. If there are multiple policies, they must all be reviewed. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Hardware" and verify both "Transfer Work Contacts Using Bluetooth PBAP or HFP" and "Bluetooth HFP" are set to "Disallow". Otherwise, this is a finding.

Fix: F-45660r1_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disable the Hands-Free Profile (HFP) Bluetooth profile.

b
The BlackBerry Device Service server must disable the Message Access Profile (MAP) Bluetooth profile via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-40722 - SV-52736r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000151
Vuln IDs
  • V-40722
Rule IDs
  • SV-52736r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-47064r1_chk

Review the BlackBerry Device Service server policy configuration to determine whether the Message Access Profile (MAP) Bluetooth profile has been disabled. If there are multiple policies, they must all be reviewed. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Hardware" and verify all of "Transfer Work Messages Using Bluetooth MAP", "Transfer Work Messages Using Bluetooth MAP Without Prompt", and "Bluetooth MAP" are set to "Disallow". Otherwise, this is a finding.

Fix: F-45661r1_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disable the Message Access Profile (MAP) Bluetooth profile.

b
The BlackBerry Device Service server must disable the Personal Area Networking Profile (PAN) Bluetooth profile via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-40723 - SV-52737r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000152
Vuln IDs
  • V-40723
Rule IDs
  • SV-52737r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-47065r1_chk

Review the BlackBerry Device Service server policy configuration to determine whether the Personal Area Networking (PAN) Bluetooth profile has been disabled. If there are multiple policies, they must all be reviewed. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Hardware" and verify "Bluetooth PAN" is set to "Disallow". Otherwise, this is a finding. Note: Check text is applicable for devices with EMM-Regulated (Work Space only).

Fix: F-45662r1_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disable the Personal Area Networking Profile (PAN) Bluetooth profile.

b
The BlackBerry Device Service server must disable the mobile device users access to BlackBerry World for Work Space and only allow access to apps published from BlackBerry Device Service.
CM-6 - Medium - CCI-000370 - V-40724 - SV-52738r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-003160
Vuln IDs
  • V-40724
Rule IDs
  • SV-52738r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-47066r1_chk

Review the BlackBerry Device Service server configuration to determine whether the commercial application store contains any applications. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Software > Applications > Manage Applications" and verify that there are no applications listed under "BlackBerry World Applications". If there are applications listed under "Blackberry World Applications", this is a finding.

Fix: F-45663r1_fix

Configure the BlackBerry Device Service server application store to contain no commercial applications.

b
The BlackBerry Device Service server must force the display of a warning banner on the lock screen of the mobile device via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-40725 - SV-52739r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-003170
Vuln IDs
  • V-40725
Rule IDs
  • SV-52739r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately. The warning banner must be displayed before or immediately after the user successfully unlocks the mobile device or unlocks a secure application where sensitive DoD data is stored: "I've read & consent to terms in IS user agreement." (Wording must be exactly as specified.)
Checks: C-47067r1_chk

Review the BlackBerry Device Service server configuration to determine whether the BlackBerry Enterprise Service 10 User Administration Tool has been utilized to set the screen-lock owner information. On the BlackBerry 10 device, lock the device and verify the lock screen reads: "I've read & consent to terms in IS user agreem't.". If it does not, this is a finding. In order to use the BlackBerry Enterprise Service 10 User Administration Tool to enable a lock screen warning banner, perform the following: 1. To open the command window for the BlackBerry Enterprise Service 10 User Administration Tool, on the computer that hosts the tool, on the taskbar, click Start > All Programs > BlackBerry Resource Kit for BlackBerry Enterprise Service 10 > BlackBerry Enterprise Service 10 User Administration Tool. 2. Type besuseradminclient <credentials> -set_owner_info -u <user_name>. 3. Perform any of the following actions: • To specify the owner name to display, type -name "<name>". • To specify a single line of text, type -info "I've read & consent to terms in IS user agreem't.". • To specify multiple lines of text using an input file, type -infofile <filename>.

Fix: F-45664r1_fix

Configure the Blackberry Device Service server to force the display of a warning banner on the mobile device.

b
The BlackBerry Device Service server must disable the transfer of work files using Bluetooth OPP via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-40726 - SV-52740r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000156
Vuln IDs
  • V-40726
Rule IDs
  • SV-52740r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-47068r1_chk

Review the BlackBerry Device Service server policy configuration to determine whether the transfer of work files using Bluetooth OPP has been disabled. If there are multiple policies, they must all be reviewed. For EMM-Corporate (BlackBerry Balance) devices, log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Hardware" and verify "Transfer Work Files Using Bluetooth OPP" is set to "Disallow." Otherwise, this is a finding. For EMM-Regulated (Work Space only) devices, log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Hardware" and verify "Bluetooth File Transfer Using OBEX" is set to "Disallow." Otherwise, this is a finding.

Fix: F-45665r1_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disable the transfer of work files using Bluetooth OPP.

b
The BlackBerry Device Service server must disable the transfer of work messages using Bluetooth MAP via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-40727 - SV-52741r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000157
Vuln IDs
  • V-40727
Rule IDs
  • SV-52741r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-47069r1_chk

Review the BlackBerry Device Service server policy configuration to determine whether the Message Access Profile (MAP) Bluetooth profile has been disabled. If there are multiple policies, they must all be reviewed. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Hardware" and verify "Transfer Work Messages Using Bluetooth MAP" is set to "Disallow". Otherwise, this is a finding.

Fix: F-45666r1_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disable the transfer of work messages using Bluetooth MAP.

b
The BlackBerry Device Service server must disable the transfer of work messages using Bluetooth MAP without a user prompt via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-40728 - SV-52742r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000158
Vuln IDs
  • V-40728
Rule IDs
  • SV-52742r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-47070r1_chk

Review the BlackBerry Device Service server policy configuration to determine whether the Message Access Profile (MAP) Bluetooth profile has been disabled. If there are multiple policies, they must all be reviewed. Log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Hardware" and verify "Transfer Work Messages Using Bluetooth MAP Without Prompt" is set to "Disallow". Otherwise, this is a finding.

Fix: F-45667r1_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disable the transfer of work messages using Bluetooth MAP without a user prompt.

b
The BlackBerry Device Service server must disable the Bluetooth transfer of Work Space contacts via centrally managed policy.
CM-6 - Medium - CCI-000370 - V-40729 - SV-52743r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000370
Version
BBDS-00-000159
Vuln IDs
  • V-40729
Rule IDs
  • SV-52743r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-47071r1_chk

Review the BlackBerry Device Service server policy configuration to determine whether the transfer of any file-based data via Bluetooth has been disabled. If there are multiple policies, they must all be reviewed. The "Transfer Work Contacts Using Bluetooth PBAP or HFP" rule on the BlackBerry Device Service server specifies whether a BlackBerry device can send work contacts to another Bluetooth-enabled device using the Bluetooth PBAP or HFP. If this rule is set to disallow, users cannot transfer work contacts using Bluetooth PBAP or HFP. Setting this rule to disallow also prevents users from transferring work messages using the Bluetooth MAP. For EMM-Corporate (BlackBerry Balance) devices, log into BlackBerry Administration Service, and under "BlackBerry solution management" on the left side of the screen, navigate to "Policy > Manage IT policies > <Policy Name> > View complete IT Policy > Hardware" and verify "Transfer Work Contacts Using Bluetooth PBAP or HFP" is set to "Disallow." Otherwise, this is a finding.

Fix: F-45668r1_fix

Configure the centrally managed BlackBerry Device Service server policy rule to disable the transfer of Work Space contacts via Bluetooth.

c
BlackBerry Device service 6.2 and BlackBerry Enterprise Service 10.1.x BlackBerry Device Service MDM servers that are no longer supported by the vendor for security updates must not be installed on a system.
CM-6 - High - CCI-000366 - V-54981 - SV-69227r1_rule
RMF Control
CM-6
Severity
High
CCI
CCI-000366
Version
BBDS-00-000500
Vuln IDs
  • V-54981
Rule IDs
  • SV-69227r1_rule
BlackBerry Device service 6.2 and BlackBerry Enterprise Service 10.1.x BlackBerry Device Service MDM servers that are no longer supported by BlackBerry for security updates are not evaluated or updated for vulnerabilities, leaving them open to potential attack. Organizations must transition to a supported operating system to ensure continued support.
Checks: C-55609r1_chk

BlackBerry support for BlackBerry Device service 6.2 and BlackBerry Enterprise Service 10.1.x BlackBerry Device Service ended 10 Feb 2014. If BlackBerry Device service 6.2 or BlackBerry Enterprise Service 10.1.x BlackBerry Device Service are installed on a system, this is a finding.

Fix: F-59845r1_fix

Upgrade BlackBerry Device service 6.2 or BlackBerry Enterprise Service 10.1.x BlackBerry Device Service systems to a supported MDM server.