Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

BlackBerry PlayBook OS V2.1 Security Technical Implementation Guide

V1R2 · · · Released 24 Oct 2014 · 31 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

Developed by BlackBerry Ltd. in coordination with DISA for use in the DoD. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.letterkenny.FSO.mbx.stig-customer-support-mailbox@mail.mil.
Sort by
b
BlackBerry PlayBook OS must retain the lock work space until the user reestablishes access using established identification and authentication procedures.
AC-11 - Medium - CCI-000056 - V-38703 - SV-50508r1_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000056
Version
PB21-00-000100
Vuln IDs
  • V-38703
Rule IDs
  • SV-50508r1_rule
The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identification and authentication procedures. A device lock is a temporary action taken when a user stops work but does not want to log out because of the temporary nature of the hiatus. During the device lock a publicly viewable pattern is visible on the associated display, hiding what was previously visible on the screen. Once invoked, the device lock shall remain in place until the user re-authenticates. No other system activity aside from re-authentication can unlock the system. The operating system must enforce a device lock function. This prevents others from gaining access to the device when not in the user's possession and accessing sensitive DoD information. The identification and authentication procedure configuration must be set by a Mobile Device Management (MDM) service and be sufficiently complex to protect sensitive data.
Checks: C-46271r1_chk

Navigate to "Options -> BlackBerry Balance" and select the Pencil icon. Ensure "Remove Password" button exists and is greyed out. Otherwise, this is a finding.

Fix: F-43657r1_fix

On BlackBerry Device Service, set "Password Required for Work Space" IT Policy rule to "Yes".

b
BlackBerry PlayBook OS must retain the device lock until the user reestablishes access using established identification and authentication procedures.
AC-11 - Medium - CCI-000056 - V-38704 - SV-50509r1_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000056
Version
PB21-00-000110
Vuln IDs
  • V-38704
Rule IDs
  • SV-50509r1_rule
The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identification and authentication procedures. A device lock is a temporary action taken when a user stops work but does not want to log out because of the temporary nature of the hiatus. During the device lock a publicly viewable pattern is visible on the associated display, hiding what was previously visible on the screen. Once invoked, the device lock shall remain in place until the user re-authenticates. No other system activity aside from re-authentication can unlock the system. The operating system must enforce a device lock function. This prevents others from gaining access to the device when not in the user's possession and accessing sensitive DoD information. The identification and authentication procedure configuration must be set by a Mobile Device Management (MDM) service and be sufficiently complex to protect sensitive data.
Checks: C-46272r1_chk

Navigate to "Options -> Security ->Password" and ensure "Enable Password" is set to "ON". Otherwise, this is a finding.

Fix: F-43658r1_fix

Navigate to "Options -> Security ->Password" and set "Enable Password" is set to "ON". Create a 4 digit passcode for the device lock.

b
BlackBerry PlayBook OS must lock the device after no more than 15 minutes of inactivity.
AC-11 - Medium - CCI-000057 - V-38705 - SV-50510r1_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000057
Version
PB21-00-000120
Vuln IDs
  • V-38705
Rule IDs
  • SV-50510r1_rule
The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identification and authentication procedures. A device lock is a temporary action taken when a user stops work but does not want to shut down because of the temporary nature of the hiatus. During the device lock a publicly viewable pattern is visible on the associated display, hiding what was previously visible on the screen. Once invoked, the device lock shall remain in place until the user re-authenticates. No other system activity aside from re-authentication can unlock the system. The operating system must lock the device after the organization defined time period. This prevents others from gaining access to the device when not in the user's possession and accessing sensitive DoD information. A device lock mitigates the risk that an adversary can access data on an unattended mobile device but only after the maximum of 15 minute period of inactivity.
Checks: C-46273r1_chk

On BlackBerry Device Service, ensure "Security Timeout" IT Policy rule is set to "15 minutes". Otherwise, this is a finding.

Fix: F-43659r1_fix

On BlackBerry Device Service, set "Security Timeout" IT Policy rule to "15 minutes".

a
BlackBerry PlayBook OS must synchronize the internal clock at least once every 24 hours with an authoritative time server or the Global Positioning System.
AU-8 - Low - CCI-000160 - V-38706 - SV-50511r1_rule
RMF Control
AU-8
Severity
L
CCI
CCI-000160
Version
PB21-00-000130
Vuln IDs
  • V-38706
Rule IDs
  • SV-50511r1_rule
Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events. Periodically synchronizing internal clocks with an authoritative time source is needed in order to correctly correlate the timing of events that occur across the enterprise. The two authoritative time sources for mobile operating systems are an authoritative time server which is synchronized with redundant United States Naval Observatory (USNO) time servers as designated for the appropriate DoD network (NIPRNet or SIPRNet) or the Global Positioning System (GPS). Timestamps generated by the audit system in mobile operating systems shall include both date and time. The time may be expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.
Checks: C-46274r1_chk

Navigate to "Options -> Date & Time" and ensure "Set Date and Time Automatically" is set to "ON". Otherwise, this is a finding.

Fix: F-43660r1_fix

Navigate to "Options -> Date & Time" and set "Set Date and Time Automatically" is to "ON".

b
BlackBerry PlayBook OS must disallow the device unlock password from containing fewer than a specified minimum number of upper case alphabetic characters, lower case alphabetic characters, and numeric characters.
IA-5 - Medium - CCI-000192 - V-38707 - SV-50512r1_rule
RMF Control
IA-5
Severity
M
CCI
CCI-000192
Version
PB21-00-000140
Vuln IDs
  • V-38707
Rule IDs
  • SV-50512r1_rule
Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Setting minimum numbers of certain types of characters increases password complexity, and therefore makes it more difficult for an adversary to discover the password. In the DoD, the expectation is that the setting will range from a minimum of 1 to 2 upper case alphabetic characters in the device unlock password. The parameter should be selected based on a risk assessment that weighs factors, such as the environments the device will be located and operational requirements for users to access data in a timely manner.
Checks: C-46275r1_chk

1. Navigate to "Options -> BlackBerry Balance". 2. Select the Pencil icon. 3. Select "Change Password". 4. Select "Password Rules". 5. Verify the dialog states: "Password must contain at least one uppercase letter". Otherwise, this is a finding.

Fix: F-43661r1_fix

On BlackBerry Device Service: Set "Minimum Password Complexity" IT Policy rule to: "At least 1 uppercase letter, 1 lowercase letter, 1 number, and 1 special character".

b
BlackBerry PlayBook OS must disallow the device unlock password from containing fewer than a specified minimum number of lower case alphabetic characters.
IA-5 - Medium - CCI-000193 - V-38708 - SV-50513r1_rule
RMF Control
IA-5
Severity
M
CCI
CCI-000193
Version
PB21-00-000150
Vuln IDs
  • V-38708
Rule IDs
  • SV-50513r1_rule
Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Setting minimum numbers of certain types of characters increases password complexity, and therefore makes it more difficult for an adversary to discover the password. In the DoD, the expectation is that the setting will range from a minimum of 1 to 2 lower case characters in the device unlock password. The parameter should be selected based on a risk assessment that weighs factors, such as the environments the device will be located and operational requirements for users to access data in a timely manner.
Checks: C-46276r1_chk

1. Navigate to "Options -> BlackBerry Balance". 2. Select the Pencil icon. 3. Select "Change Password". 4. Select "Password Rules". 5. Verify the dialog states: "Password must contain at least one lowercase letter". Otherwise, this is a finding.

Fix: F-43662r1_fix

On BlackBerry Device Service: Set "Minimum Password Complexity" IT Policy rule to: "At least 1 uppercase letter, 1 lowercase letter, 1 number, and 1 special character".

b
BlackBerry PlayBook OS must disallow the device unlock password from containing fewer than a specified minimum number of numeric characters.
IA-5 - Medium - CCI-000194 - V-38709 - SV-50514r1_rule
RMF Control
IA-5
Severity
M
CCI
CCI-000194
Version
PB21-00-000160
Vuln IDs
  • V-38709
Rule IDs
  • SV-50514r1_rule
Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Setting minimum numbers of certain types of characters increases password complexity, and therefore makes it more difficult for an adversary to discover the password. In the DoD, the expectation is that the setting will range from a minimum of 1 to 2 numeric characters in the device unlock password. The parameter should be selected based on a risk assessment that weighs factors, such as the environments the device will be located and operational requirements for users to access data in a timely manner.
Checks: C-46277r1_chk

1. Navigate to "Options -> BlackBerry Balance". 2. Select the Pencil icon. 3. Select "Change Password". 4. Select "Password Rules". 5. Verify the dialog states: "Password must contain at least one number". Otherwise, this is a finding.

Fix: F-43663r1_fix

On BlackBerry Device Service: Set "Minimum Password Complexity" IT Policy rule to: "At least 1 uppercase letter, 1 lowercase letter, 1 number, and 1 special character".

a
BlackBerry PlayBook OS must enforce a maximum lifetime of 120 days for the device unlock password (password age).
IA-5 - Low - CCI-000199 - V-38710 - SV-50515r1_rule
RMF Control
IA-5
Severity
L
CCI
CCI-000199
Version
PB21-00-000170
Vuln IDs
  • V-38710
Rule IDs
  • SV-50515r1_rule
Changing passcodes regularly prevents an attacker who has compromised the password from re-using it to regain access. This is an unlikely scenario, but is addressed by setting a password expiration. The IA control only needs to be enforced in product level STIGs, if there is a need for such rotation based on the expected operational use of the device.
Checks: C-46278r1_chk

If the local command determines that there is not a need for password rotation based on the expected operational use of the device, this requirement does not apply. On BlackBerry Device Service: "Maximum Password Age" IT Policy rule must be set to 60 or less. Otherwise, this is a finding

Fix: F-43664r1_fix

On BlackBerry Device Service: Set "Maximum Password Age" IT Policy rule to: 60.

a
BlackBerry PlayBook OS must prohibit a user from reusing any of the last five previously used device unlock passwords.
IA-5 - Low - CCI-000200 - V-38711 - SV-50516r1_rule
RMF Control
IA-5
Severity
L
CCI
CCI-000200
Version
PB21-00-000180
Vuln IDs
  • V-38711
Rule IDs
  • SV-50516r1_rule
Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute force attacks. Remembering the prior five device unlock passwords enables the operating system from permitting those passwords to be reused, which increases the resistance against password attacks.
Checks: C-46279r1_chk

If the local command determines that there is not a need for password rotation based on the expected operational use of the device, this requirement does not apply. On BlackBerry Device Service: "Maximum Password History" IT Policy rule must be set to 5 or more. Otherwise, this is a finding.

Fix: F-43665r1_fix

On BlackBerry Device Service: Set "Maximum Password History" IT Policy rule to: 5.

b
BlackBerry PlayBook OS must enforce a minimum length for the work area password.
IA-5 - Medium - CCI-000205 - V-38712 - SV-50517r1_rule
RMF Control
IA-5
Severity
M
CCI
CCI-000205
Version
PB21-00-000190
Vuln IDs
  • V-38712
Rule IDs
  • SV-50517r1_rule
Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute force attacks. The ability to crack a password is a function of how many times an attempt to crack the password, how quickly the adversary can do each attempt, and the size of the password space. The longer the minimum length of the password is, the larger the password space.
Checks: C-46280r1_chk

1. Navigate to "Options -> BlackBerry Balance". 2. Select the Pencil icon. 3. Select "Change Password". 4. Select "Password Rules". 5. Verify the dialog states: "Password must be at least 8 characters long". Otherwise, this is a finding.

Fix: F-43666r1_fix

On BlackBerry Device Service: Set "Minimum Password Length" IT Policy rule to: 8.

a
BlackBerry PlayBook OS must enforce a minimum length for the device unlock password.
IA-5 - Low - CCI-000205 - V-38737 - SV-50542r1_rule
RMF Control
IA-5
Severity
L
CCI
CCI-000205
Version
PB21-00-000200
Vuln IDs
  • V-38737
Rule IDs
  • SV-50542r1_rule
Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute force attacks. The ability to crack a password is a function of how many times an attempt to crack the password, how quickly the adversary can do each attempt, and the size of the password space. The longer the minimum length of the password is, the larger the password space.
Checks: C-46282r1_chk

Lock the device by "Battery icon -> Lock". Unlock the device using the device lock password. If the unlock password is less than 4 characters, this is a finding.

Fix: F-43692r1_fix

Navigate to "Options -> Security -> Password -> Change Password". Input the old password under "Old Password". Under "New Password" and "Confirm Password" fields, input a new password that is greater or equal to 4 characters.

c
BlackBerry PlayBook OS must not permit mobile service carriers to have privileged access to the operating system or perform any function not directed by the user.
CM-7 - High - CCI-000381 - V-38738 - SV-50543r1_rule
RMF Control
CM-7
Severity
H
CCI
CCI-000381
Version
PB21-00-000210
Vuln IDs
  • V-38738
Rule IDs
  • SV-50543r1_rule
Permitting mobile service carriers access to the mobile operating system leaves the device vulnerable to breach from rogue elements within the carrier infrastructure. Mobile service carriers are not subject to the same personnel, operational, and technical controls as DoD organizations. For example, its employees in most cases do not have active DoD clearances. When a mobile service carrier must update software or configuration on a mobile device, these updates must come from a DoD approved source, which in many cases is the vendor of the MOS software. Preventing mobile service carrier access to mobile operating systems greatly mitigates the risk associated with this vulnerability. Research In Motion does not pre-install any software that would allow carriers to access or manipulate a BlackBerry device. As well, all applications available through App World are tested and monitored for malicious code, and applications must be signed by RIM to allow them to be installed on a BlackBerry Device, and these applications and their permissions must be acknowledged by the user or system administrator before they can be installed.
Checks: C-46283r1_chk

Navigate to "Options -> Security -> Application Permissions" and select each application listed, and ensure only DoD authorized permissions (Files, GPS Location, Camera, etc.) for this application is set to "Allowed" or "Prompt", with non-authorized permissions set to "Denied". Otherwise, this is a finding.

Fix: F-43693r1_fix

Navigate to "Options -> Security -> Application Permissions" and select each application listed, and set only DoD authorized permissions (Files, GPS Location, Camera, etc.) for this application to "Allowed" or "Prompt", with non-authorized permissions set to "Denied".

c
BlackBerry PlayBook OS must prevent a user from installing applications from an untrusted source (other than BlackBerry World) in the personal space.
SA-7 - High - CCI-000663 - V-38739 - SV-50544r1_rule
RMF Control
SA-7
Severity
H
CCI
CCI-000663
Version
PB21-00-000220
Vuln IDs
  • V-38739
Rule IDs
  • SV-50544r1_rule
The operating system must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what types of installations are prohibited (e.g., software whose pedigree with regard to being potentially malicious is unknown or suspect) by the organization. The installation and execution of unauthorized software on an operating system may allow the application to obtain sensitive information or further compromise the system. Preventing a user from installing unapproved applications mitigates this risk.
Checks: C-46284r1_chk

Navigate to "Options ->Security -> Development Mode" and ensure "Use Development Mode" is set to "OFF" and greyed out. Otherwise, this is a finding.

Fix: F-43694r1_fix

On BlackBerry Device Service: Set "Restrict Development Mode" IT Policy rule to "Yes".

b
BlackBerry PlayBook OS must only permit download of software from a DoD approved source (e.g., DoD operated mobile device application store or MDM server).
SA-7 - Medium - CCI-000663 - V-38740 - SV-50545r1_rule
RMF Control
SA-7
Severity
M
CCI
CCI-000663
Version
PB21-00-000230
Vuln IDs
  • V-38740
Rule IDs
  • SV-50545r1_rule
DoD can perform due diligence on sources of software to mitigate the risk that malicious software is introduced to those sources. Therefore, if software is downloaded from a DoD approved source, then it is less likely to be malicious than if it is downloaded from an unapproved source. To prevent access to unapproved sources, the operating system in most cases can be configured to disable user access to public application stores. However, in some cases, DoD may approve downloads directly from the OS vendor.
Checks: C-46285r1_chk

On BlackBerry Device Service: 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand "Software -> Applications". 2. Click "Manage applications". 3. Review the applications listed under "BlackBerry World Applications". If any applications are listed, this is a finding.

Fix: F-43695r1_fix

On BlackBerry Device Service: 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand "Software -> Applications". 2. Click "Manage applications". 3. Delete all applications under "BlackBerry World Applications".

b
BlackBerry PlayBook OSs Wi-Fi module must use EAP-TLS authentication when authenticating to DoD WLAN authentication servers.
IA-3 - Medium - CCI-000780 - V-38741 - SV-50546r1_rule
RMF Control
IA-3
Severity
M
CCI
CCI-000780
Version
PB21-00-000240
Vuln IDs
  • V-38741
Rule IDs
  • SV-50546r1_rule
Without strong mutual authentication a mobile device may connect to an unauthorized network. In many cases, the user may falsely believe that the device is connected to an authorized network and then provide authentication credentials and other sensitive information. EAP-TLS is strong mutual authentication leveraging a public key infrastructure. Its use greatly mitigates risk associated with authentication transactions.
Checks: C-46286r1_chk

Navigate to "Options -> Wi-Fi -> Saved Networks" and select a Wi-Fi profile used to connect to DoD WLAN. Ensure "Security Type" is set to "WPA Enterprise" or "WPA2 Enterprise" and "Security Sub Type" (EAP security method) is set to "TLS". These options should be greyed out. Otherwise, this is a finding.

Fix: F-43696r1_fix

On BlackBerry Device Service: Select the affected Wi-Fi Profile, and set "Security Type" to "WPA Enterprise" or "WPA2 Enterprise" and "Security Sub Type" to "TLS".

b
BlackBerry PlayBook OS must authenticate devices before establishing remote network (e.g., VPN) connections using bidirectional cryptographically based authentication between devices.
IA-3 - Medium - CCI-000780 - V-38742 - SV-50547r1_rule
RMF Control
IA-3
Severity
M
CCI
CCI-000780
Version
PB21-00-000250
Vuln IDs
  • V-38742
Rule IDs
  • SV-50547r1_rule
Without strong mutual authentication a mobile device may connect to an unauthorized network. In many cases, the user may falsely believe that the device is connected to an authorized network and then provide authentication credentials and other sensitive information. A strong bidirectional cryptographically based authentication method mitigates this risk.
Checks: C-46287r1_chk

1. Navigate to "Options -> Security -> VPN". 2. Select the enterprise VPN Profile (Work VPN Profiles have a briefcase icon on the right hand side). 3. Verify "Authentication Type" is set to a bidirectional cryptographically based authentication, and greyed out. Otherwise, this is a finding.

Fix: F-43697r1_fix

On BlackBerry Device Service: Create a VPN Profile with approved "Authentication Type" configured, and associate VPN Profile with IT Policy for the affected device.

b
BlackBerry PlayBook OS VPN client must employ DoD PKI approved mechanisms for authentication when connecting to DoD networks.
IA-3 - Medium - CCI-000780 - V-38743 - SV-50548r1_rule
RMF Control
IA-3
Severity
M
CCI
CCI-000780
Version
PB21-00-000260
Vuln IDs
  • V-38743
Rule IDs
  • SV-50548r1_rule
VPNs are vulnerable to attack if they are not supported by strong authentication. An adversary may be able gain access to network resources and sensitive information if they can compromise the authentication process. Common Access Card (CAC) authentication is a strong cryptographic two-factor authentication that greatly mitigates the risk of VPN authentication breaches. Other DoD approved PKI mechanisms provide similar levels of assurance.
Checks: C-46288r1_chk

Navigate to "Options -> Security -> VPN -> <VPN Profile>" and ensure "Authentication Type" is set to "PKI" or "XAUTH-PKI", and greyed out. Otherwise, this is a finding.

Fix: F-43698r1_fix

On BlackBerry Device Service, set select the applicable VPN Profile and set "Authentication Type" is to "PKI" or "XAUTH-PKI".

b
BlackBerry PlayBook OSs VPN client must use either IPSec or SSL/TLS when connecting to DoD networks.
SC-9 - Medium - CCI-001130 - V-38744 - SV-50549r1_rule
RMF Control
SC-9
Severity
M
CCI
CCI-001130
Version
PB21-00-000270
Vuln IDs
  • V-38744
Rule IDs
  • SV-50549r1_rule
Use of non-standard communications' protocols can affect both the availability and confidentiality of communications. IPSec and SSL/TLS are both well-known and tested protocols that provide strong assurance with respect to both IA and interoperability.
Checks: C-46289r1_chk

Navigate to "Options -> Security -> VPN". Select each VPN Profile used to connect to a DoD network, and ensure "Gateway Type" is set to a type which supports and utilizes IPSec and SSL/TLS and greyed out. Otherwise, this is a finding.

Fix: F-43699r1_fix

On BDS, select the affected VPN Profile for Edit, and set "Gateway Type" is to a type which supports and utilizes IPSec and SSL/TLS.

b
BlackBerry PlayBook OS must prohibit the use of non-DoD authorized instant messaging (IM) systems.
SC-15 - Medium - CCI-001154 - V-38746 - SV-50551r1_rule
RMF Control
SC-15
Severity
M
CCI
CCI-001154
Version
PB21-00-000290
Vuln IDs
  • V-38746
Rule IDs
  • SV-50551r1_rule
Many instant messaging systems have known vulnerabilities, some of which allow an adversary to install malware on the device. This malware can then be used to obtain sensitive information or further compromise DoD information systems. Restricting IM traffic to DoD authorized IM systems mitigates the risk of using IM technology.
Checks: C-46291r1_chk

On BlackBerry Device Service: 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand "Software -> Applications". 2. Click "Manage applications". 3. Review the listed IM systems. If any unauthorized IM systems are listed, this is a finding.

Fix: F-43701r1_fix

On BlackBerry Device Service: 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand "Software -> Applications". 2. Click "Manage applications". 3. Delete the unauthorized IM system application.

c
Only DoD PKI issued or DoD approved software authentication certificates may be installed on BlackBerry PlayBook OS.
SC-17 - High - CCI-001159 - V-38748 - SV-50553r1_rule
RMF Control
SC-17
Severity
H
CCI
CCI-001159
Version
PB21-00-000310
Vuln IDs
  • V-38748
Rule IDs
  • SV-50553r1_rule
If unauthorized software authentication certificates are installed on the device, then the operating system would not block malware signed by the entity that published these certificates. Such malware could be used to obtain sensitive DoD information or to further breach system security. Eliminating unapproved software authentication certificates greatly mitigates the risk of malware passing authentication controls.
Checks: C-46293r1_chk

Navigate to "Options -> Security -> Certificates". Select each certificate listed under "All Certificates". In "Certificate Details", ensure "Issued By" states appropriate DoD certificate authority, or the certificate itself has been approved by DoD. Otherwise, this is a finding.

Fix: F-43703r1_fix

On BlackBerry Device Service Server: Remove the corresponding .pem file from <drive>:\<shared_network_folder>\Shared\Certificates\<ENTERPRISE/VPN/WIFI/www> folder.

b
Only DoD PKI issued or DoD approved server authentication certificates may be installed on BlackBerry PlayBook OS.
SC-17 - Medium - CCI-001159 - V-38749 - SV-50554r1_rule
RMF Control
SC-17
Severity
M
CCI
CCI-001159
Version
PB21-00-000320
Vuln IDs
  • V-38749
Rule IDs
  • SV-50554r1_rule
If unauthorized device authentication certificates are installed on the device, there is the potential that the device may connect to a rogue device or network. Rogue devices can mimic the behavior of authorized equipment to trick the user into providing authentication credentials, which could then in turn be used to compromise DoD information and networks. Restricting device authentication certificates to an authorized list mitigates the risk of attaching to rogue devices and networks.
Checks: C-46294r1_chk

Navigate to "Options -&gt; Security -&gt; Certificates". Select each certificate listed under "All Certificates". In "Certificate Details", ensure "Issued By" states appropriate DoD certificate authority, or the certificate itself has been approved by DoD. Otherwise, this is a finding.

Fix: F-43704r1_fix

On BlackBerry Device Service Server: Remove the corresponding .pem file from <drive>:\<shared_network_folder>\Shared\Certificates\<ENTERPRISE/VPN/WIFI/www> folder.

b
BlackBerry PlayBook OS must prevent a user from using a browser that does not direct its traffic to a DoD proxy server.
SI-4 - Medium - CCI-001265 - V-38750 - SV-50555r1_rule
RMF Control
SI-4
Severity
M
CCI
CCI-001265
Version
PB21-00-000330
Vuln IDs
  • V-38750
Rule IDs
  • SV-50555r1_rule
Proxy servers can inspect traffic for malware and other signs of a security attack. Allowing a mobile device to access the public Internet without proxy server inspection forgoes the protection that the proxy server would otherwise provide. Malware downloaded onto the device could have a wide variety of malicious consequences, including loss of sensitive DoD information. Forcing traffic to flow through a proxy server greatly mitigates the risk of access to public Internet resources.
Checks: C-46295r1_chk

On BlackBerry Device Service: 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand "Software -&gt; Applications". 2. Click "Manage applications". 3. Review the listed browser applications. If any unauthorized browser applications are listed, this is a finding.

Fix: F-43705r1_fix

On BlackBerry Device Service: 1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand "Software -> Applications". 2. Click "Manage applications". 3. Delete the unauthorized browser application.

b
BlackBerry PlayBook OS must employ mobile device management services to centrally manage IT Policies
CM-6 - Medium - CCI-000370 - V-38752 - SV-50557r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000370
Version
PB21-00-000350
Vuln IDs
  • V-38752
Rule IDs
  • SV-50557r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46297r1_chk

1. Navigate to "Options -&gt; About -&gt; BlackBerry Balance". 2. Review the "IT Policy Name" assigned to the user. If different from the BDS policy, this is a finding.

Fix: F-43707r1_fix

On BlackBerry Device Service: 1. Navigate to "BlackBerry solution management -> User -> Manage users -> <affected user's device PIN>". 2. Select "Resend IT Policy to a device".

b
BlackBerry PlayBook OS must employ mobile device management services to centrally manage email settings
CM-6 - Medium - CCI-000370 - V-38753 - SV-50558r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000370
Version
PB21-00-000360
Vuln IDs
  • V-38753
Rule IDs
  • SV-50558r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46298r1_chk

To verify IT Policy: 1. Navigate to "Options -&gt; Accounts". 2. Verify that all required work accounts (with a briefcase icon) are present. Otherwise, this is a finding.

Fix: F-43708r1_fix

On BlackBerry Device Service: 1. Navigate to "BlackBerry solution management -> Profiles -> Manage email profiles". 2. Ensure all required profiles are listed. If not, create necessary profiles by navigating to "BlackBerry solution management -> Profiles -> Create email profiles". 3. Assign all required email profiles to the affected user, or a group containing the user.

b
BlackBerry PlayBook OS must employ mobile device management services to centrally manage Wi-Fi profiles
CM-6 - Medium - CCI-000370 - V-38754 - SV-50559r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000370
Version
PB21-00-000370
Vuln IDs
  • V-38754
Rule IDs
  • SV-50559r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46299r1_chk

1. Navigate to "Options -&gt; Wi-Fi -&gt; Saved Networks". 2. Verify that all required work Wi-Fi profiles (with a briefcase icon) are present. Otherwise, this is a finding.

Fix: F-43709r1_fix

On BlackBerry Device Service: 1. Navigate to "BlackBerry solution management -> Profiles -> Manage Wi-Fi Profiles". 2. Ensure all required profiles are listed. If not, create necessary profiles by navigating to "BlackBerry solution management -> Profiles -> Create Wi-Fi Profiles". 3. Assign all required Wi-Fi profiles to the affected user, or a group containing the user.

b
BlackBerry PlayBook OS must employ mobile device management services to centrally manage VPN profiles
CM-6 - Medium - CCI-000370 - V-38755 - SV-50560r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000370
Version
PB21-00-000380
Vuln IDs
  • V-38755
Rule IDs
  • SV-50560r1_rule
Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.
Checks: C-46300r1_chk

1. Navigate to "Options -&gt; Security -&gt; VPN". 2. Verify that all required work VPN profiles (with a briefcase icon) are present. Otherwise, this is a finding.

Fix: F-43710r1_fix

On BlackBerry Device Service: 1. Navigate to "BlackBerry solution management -> Profiles -> Manage VPN Profiles". 2. Ensure all required profiles are listed. If not, create necessary profiles by navigating to "BlackBerry solution management -> Profiles -> Create VPN Profiles". 3. Assign all required VPN profiles to the affected user, or a group containing the user.

b
BlackBerry PlayBook OS must encrypt all data on the mobile device using AES encryption (AES 128 bit encryption key length is the minimum requirement; AES 256 desired).
SC-28 - Medium - CCI-001200 - V-38756 - SV-50561r1_rule
RMF Control
SC-28
Severity
M
CCI
CCI-001200
Version
PB21-00-000390
Vuln IDs
  • V-38756
Rule IDs
  • SV-50561r1_rule
If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. AES encryption with appropriate key lengths provides assurance that the cryptography is adequate.
Checks: C-46301r1_chk

Navigate to "Options -&gt; Security -&gt; Encryption" and ensure it states: "Personal data and files are encrypted" and cannot be disabled. Otherwise, this is a finding.

Fix: F-43711r1_fix

On BlackBerry Device Service, set "Personal Space Data Encryption" IT Policy rule to "Yes".

b
BlackBerry PlayBook OS must prohibit wireless remote access connections except for personal hotspot service.
AC-17 - Medium - CCI-000066 - V-38757 - SV-50562r1_rule
RMF Control
AC-17
Severity
M
CCI
CCI-000066
Version
PB21-00-000400
Vuln IDs
  • V-38757
Rule IDs
  • SV-50562r1_rule
The device acts as a personal hotspot when it accepts remote connections on a local area network interface for the purposes of routing traffic to a wide area network interface. The most common implementation is to accept local area Wi-Fi connections to reach ISP service provided by a cellular data carrier. The objective is to ensure the remote devices are not able to access any applications, data, or other operating system functionality on the device. A core assumption of the MOS SRG is that mobile devices do not serve applications to remote devices. If remote access to applications and data were feasible, this would open up a wide variety of vulnerabilities in which an adversary with a remote wireless capability could breach system security. Precluding this possibility greatly mitigates the risk of such an attack.
Checks: C-46302r1_chk

Navigate to "Options -&gt; Storage &amp; Sharing" and ensure "Wi-Fi Sharing" is set to "OFF". Otherwise, this is a finding.

Fix: F-43712r1_fix

Navigate to "Options -> Storage & Sharing" and set "Wi-Fi Sharing" to "OFF".

b
BlackBerry PlayBook OS must not permit a user to disable the password-protected lock feature on the work space.
CM-6 - Medium - CCI-000366 - V-38758 - SV-50563r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
PB21-00-000410
Vuln IDs
  • V-38758
Rule IDs
  • SV-50563r1_rule
If the user is able to disable the password-protected lock feature, the user can change the configuration of the device to allow access without a password. The modified configuration would enable an adversary with access to the device to obtain DoD information and possibly other information resources on other systems. An operating system that does not allow a user to disable this feature mitigates the risk of this attack. In cases in which the mobile operating system relies on another application for protected data storage (e.g., if FIPS 140-2 validated encryption for unclassified use is not native to the device), then this requirement applies to both the device lock password and the password to the data storage application.
Checks: C-46303r1_chk

1. Navigate to "Options -&gt; BlackBerry Balance". 2. Select the Pencil icon. 3. Verify the "Remove Password" button is greyed out. Otherwise, this is a finding.

Fix: F-43713r1_fix

On BlackBerry Device Service: Set "Password Required for Work Space" IT Policy rule to: "Yes".

b
BlackBerry PlayBook OS must allow user to configure a non-complex 4 digit password for the personal space.
CM-6 - Medium - CCI-000366 - V-38759 - SV-50564r1_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
PB21-00-000420
Vuln IDs
  • V-38759
Rule IDs
  • SV-50564r1_rule
If the user is able to disable the password-protected lock feature, the user can change the configuration of the device to allow access without a password. The modified configuration would enable an adversary with access to the device to obtain DoD information and possibly other information resources on other systems. An operating system that does not allow a user to disable this feature mitigates the risk of this attack. In cases in which the mobile operating system relies on another application for protected data storage (e.g., if FIPS 140-2 validated encryption for unclassified use is not native to the device), then this requirement applies to both the device lock password and the password to the data storage application.
Checks: C-46304r1_chk

1. Navigate to "Options -&gt; Security -&gt; Password". 2. Verify "Enable Password" is set to "ON". Otherwise, this is a finding.

Fix: F-43714r1_fix

1. Navigate to "Options -> Security -> Password". 2. Set "Enable Password" is set to "ON". 3. Create a 4 digit passcode for the device.

c
BlackBerry PlayBook OS versions no longer supported by the manufacturer or vendor must not be installed on a device.
CM-6 - High - CCI-000366 - V-53891 - SV-68129r1_rule
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
PB21-00-000000
Vuln IDs
  • V-53891
Rule IDs
  • SV-68129r1_rule
Unsupported versions of the operating system do not contain new security-related features and security patches that address known vulnerabilities. Software or hardware no longer supported by the manufacturer or vendor are not maintained or updated for current vulnerabilities leaving them open to potential attack.
Checks: C-54741r2_chk

Manufacturer support for BlackBerry Playbook tablets ended April 2014. If BlackBerry Playbook tablets are in use, this is a finding.

Fix: F-58741r2_fix

Replace the BlackBerry PlayBook with an approved device.