Select any two versions of this STIG to compare the individual requirements
Select any old version/release of this STIG to view the previous requirements
Verify the Sentry is configured to enforce approved authorizations for logical access to information and system resources by employing identity-based, role-based, and attribute-based security policies. The Sentry system configured for ActiveSync, AppTunnel, and/or as a Kerberos Proxy ensures only authenticated and authorized apps and managed devices have access to backend resources. Refer to the Sentry 9.8.0 Guide for Core pages 20-21 for more information. 1. Log in to the Core Admin Portal. 2. Go to Service >> Sentry. 3. Verify the Sentry is configured with one or all the of the applicable services (ActiveSync, AppTunnel, or Kerberos Proxy). If no services are applied, this is a finding. 4. If Sentry is being used as an ActiveSync Proxy or AppTunnel, verify an Identity Certificate is configured for the Device Authentication Configuration in the Sentry Configuration and that CRL is enabled. If not, this is a finding. Refer to the Sentry 9.8.0 Guide on how to configure the specific Sentry Services. ActiveSync: Standalone Sentry for ActiveSync Email Section, AppTunnel: Standalone Sentry for AppTunnel Section Kerberos Proxy: Standalone Sentry for KKDCP Section. MobileIron UEM applies security, privacy, lockdown, and sync policies to registered devices. These policies ensure that devices can connect only if they comply to an organization’s security requirements. Standalone Sentry gets device posture and compliance information from MobileIron UEM, and allows access to Email via ActiveSync or backend systems based on the device posture. 1. Log in to the Core Admin Portal. 2. Go to Policies and Configurations >> Policies. 3. Verify the appropriate Lockdown and Security Policies are applied to the devices accessing systems behind the Sentry. If no policies are applied, this is a finding. By default, Sentry allows unregistered devices to access the ActiveSync server. Use this setting to change Sentry’s behavior to block unregistered devices from access if configuring Sentry for ActiveSync. 1. Log in to the Core Admin Portal. 2. Go to Services >> Sentry >> Preferences. 3. Verify "Yes" for Auto Block Unregistered Devices is applied. If not applied, this is a finding.
Configure the Sentry to enforce approved authorizations for logical access to information and system resources by employing identity-based, role-based, and/or attribute-based security policies. 1. Log in to the Core Admin Portal. 2. Go to Services >> Sentry. 3. Create one or all of the applicable Sentry Services: ActiveSync, AppTunnel, or Kerberos Proxy based on the Sentry use case. (Refer to the Sentry Guide on how to configure the specific Sentry Services. ActiveSync: Page 43; AppTunnel: Page 64; Kerberos Proxy: Page 92.) 4. If Sentry is being used as an ActiveSync Proxy or AppTunnel, configure an Identity Certificate for the Device Authentication Configuration in the Sentry Configuration and enable the CRL checkbox. 5. Save the Sentry configuration. MobileIron UEM applies security, privacy, lockdown, and sync policies to registered devices. These policies ensure that devices can connect only if they comply to an organization’s security requirements. Standalone Sentry gets device posture and compliance information from MobileIron UEM and allows access to email via ActiveSync or backend systems based on the device posture. 1. Log in to the Core Admin Portal. 2. Go to Policies and Configurations >> Policies. 3. Create or edit the Lockdown and Security Policies. 4. Ensure the policies are applied to devices accessing systems behind a Sentry if configuring Sentry for ActiveSync. By default, Sentry allows unregistered devices to access the ActiveSync server. Use this setting to change Sentry’s behavior to block unregistered devices from access if configuring Sentry for ActiveSync. 1. Log in to the Core Admin Portal. 2. Go to Services >> Sentry >> Preferences. 3. Change the Auto Block Unregistered Devices setting to "Yes". 4. Click "Save".
Verify the Sentry and MobileIron UEM is configured to enforce approved authorizations for controlling the flow of information within the network based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic. MobileIron UEM applies Configurations to devices/users based on manual or dynamic labels. Verify that Configurations that leverage Sentry such as Email, VPN, Docs@Work, or any backend service which leverage Sentry as a gateway are applied to the appropriate user groups via the configurable labels. If not, this is a finding. 1. Log in to the Core Admin Portal. 2. Go to Policies and Configurations >> Configurations. 3. Verify the Sentry related Configurations are applied to the devices accessing systems behind the Sentry. If Configurations are misassigned to the wrong label/user groups, this is a finding.
Configure the Sentry to enforce approved authorizations for controlling the flow of information within the network based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic via MI Core labels. 1. Log in to the Core Admin Portal. 2. Go to Policies and Configurations >> Configurations. 3. For Active Sync email use cases with Sentry, apply the Exchange or mail app configurations using the Sentry to devices via a label. 4. For App Tunnel use cases, apply app configurations using the Sentry to device via a label.
Verify the Sentry restricts or blocks harmful or suspicious communications traffic by controlling the flow of information between interconnected networks based on mobile device security posture reported by the MobileIron UEM. 1. Log in to the Core Admin Portal. 2. Go to Policies and Configurations >> Policies. 3. Verify the appropriate Security Policies are applied to the devices accessing systems behind the Sentry. 4. Click "Edit". 5. In the Access Control section of the policy, verify the Block Email and AppConnect apps compliance action is selected for the "when a compromised device is detected" control for the iOS and Android device operating systems sections. 6. Click "Cancel". If "when a compromised device is detected" control for the iOS and Android device operating systems is not selected in the Access control section, this is a finding.
Configure the Sentry to restrict or block harmful or suspicious communications traffic by controlling the flow of information between interconnected networks based on attribute- and content-based inspection of the source, destination, headers, and/or content of the communications traffic. 1. Log in to the Core Admin Portal. 2. Go to Policies and Configurations >> Policies. 3. Ensure the appropriate Security Policies are applied to the devices accessing systems behind the Sentry. 4. Click "Edit". 5. In the Access Control section of the policy, select the Block Email and AppConnect apps compliance for the “when a compromised device is detected” control for the iOS and Android device operating systems sections. 6. Click "Save". Refer to the Sentry 9.8.0 Guide on how to configure the specific Sentry Services.
Verify the Sentry uses encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions. On the Sentry CLI console, do the following: 1. SSH to Sentry Server from any SSH client. 2. Enter the administrator credentials established when Sentry was installed. 3. Enter "enable". 4. When prompted, enter the "enable secret" set when Sentry was installed. 5. Enter "show FIPS". 6. Verify "FIPS 140 mode is enabled" is displayed. If the Sentry Server does not report that FIPS mode is "enabled", this is a finding.
Configure the Sentry Server to use a FIPS 140-2-validated cryptographic module. On the Sentry console, do the following: 1. SSH to Sentry Server from any SSH client. 2. Enter the administrator credentials established when Sentry was installed. 3. Enter "enable". 4. When prompted, enter the "enable secret" set when Sentry was installed. 5. Enter "configure terminal". 6. Enter the following command to enable FIPS: FIPS 7. Enter the following command to proceed with the necessary reload: do reload 8. Enter "Yes" at save configuration modified prompt. 9. Enter "Yes" at proceed do reload.
Verify the Sentry uses encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions. On the Sentry CLI console, do the following: 1. SSH to Sentry Server from any SSH client. 2. Enter the administrator credentials set when Sentry was installed. 3. Enter "enable". 4. When prompted, enter the "enable secret" set when Sentry was installed. 5. Enter "show FIPS". 6. Verify "FIPS 140 mode is enabled" is displayed. If the Sentry Server does not report that FIPS mode is "enabled", this is a finding.
Configure the Sentry Server to use a FIPS 140-2-validated cryptographic module. On the Sentry console, do the following: 1. SSH to Sentry Server from any SSH client. 2. Enter the administrator credentials set when Sentry was installed. 3. Enter "enable". 4. When prompted, enter the "enable secret" set when Sentry was installed. 5. Enter "configure terminal". 6. Enter the following command to enable FIPS: FIPS 7. Enter the following command to proceed with the necessary reload: do reload 8. Enter "Yes" at save configuration modified prompt. 9. Enter "Yes" at proceed do reload.
Verify the Sentry is configured to implement the applicable required TLS settings in NIST PUB SP 800-52. 1. Log in to Sentry. 2. Go to Settings >> Services >> Sentry. 3. For each of the following configurations, follow the step 4 procedure: a. Incoming SSL configuration b. Outgoing SSL configuration c. UEM SSL configuration d. Access SSL configuration 4. Verify only TLS 1.2 is selected. If any other protocol is selected, this is a finding. For more information, go to the "Sentry 9.8.0 guide for Core" and refer the main section "Standalone Sentry Settings", which includes subsections on how TLS 1.2 is set as the default protocol: 1. Incoming SSL configuration 2. Outgoing SSL configuration 3. UEM SSL configuration 4. Access SSL configuration Sentry conforms to the NIST SP 800-52 TLS settings by setting TLS 1.2 by default.
Configure the Sentry to comply with applicable required TLS settings in NIST PUB SP 800-52. 1. Log in to Sentry. 2. Go to Settings >> Services >> Sentry. 3. For each of the following configurations, follow the step 4 procedure: a. Incoming SSL configuration b. Outgoing SSL configuration c. UEM SSL configuration d. Access SSL configuration 4. Select only TLS 1.2 and remove others if selected. 5. Click "Apply".
Verify the Sentry uses encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions. On the Sentry CLI console, do the following: 1. SSH to Sentry Server from any SSH client. 2. Enter the administrator credentials set when Sentry was installed. 3. Enter "enable". 4. When prompted, enter the "enable secret" set when Sentry was installed. 5. Enter "show FIPS". 6. Verify "FIPS 140 mode is enabled" is displayed. If the Sentry Server does not report that FIPS mode is "enabled", this is a finding.
Configure the Sentry Server to use a FIPS 140-2-validated cryptographic module. On the Sentry console, do the following: 1. SSH to Sentry Server from any SSH client. 2. Enter the administrator credentials set when Sentry was installed. 3. Enter "enable". 4. When prompted, enter the "enable secret" set when Sentry was installed. 5. Enter "configure terminal". 6. Enter the following command to enable FIPS: FIPS 7. Enter the following command to proceed with the necessary reload: do reload 8. Enter "Yes" at save configuration modified prompt. 9. Enter "Yes" at proceed do reload.
Verify the Sentry produces audit records containing information to establish what type of events occurred. 1. Log in to Sentry. 2. Go to Settings >> Syslog. 3. Verify a syslog server is configured. 4. Click on the syslog server(s) and in the "Modify Syslog" pop-up dialog, under the "Facility Type", verify the checkbox for "Audit" is selected. If the syslog server is not configured or "Audit" is not selected under "Modify Syslog", this is a finding. For more information, go to the "Sentry 9.8.0 Guide for Core" and refer to the section "Standalone Sentry Settings", which includes a subsection detailing the log representation format in "Audit log representation and format". The audit logs contain additional information on the type of events that occurred. Also included is date and timestamp, the source of the event, the location of the event, and the result of the action whether a success or failure.
Configure the Sentry to produce audit records containing information to establish what type of events occurred. 1. Log in to Sentry. 2. Go to Settings >> Syslog. 3. Configure a new Syslog Server if not already added. 4. Click on the syslog server(s) and in the "Modify Syslog"/"Add Syslog" pop-up dialog, under the "Facility Type", click the checkbox for "Audit". 5. Set the Admin State to "Enable". 6. Click "Apply".
Verify the Sentry produces audit records containing information to establish when (date and time) the events occurred. 1. Log in to Sentry. 2. Go to Settings >> Syslog. 3. Verify a syslog server is configured. 4. Click on the syslog server(s) and in the "Modify Syslog" pop-up dialog, under the "Facility Type", verify the checkbox for "Audit" is selected. If the syslog server is not configured or "Audit" is not selected under "Modify Syslog", this is a finding. For more information, go to the "Sentry 9.8.0 Guide for Core" and refer to the main section "Standalone Sentry Settings", which includes a subsection detailing the log representation format in "Audit log representation and format". The audit logs contain additional information on the type of events that occurred. Also included is the date and timestamp, the source of the event, the location of the event, and the result of the action whether a success/failure.
Configure the Sentry to produce audit records containing information to establish when (date and time) the events occurred. 1. Log in to Sentry. 2. Go to Settings >> Syslog. 3. Configure a new Syslog Server if not already added. 4. Click on the syslog server(s) and in the "Modify Syslog"/"Add Syslog" pop-up dialog, under the "Facility Type", click the checkbox for "Audit". 5. Set the Admin State to "Enable". 6. Click "Apply".
Verify the Sentry produces audit records containing information to establish where the events occurred. 1. Log in to Sentry. 2. Go to Settings >> Syslog. 3. Verify a syslog server is configured. 4. Click on the syslog server(s) and in the "Modify Syslog" pop-up dialog, under the "Facility Type", verify the checkbox for "Audit" is selected. If the syslog server is not configured or "Audit" is not selected under "Modify Syslog", this is a finding. For more information, go to the "Sentry 9.8.0 Guide for Core" and refer to the main section "Standalone Sentry Settings", which includes a subsection detailing the log representation format in "Audit log representation and format". The audit logs contain additional information on the type of events that occurred. Also included is the date and timestamp, the source of the event, the location of the event, the result of the action whether a success or failure.
Configure the Sentry to produce audit records containing information to establish where the events occurred. 1. Log in to Sentry. 2. Go to Settings >> Syslog. 3. Configure a new Syslog Server if not already added. 4. Click on the syslog server(s) and in the "Modify Syslog"/"Add Syslog" pop-up dialog, under the "Facility Type", click the checkbox for "Audit" . 5. Set the Admin State to "Enable". 6. Click "Apply".
Verify the Sentry produces audit records containing information to establish the source of the events. 1. Log in to Sentry. 2. Go to Settings >> Syslog. 3. Verify a syslog server is configured. 4. Click on the syslog server(s) and in the "Modify Syslog" pop-up dialog, under the "Facility Type", verify the checkbox for "Audit" is selected. If the syslog server is not configured or "Audit" is not selected under "Modify Syslog", this is a finding. For more information, go to the "Sentry 9.8.0 Guide for Core" and refer to the main section "Standalone Sentry Settings", which includes a subsection detailing the log representation format in "Audit log representation and format". The audit logs contain additional information on the type of events that occurred. Also included is date and timestamp, the source of the event, the location of the event, and the result of the action whether a success or failure.
Configure the Sentry to produce audit records containing information to establish the source of the events. 1. Log in to Sentry. 2. Go to Settings >> Syslog. 3. Configure a new Syslog Server if not already added. 4. Click on the syslog server(s) and in the "Modify Syslog"/"Add Syslog" pop-up dialog, under the "Facility Type", click the checkbox for "Audit". 5. Set the Admin State to "Enable". 6. Click "Apply".
Verify the Sentry produces audit records containing information to establish the outcome of the events. 1. Log in to Sentry. 2. Go to Settings >> Syslog. 3. Verify a syslog server is configured. 4. Click on the syslog server(s) and in the "Modify Syslog" pop-up dialog, under the "Facility Type", verify the checkbox for "Audit" is selected. If the syslog server is not configured or if "Audit" is not selected under "Modify Syslog", this is a finding. For more information, go to the "Sentry 9.8.0 Guide for Core" and refer the following main section "Standalone Sentry Settings" under which there is a sub-section detailing the log representation format in "Audit log representation and format". The audit logs contain additional information on the type of events that occurred. Also included is the date and timestamp, the source of the event, the location of the event, and the result of the action whether a success/failure.
Configure the Sentry to produce audit records containing information to establish the outcome of the events. 1. Log in to Sentry. 2. Go to Settings >> Syslog. 3. Configure a new Syslog Server if not already added. 4. Click on the syslog server(s) and in the "Modify Syslog"/"Add Syslog" pop-up dialog, under the "Facility Type", click the checkbox for "Audit". 5. Set the Admin State to "Enable". 6. Click "Apply".
Verify the Sentry produces audit records containing information to establish the outcome of the events. 1. Log in to Sentry. 2. Go to Settings >> Syslog. 3. Verify a syslog server is configured. 4. Click on the syslog server(s) and in the "Modify Syslog" pop-up dialog, under the "Facility Type", verify the checkbox for "Audit" is selected. If the syslog server is not configured or "Audit" is not selected under "Modify Syslog", this is a finding. For more information, go to the "Sentry 9.8.0 Guide for Core" and refer to the main section "Standalone Sentry Settings", which includes a subsection detailing the log representation format in "Audit log representation and format". The audit logs contain additional information on the type of events that occurred. Also included is date and timestamp, the source of the event, the location of the event, and the result of the action whether a success/failure.
1. Log in to Sentry. 2. Go to Settings >> Syslog. 3. Configure a new Syslog Server if not already added. 4. Click on the syslog server(s) and in the "Modify Syslog"/"Add Syslog" pop-up dialog, under the "Facility Type", click the checkbox for "Audit". 5. Set the Admin State to "Enable". 6. Click "Apply".
Verify the Sentry sends an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs. 1. Log in to Sentry. 2. Go to Monitoring >> Alert Configuration. 3. Verify "Send Notifications" is enabled. 4. Verify an email list containing the ISSM and SCA is input in the Email List. 5. Verify "Alert Notification Management" section is set to meet organizational requirements. If the "Alert Notification Management" section is not set to meet organizational requirements, this is a finding.
Configure the Sentry to send an alert to, at a minimum, the ISSO and SCA when an audit processing failure occurs. 1. Log in to Sentry. 2. Go to Monitoring >> Alert Configuration. 3. Configure "Send Notifications" to enabled. 4. Configure an email list containing the ISSM and SCA in the Email List. 5. Configure "Alert Notification Management" section is set to meet organizational requirements. Refer to the Sentry 9.8.0 Guide "Configuring Sentry alert notifications" section for more information.
View the configuration and vendor documentation of the Sentry application to find the minimum ports, protocols, and services required for Sentry operation. 1. Log in to Sentry System Manager. 2. Go to Security >> Access Control Lists >> ACLs. 3. Check all the ACLs to determine if the service restricted has an ACL already available. If it does not, this is a finding.
Disable ports, protocols, and/or services not required for Sentry operation. 1. Log in to the Standalone Sentry System Manager. 2. Go to Security >> Access Control Lists >> ACLs. 3. Check all the ACLs to determine if the service restricted has an ACL already available. If it does not, click "Add". 4. In the "Name" field, enter a name to identify the ACL. 5. In the "Description" field, enter text to clarify the purpose of the ACL. 6. Click "Save". 7. Select the new ACL created and click it, which should open a "Modify ACL" dialog box. 8. Click "Add" to add an access control entry (ACE) to the ACL. Each ACE consists of a combination of the network hosts and services configured for use in ACLs. 9. Use the following guidelines to complete the form: Source Network Destination Network Service Action - Select Permit or Deny from the drop-down list. Connections Per Minute 10. Click "Apply".
Verify the MobileIron Core configured with the Sentry is enabled with Active Directory or LDAP server. 1. Log in to the MobileIron Core MIFS portal. 2. Go to Services >> LDAP. 3. Verify an LDAP server is configured and enabled. If an LDAP server is not configured and enabled, this is a finding.
Ensure the MobileIron Core configured with the Sentry is enabled with Active Directory or LDAP server. 1. Log in to the MobileIron Core MIFS portal. 2. Go to Services >> LDAP. 3. Click "Add New". 4. Follow LDAP Configuration Wizard Prompts to enable an LDAP server (refer to the "Configuring LDAP Servers" section of the "Getting Started with MobileIron Core Guide" for more information). 5. Click "Save".
If the Sentry does not provide user authentication intermediary services, this is not applicable. Verify the Sentry is configured with a preestablished trust relationship and mechanisms with appropriate authorities that validate each user access authorization and privileges. If Sentry provides user authentication intermediary services for ActiveSync, verify them as follows: 1. In the MobileIron Core Admin Portal, go to Services >> Sentry. 2. Click the "Edit" icon next to Sentry, which opens the "Edit Standalone Sentry" dialog. 3. Determine if the fields in the form are configured for ActiveSync. 4. Look under "ActiveSync Server(s)". 5. Verify only the ActiveSync Servers' end users are on this list. If ActiveSync Servers' end users are not the only entities on this list, this is a finding. If Sentry provides user authentication intermediary services for AppTunnel, verify only the Servers that users should be authenticating to are specified in the Services list. 1. In the MobileIron Core Admin Portal, go to Services >> Sentry. 2. Select the "Edit" icon for an existing Standalone Sentry entry. 3. Review the Approved AppTunnel Services and verify only the Servers that users should be authenticating to are specified in the services list. If end users are able to access AppTunnel services they should not be accessing, this is a finding.
If user authentication intermediary services are provided, configure the Sentry to use a specific authentication server(s). For ActiveSync services: 1. In the MobileIron Core Admin Portal, go to Services >> Sentry. 2. Select Add New >> Standalone Sentry or click the "Edit" icon for an existing Standalone Sentry entry. 3. Complete the fields in the form for ActiveSync Configuration. 4. Configure approved ActiveSync servers. 5. Click "Save". For AppTunnel services: 1. In the MobileIron Core Admin Portal, go to Services >> Sentry. 2. Select Add New >> Standalone Sentry or click the "Edit" icon for an existing Standalone Sentry entry. 3. Complete the fields in the form for AppTunnel Configuration. 4. Configure approved AppTunnel services. 5. Click "Save".
Verify the MobileIron Core has a device-level password policy enforcing password or biometric and is applied to managed devices. This should be done by default. Verify the Sentry is configured for certificate based authentication. Verify the Sentry is set up to provide user authentication intermediary services. 1. In the MobileIron Core Portal, select Services >> Sentry. 2. Click the "Edit" icon for the Standalone Sentry entry. 3. In the "Device Authentication Configuration" section, select an option appropriate for this implementation. 4. Depending on the option selected, follow the instructions in one of the following sections to complete the configuration: - Group Certificate - Identity Certificate - Identity Certificate with Kerberos constrained delegation If Sentry is not configured for certificate-based authentication, this is a finding.
If user authentication intermediary services are provided, configure the Sentry to use multifactor authentication for network access to non-privileged accounts. 1. In the MobileIron Core Portal, select Services >> Sentry. 2. Click the "Edit" icon for the Standalone Sentry entry. 3. In the "Device Authentication Configuration" section, select an option appropriate for this implementation. 4. Depending on the option selected, follow the instructions in one of the following sections to complete the configuration: - Group Certificate Refer to "Configuring authentication using a group certificate" for next steps. - Identity Certificate Refer to "Configuring authentication using an identity certificate and Pass Through" for next steps. OR Refer to "Configuring authentication using an identity certificate and Kerberos constrained delegation" for next steps. For more information, in the "Sentry 9.8.0 Guide for Core" refer to the section "Device and Server Authentication", which includes the subsection "Configuring device and server authentication".
The Sentry is configured with TLS by default. The Sentry enables TLS 1.2 by default. To check the status: 1. Log in to Sentry. 2. Go to Settings >> Services >> Sentry. 3. For each of the following configurations, follow step 4: a. Incoming SSL configuration b. Outgoing SSL configuration c. UEM SSL configuration d. Access SSL configuration 4. In Protocols, verify TLS 1.2 is enabled. If TLS 1.2 is not enabled for each configuration, this is a finding. For more information, go to the "Sentry 9.8.0 Guide for Core" and refer to the main section "Standalone Sentry Settings", which includes subsections on how TLS 1.2 is set as the default protocol: 1. Incoming SSL configuration 2. Outgoing SSL configuration 3. UEM SSL configuration 4. Access SSL configuration Sentry conforms to the NIST SP 800-52 TLS settings by setting TLS 1.2 by default.
The Sentry is configured with TLS by default. To configure the Sentry with TLS 1.2: 1. Log in to Sentry. 2. Go to Settings >> Services >> Sentry. 3. Select each of the configurations listed below and follow steps 4 and 5: a. Incoming SSL configuration b. Outgoing SSL configuration c. UEM SSL Configuration d. Access SSL Configuration 4. In protocols, make TLS 1.2 enabled. 5. Apply the configuration and click "Save" in the top right corner.
The Sentry is configured with TLS by default. The Sentry enables TLS 1.2 by default. To check the status: 1. Log in to Sentry. 2. Go to Settings >> Services >> Sentry. 3. For each of the following configurations, follow step 4: a. Incoming SSL configuration b. Outgoing SSL configuration c. UEM SSL configuration d. Access SSL configuration 4. In Protocols, verify TLS 1.2 is enabled. If TLS 1.2 is not enabled for each configuration, this is a finding. For more information, go to the "Sentry 9.8.0 Guide for Core" and refer to the main section "Standalone Sentry Settings", which includes subsections on how TLS 1.2 is set as the default protocol: 1. Incoming SSL configuration 2. Outgoing SSL configuration 3. UEM SSL configuration 4. Access SSL configuration Sentry conforms to the NIST SP 800-52 TLS settings by setting TLS 1.2 by default.
The Sentry is configured with TLS by default. To configure the Sentry with TLS 1.2: 1. Log in to Sentry. 2. Go to Settings >> Services >> Sentry. 3. Select each of the configurations listed below and follow steps 4 and 5: a. Incoming SSL configuration b. Outgoing SSL configuration c. UEM SSL Configuration d. Access SSL Configuration 4. In protocols, make TLS 1.2 enabled. 5. Apply the configuration and click "Save" in the top right corner.
Verify the Sentry is configured with certificate-based authentication with the appropriate certificate field user mappings. 1. In the MobileIron Core Portal, select Services >> Sentry. 2. Click the "Edit" icon for the Standalone Sentry entry. 3. In the "Device Authentication Configuration" section, verify certificate mappings are configured in the "certificate mapping" field. If Sentry is not configured to map authenticated identities to the user accounts, this is a finding.
If PKI-based user authentication intermediary services are provided, configure the Sentry to map the authenticated identities to the user account. 1. In the MobileIron Core Portal, select Services >> Sentry. 2. Click the "Edit" icon the Standalone Sentry entry. 3. In the "Device Authentication Configuration" section, configure certificate mappings in the "certificate mapping" field (i.e., User UPN = Subject Alternative Name: NT Principal Name). 4. Click "Save".
1. Log in to the Core Admin Portal. 2. Go to Policies and Configurations >> Configurations. 3. Click on existing VPN Configuration for MobileIron Tunnel; verify "Connection Type" is set to "MobileIron Tunnel". 4. Go to "Custom Data" section at the bottom and find the following Key Value pair: "TcpIdleTmoMs" The default idle timeout for the session is 1 hour. Therefore, if the key value pair is missing, this is a finding. If the key value pair is present, verify the value is no greater than 900000 millisec (15 min). If key value pair is not present or is set to a value greater than 900000, this is a finding.
Configure Sentry to terminate all network connections associated with a communication session at 15 minutes of inactivity. 1. Log in to the Core Admin Portal. 2. Go to Policies and Configurations >> Configurations. 3. Click on existing VPN Configuration for MobileIron Tunnel; ensure "Connection Type" is set to "MobileIron Tunnel". 4. Go to "Custom Data" section at the bottom and find the following Key Value pair: "TcpIdleTmoMs" If the key value pair is present, set the value to 900000 millisec (15 min).
Verify Sentry offloads audit records onto a centralized log server. 1. Log in to Sentry. 2. Go to Settings >> Syslog. 3. Verify a syslog server is configured. If it is not configured, this is a finding. 4. Click on the syslog server(s) and in the "Modify Syslog" pop-up dialog, under the "Facility Type", verify the checkbox for "Audit" is selected. If Sentry is not configured to offload audit records, this is a finding. For more information, go to the "Sentry 9.8.0 Guide for Core" and refer to the main section "Standalone Sentry Settings", which includes a subsection detailing the log representation format in "Audit log representation and format". The audit logs contain additional information on the type of events that occurred. Also included is date and timestamp, the source of the event, the location of the event, and the result of the action whether success/failure.
Configure the ALG to offload audit records onto a centralized log server. 1. Log in to Sentry. 2. Go to Settings >> Syslog. 3. Click on the syslog server(s) and in the "Modify Syslog" pop-up dialog, under the "Facility Type", click the checkbox for "Audit". For more information, go to the "Sentry 9.8.0 Guide for Core" and refer to the main section "Standalone Sentry Settings", which includes a subsection detailing the log representation format in "Audit log representation and format". The audit logs contain additional information on the type of events that occurred. Also included is date and timestamp, the source of the event, the location of the event, and the result of the action whether a success/failure.
If the Sentry does not provide user authentication intermediary services, this is not applicable. Verify the Sentry implements multifactor authentication for remote access to nonprivileged accounts. Verify the MobileIron Core has a device-level password policy enforcing password or biometric and is applied to managed devices. This should be done by default. Verify the Sentry is configured for certificate-based authentication. If the Sentry is set up as an intermediary service for backend resources: 1. In the MobileIron Core Portal, select Services >> Sentry. 2. Click the "Edit" icon for the Standalone Sentry entry. 3. In the "Device Authentication Configuration" section, select an option appropriate for this implementation. 4. Depending on the option selected, follow the instructions in one of the following sections to verify the configuration is correct: - Group Certificate - Identity Certificate - Identity Certificate with Kerberos constrained delegation If the "Device Authentication Configuration" is not set up correctly, this is a finding.
If user authentication intermediary services are provided, configure the Sentry to implement multifactor authentication for remote access to nonprivileged accounts such that one of the factors is provided by a device separate from the system gaining access. 1. In the MobileIron Core Portal, select Services >> Sentry. 2. Click the "Edit" icon for the Standalone Sentry entry. 3. In the "Device Authentication Configuration" section, select an option appropriate for this implementation. 4. Depending on the option selected, follow the instructions in one of the following section to complete the configuration: - Group Certificate Refer to "Configuring authentication using a group certificate" for next steps. - Identity Certificate Refer to "Configuring authentication using an identity certificate and Pass Through" for next steps. OR Refer to "Configuring authentication using an identity certificate and Kerberos constrained delegation" for next steps. For more information, in the "Sentry 9.8.0 Guide for Core", refer to the main section "Device and Server Authentication", which contains the subsection "Configuring device and server authentication".
Verify Sentry only accepts end entity certificates issued by DoD PKI or DoD-approved PKI CAs for the establishment of protected sessions. Verify the MobileIron Core has a device-level password policy enforcing password or biometric and is applied to managed devices. This should be done by default. Verify the Sentry is configured for certificate-based authentication: Verify the Sentry is set up to provide user authentication intermediary services: 1. In the MobileIron Core Portal, select Services >> Sentry. 2. Click the "Edit" icon for the Standalone Sentry entry. 3. In the "Device Authentication Configuration" section, select an option appropriate for this implementation. 4. Depending on the option selected, follow the instructions in one of the following sections to complete the configuration: - Group Certificate - Identity Certificate - Identity Certificate with Kerberos constrained delegation 5. Select "View Certificate" and verify DoD and/or DoD-approved CA certificates are presented. If non-DoD-approved certificates are used, this is a finding.
If PKI-based user authentication intermediary services are provided, configure Sentry to only accept end entity certificates issued by DoD PKI or DoD-approved PKI CAs for the establishment of protected sessions. 1. In the MobileIron Core Portal, select Services >> Sentry. 2. Click the "Edit" icon for the Standalone Sentry entry. 3. In the "Device Authentication Configuration" section, select an option appropriate for your implementation. 4. Depending on the option selected, follow the instructions in one of the following sections to complete the configuration: - Group Certificate Refer to "Configuring authentication using a group certificate" for next steps. - Identity Certificate Refer to "Configuring authentication using an identity certificate and Pass Through" for next steps. OR Refer to "Configuring authentication using an identity certificate and Kerberos constrained delegation" for next steps. For more information, in the "Sentry 9.8.0 Guide for Core", refer to the main section "Device and Server Authentication", which contains the subsection "Configuring device and server authentication". 5. From the "Upload Certificate" option, load the DoD and/or DoD-approved CA certificates.
Verify the Sentry is implemented behind a load balancer to limit the effects of known and unknown types of DoS attacks. If the device is not implemented behind a load balancer to limit the effects of known and unknown types of DoS attacks, this is a finding.
Configure the Sentry to be implemented behind a load balancer to limit the effects of known and unknown types of DoS attacks.
Verify only approved network routes are added to the Sentry. 1. Log in to Sentry System Manager. 2. Go to Settings >> Network >> Routes. 3. Verify only approved network routes are configured. If non-approved network routes are configured, this is a finding.
Configure only approved network routes on the Sentry. 1. Log in to Sentry System Manager. 2. Go to Settings >> Routes. 3. Select any unauthorized network routes in the list and click "Delete". 4. Click "Add" to add approved routes.
Verify the Sentry reveals error messages only to the ISSO, ISSM, and SCA. 1. Log in to Sentry. 2. Go to Monitoring >> Alert Configuration. 3. Verify "Send Notifications" is enabled. 4. Verify an email list containing the ISSO, ISSM, and SCA is input in the Email List. 5. Verify the "Alert Notification Management" section is set to meet organizational requirements. If Sentry is not configured to reveal error messages only to the ISSO, ISSM, and SCA, this is a finding.
Configure the Sentry to reveal error messages only to the ISSO, ISSM, and SCA. 1. Log in to Sentry. 2. Go to Monitoring >> Alert Configuration. 3. Enable "Send Notifications". 4. Configure an email list containing the ISSO, ISSM, and SCA in the Email List. 5. Configure the "Alert Notification Management" section to meet organizational requirements.
Verify the Sentry uses encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions. On the Sentry CLI console, do the following: 1. SSH to Sentry Server from any SSH client. 2. Enter the administrator credentials set when Sentry was installed. 3. Enter "enable". 4. When prompted, enter the "enable secret" set when Sentry was installed. 5. Enter "show FIPS". 6. Verify "FIPS 140 mode is enabled" is displayed. If the Sentry Server does not report that FIPS mode is "enabled", this is a finding.
Configure the Sentry Server to use a FIPS 140-2 validated cryptographic module. On the Sentry console, do the following: 1. SSH to Sentry Server from any SSH client. 2. Enter the administrator credentials set when Sentry was installed. 3. Enter "enable". 4. When prompted, enter the "enable secret" set when Sentry was installed. 5. Enter "configure terminal". 6. Enter the following command to enable FIPS: FIPS 7. Enter the following command to proceed with the necessary reload: do reload 8. Enter "Yes" at saved configuration modified prompt. 9. Enter "Yes" at proceed do reload.
Verify the Sentry uses encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions. On the Sentry CLI console, do the following: 1. SSH to Sentry Server from any SSH client. 2. Enter the administrator credentials set when Sentry was installed. 3. Enter "enable". 4. When prompted, enter the "enable secret" set when Sentry was installed. 5. Enter "show FIPS". 6. Verify "FIPS 140 mode is enabled" is displayed. If the Sentry Server does not report that FIPS mode is "enabled", this is a finding.
Configure the Sentry Server to use a FIPS 140-2-validated cryptographic module. On the Sentry console, do the following: 1. SSH to Sentry Server from any SSH client. 2. Enter the administrator credentials set when Sentry was installed. 3. Enter "enable". 4. When prompted, enter the "enable secret" set when Sentry was installed. 5. Enter "configure terminal". 6. Enter the following command to enable FIPS: FIPS 7. Enter the following command to proceed with the necessary reload: do reload 8. Enter "Yes" at saved configuration modified prompt. 9. Enter "Yes" at proceed do reload.
Verify the Sentry uses encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions. On the Sentry CLI console, do the following: 1. SSH to Sentry Server from any SSH client. 2. Enter the administrator credentials set when Sentry was installed. 3. Enter "enable". 4. When prompted, enter the "enable secret" set when Sentry was installed. 5. Enter "show FIPS". 6. Verify "FIPS 140 mode is enabled" is displayed. If the Sentry Server does not report that FIPS mode is "enabled", this is a finding.
Configure the Sentry Server to use a FIPS 140-2-validated cryptographic module. On the Sentry console, do the following: 1. SSH to Sentry Server from any SSH client. 2. Enter the administrator credentials set when Sentry was installed. 3. Enter "enable". 4. When prompted, enter the "enable secret" set when Sentry was installed. 5. Enter "configure terminal". 6. Enter the following command to enable FIPS: FIPS 7. Enter the following command to proceed with the necessary reload: do reload 8. Enter "Yes" at saved configuration modified prompt. 9. Enter "Yes" at proceed do reload.
Verify the Sentry produces audit records onto a centralized log server in real time. 1. Log in to Sentry. 2. Go to Settings >> Syslog. 3. Verify a syslog server is configured. If it is not configured, this is a finding. 4. Click on the syslog server(s) and in the "Modify Syslog" pop-up dialog, under the "Facility Type", verify the checkbox for "Audit" is selected. If it is not selected, this is a finding. For more information, go to the "Sentry 9.8.0 Guide for Core" and refer to the main section "Standalone Sentry Settings", which includes a subsection detailing the log representation format in "Audit log representation and format". The audit logs contain additional information on the type of events that occurred. Also included is date and timestamp, the source of the event, the location of the event, and the result of the action whether a success/failure.
1. Log in to Sentry. 2. Go to Settings >> Syslog. 3. Configure a new Syslog Server if not already added. 4. Click on the syslog server(s) and in the "Modify Syslog"/"Add Syslog" pop-up dialog, under the "Facility Type", click the checkbox for "Audit". 5. Set the Admin State to "Enable". 6. Click "Apply".