Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

Samsung Android OS 17 with Knox 3.x COPE Security Technical Implementation Guide

V1R1 · · · Released 28 Jul 2026 · 48 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

This Security Technical Implementation Guide is published as a tool to improve the security of Department of War (DoW) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
Sort by
b
Samsung Android 17 must allow only the administrator (EMM) to install/remove DoW root and intermediate PKI certificates.
CM-6 - Medium - CCI-000366 - V-286399 - SV-286399r1256282_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-003800
Vuln IDs
  • V-286399
Rule IDs
  • SV-286399r1256282_rule
DoW root and intermediate PKI certificates are used to verify the authenticity of PKI certificates of users and web services. If the user is allowed to remove root and intermediate certificates, the user could allow an adversary to falsely sign a certificate in such a way that it could not be detected. Restricting the ability to remove DoW root and intermediate PKI certificates to the administrator mitigates this risk. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91081r1256280_chk

COPE: Review the configuration to determine if the Samsung Android device's work profile is preventing the user from removing DoW root and intermediate PKI certificates. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the work profile restrictions, verify "Configure credentials" is set to "Disallow". On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> View security certificates. 2. In the System tab, verify no listed certificate in the work profile can be untrusted. 3. In the User tab, verify no listed certificate in the work profile can be removed. If on the management tool the device "Configure credentials" is not set to "Disallow", or on the Samsung Android device a certificate can be untrusted or removed, this is a finding. COBO: Review the configuration to determine if the Samsung Android devices are preventing users from removing DoW root and intermediate PKI certificates. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions, verify "Configure credentials" is set to "Disallow". On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> View security certificates. 2. In the System tab, verify no listed certificate in the device can be untrusted. 3. In the User tab, verify no listed certificate in the device can be removed. If on the management tool in the device restrictions "Configure credentials" is not set to "Disallow", or on the Samsung Android device a certificate can be untrusted or removed, this is a finding.

Fix: F-90986r1256281_fix

COPE: Configure the Samsung Android device's work profile to prevent users from removing DoW root and intermediate PKI certificates. On the management tool, in the work profile restrictions, set "Configure credentials" to "Disallow". COBO: Configure the Samsung Android device to prevent the user from removing DoW root and intermediate PKI certificates. On the management tool, in the device restrictions, set "Configure credentials" to "Disallow".

a
Samsung Android 17 must [DoW-restricted selection: Allow the user to choose whether to accept the certificate in these cases, not accept the certificate] when it cannot establish a connection to determine the validity of a certificate.
IA-5 - Low - CCI-000185 - V-286403 - SV-286403r1256811_rule
RMF Control
IA-5
Severity
L
CCI
CCI-000185
Version
KNOX-17-004200
Vuln IDs
  • V-286403
Rule IDs
  • SV-286403r1256811_rule
Certificate-based security controls depend on the ability of the system to verify the validity of a certificate. If the MOS were to accept an invalid certificate, it could take unauthorized actions, resulting in unanticipated outcomes. At the same time, if the MOS were to disable functionality when it could not determine the validity of the certificate, this could result in a denial of service. Therefore, the ability to provide exceptions is appropriate to balance the tradeoff between security and functionality. Always accepting certificates when they cannot be determined to be valid is the most extreme exception policy and is not appropriate in the DoW context. Involving an administrator or user in the exception decision mitigates this risk to some degree. SFR ID: FIA_X509_EXT.2.2/FP for X.509
Checks: C-91085r1256283_chk

Verify requirement KNOX-17-009200 (Common Criteria mode) has been implemented. If "Common Criteria mode" has not been implemented, this is a finding.

Fix: F-90990r1255858_fix

Implement "Common Criteria mode" (refer to requirement KNOX-17-009200).

b
Samsung Android 17 must be configured to enforce a minimum password length of six characters.
Medium - CCI-004066 - V-286413 - SV-286413r1256292_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
KNOX-17-005200
Vuln IDs
  • V-286413
Rule IDs
  • SV-286413r1256292_rule
Password strength is a measure of the effectiveness of a password in resisting guessing and brute force attacks. The ability to crack a password is a function of how many attempts an adversary is permitted, how quickly an adversary can do each attempt, and the size of the password space. The longer the minimum length of the password is, the larger the password space. Having a too-short minimum password length significantly reduces password strength, increasing the chance of password compromise and resulting in device and data compromise. SFR ID: FMT_SMF_EXT.1.1 #1
Checks: C-91095r1256290_chk

Review the configuration to determine if the Samsung Android device is enforcing a minimum password length of six characters. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device password policies, verify "minimum password length" is set to "6". On the Samsung Android device: 1. Open Settings >> Lock screen and AOD >> Screen lock and biometrics. 2. Enter current password. 3. Tap "PIN". 4. Verify the text "PIN must contain at least", followed by a value of at least "6 digits", appears above the PIN entry. If on the management tool "minimum password length" is not set to "6", or on the Samsung Android device the text "PIN must contain at least" is followed by a value of less than "6 digits", this is a finding.

Fix: F-91000r1256291_fix

Configure the Samsung Android device to enforce a minimum password length of six characters. On the management tool, in the device password policies, set "minimum password length" to "6".

b
Samsung Android 17 must be configured to not allow passwords that include more than four repeating or sequential characters.
Medium - CCI-004066 - V-286414 - SV-286414r1256295_rule
RMF Control
Severity
M
CCI
CCI-004066
Version
KNOX-17-005300
Vuln IDs
  • V-286414
Rule IDs
  • SV-286414r1256295_rule
Password strength is a measure of the effectiveness of a password in resisting guessing and brute force attacks. Passwords that contain repeating or sequential characters are significantly easier to guess than those that do not contain repeating or sequential characters. Therefore, disallowing repeating or sequential characters increases password strength and decreases risk. SFR ID: FMT_SMF_EXT.1.1 #1
Checks: C-91096r1256293_chk

Review the configuration to determine if the Samsung Android devices are disallowing passwords containing more than four repeating or sequential characters. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device password policies, verify "minimum password quality" is set to "Numeric(Complex)" or better. On the Samsung Android device: 1. Open Settings >> Lock screen and AOD >> Screen lock and biometrics. 2. Enter current password. 3. Tap "PIN". 4. Verify PINs with more than four repeating or sequential numbers are not accepted. If on the management tool "minimum password quality" is not set to "Numeric(Complex)" or better, or on the Samsung Android device a password with more than four repeating or sequential numbers is accepted, this is a finding.

Fix: F-91001r1256294_fix

Configure the Samsung Android devices to disallow passwords containing more than four repeating or sequential characters. On the management tool, in the device password policies, set "minimum password quality" to "Numeric(Complex)" or better. If the management tool does not support "Numeric(Complex)" but does support "Numeric", Knox Platform for Enterprise (KPE) can be used to achieve STIG compliance. In this case, configure this policy with value "Numeric" and use an additional KPE policy (innately by the management tool or via KSP) "Maximum Numeric Sequence Length" with value "4".

b
Samsung Android 17 must be configured to lock the display after 15 minutes (or less) of inactivity.
AC-11 - Medium - CCI-000057 - V-286415 - SV-286415r1256298_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000057
Version
KNOX-17-005400
Vuln IDs
  • V-286415
Rule IDs
  • SV-286415r1256298_rule
The screen lock timeout must be set to a value that helps protect the device from unauthorized access. Having a too-long timeout would increase the window of opportunity for adversaries who gain physical access to the mobile device through loss, theft, etc. Such devices are much more likely to be in an unlocked state when acquired by an adversary, thus granting immediate access to the data on the mobile device. The maximum timeout period of 15 minutes has been selected to balance functionality and security; shorter timeout periods may be appropriate depending on the risks posed to the mobile device. SFR ID: FMT_SMF_EXT.1.1 #2
Checks: C-91097r1256296_chk

Review the configuration to determine if the Samsung Android devices are locking the device display after 15 minutes (or less) of inactivity. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device password policies, verify "max time to screen lock" is set to "15 minutes" or less. On the Samsung Android device: 1. Open Settings >> Lock screen and AOD. 2. Verify "Secure lock settings" is present and tap it. 3. Enter current password. 4. Tap "Auto lock when screen turns off". 5. Verify the listed timeout values are 15 minutes or less. If on the management tool "max time to screen lock" is not set to "15 minutes" or less, or on the Samsung Android device "Secure lock settings" is not present and the listed screen timeout values include durations of more than 15 minutes, this is a finding.

Fix: F-91002r1256297_fix

Configure the Samsung Android devices to lock the device display after 15 minutes (or less) of inactivity. On the management tool, in the device password policies, set "max time to screen lock" to "15 minutes" or less. A device password must be set for "max time to screen lock" to become active.

b
Samsung Android 17 must be configured to enable a screen-lock policy that will lock the display after a period of inactivity - Disable trust agents.
IA-2 - Medium - CCI-000765 - V-286416 - SV-286416r1256301_rule
RMF Control
IA-2
Severity
M
CCI
CCI-000765
Version
KNOX-17-005500
Vuln IDs
  • V-286416
Rule IDs
  • SV-286416r1256301_rule
The screen lock timeout must be set to a value that helps protect the device from unauthorized access. Having a too-long timeout would increase the window of opportunity for adversaries who gain physical access to the mobile device through loss, theft, etc. Such devices are much more likely to be in an unlocked state when acquired by an adversary, thus granting immediate access to the data on the mobile device. The maximum timeout period of 15 minutes has been selected to balance functionality and security; shorter timeout periods may be appropriate depending on the risks posed to the mobile device. SFR ID: FMT_SMF_EXT.1.1 #2
Checks: C-91098r1256299_chk

Review the configuration to determine if the Samsung Android devices are disabling Trust Agents. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions, verify "Trust Agents" are set to "Disable". On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> Trust Agents. 2. Verify all listed trust agents are disabled and cannot be enabled. If a trust agent is not disabled in the list, verify for that trust agent, all of its listed trustlets are disabled and cannot be enabled. If on the management tool "Trust Agents" are not set to "Disable", or on the Samsung Android device a "Trust Agent" or "Trustlet" can be enabled, this is a finding. Note: If the management tool has been correctly configured but a trust agent is still enabled, configure the "List of approved apps listed in managed Google Play" to disable it; refer to KNOX-17-005800. Exception: Trust agents may be used if the authorizing official (AO) allows a screen lock timeout after four hours (or more) of inactivity. This may be applicable to tactical use cases.

Fix: F-91003r1256300_fix

Configure the Samsung Android devices to disable trust agents. On the management tool, in the device restrictions, set "Trust Agents" to "Disable".

b
Samsung Android 17 must be configured to not allow more than 10 consecutive failed authentication attempts.
AC-7 - Medium - CCI-000044 - V-286417 - SV-286417r1256304_rule
RMF Control
AC-7
Severity
M
CCI
CCI-000044
Version
KNOX-17-005600
Vuln IDs
  • V-286417
Rule IDs
  • SV-286417r1256304_rule
The more attempts an adversary has to guess a password, the more likely the adversary will enter the correct password and gain access to resources on the device. Setting a limit on the number of attempts mitigates this risk. Setting the limit at 10 or less gives authorized users the ability to make a few mistakes when entering the password but still provides adequate protection against dictionary or brute force attacks on the password. SFR ID: FMT_SMF_EXT.1.1 #2
Checks: C-91099r1256302_chk

Review the configuration to determine if the Samsung Android devices are allowing only 10 or fewer consecutive failed authentication attempts. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device password policies, verify "max password failures for local wipe" is set to "10" attempts or less. On the Samsung Android device: 1. Open Settings >> Lock screen and AOD. 2. Verify "Secure lock settings" is present and tap it. 3. Enter current password. 4. Verify "Auto factory reset" is grayed out, and cannot be configured. Note: When "Auto factory reset" is grayed out, this indicates the Administrator (MDM) is in control of the setting to wipe the device after 10 or fewer consecutive failed authentication attempts. If on the management tool "max password failures for local wipe" is not set to "10" attempts or less, or on the Samsung Android device the "Auto factory reset" menu can be configured, this is a finding.

Fix: F-91004r1256303_fix

Configure the Samsung Android devices to allow only 10 or fewer consecutive failed authentication attempts. On the management tool, in the device password policies, set "max password failures for local wipe" to "10" attempts or fewer. A device password must be set for "max password failures for local wipe" to become active.

b
Samsung Android 17 must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [selection: DoW-approved commercial app repository, MDM server, mobile application store].
CM-6 - Medium - CCI-000366 - V-286418 - SV-286418r1256307_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-005700
Vuln IDs
  • V-286418
Rule IDs
  • SV-286418r1256307_rule
Forcing all applications to be installed from authorized application repositories can prevent unauthorized and malicious applications from being installed and executed on mobile devices. Allowing such installations and executions could cause a compromise of DoW data accessible by these unauthorized/malicious applications. SFR ID: FMT_SMF_EXT.1.1 #8
Checks: C-91100r1256305_chk

Review the configuration to determine if the Samsung Android devices are disabling unauthorized application repositories. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the work profile restrictions, verify "installs from unknown sources globally" is set to "Disallow". On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> Install unknown apps. 2. Verify that each app listed has the status "Disabled" under the app name or no apps are listed. On COPE devices, confirm this in both the "Personal" and "Work" tabs. If on the management tool "installs from unknown sources globally" is not set to "Disallow", or on the Samsung Android device an app is listed with a status other than "Disabled", this is a finding.

Fix: F-91005r1256306_fix

Configure the Samsung Android devices to disable unauthorized application repositories. COPE: On the management tool, in the work profile restrictions, set "installs from unknown sources globally" to "Disallow". COBO: On the management tool, in the device restrictions, set "installs from unknown sources globally" to "Disallow". Note: Google Play must not be disabled. Disabling Google Play will cause system instability and critical updates will not be received.

b
Samsung Android 17 must be configured to enforce an application installation policy by specifying an application allow list that restricts applications by the following characteristic: Names.
CM-7 - Medium - CCI-001764 - V-286419 - SV-286419r1256815_rule
RMF Control
CM-7
Severity
M
CCI
CCI-001764
Version
KNOX-17-005800
Vuln IDs
  • V-286419
Rule IDs
  • SV-286419r1256815_rule
The application allow list, in addition to controlling the installation of applications on the MD, must control user access/execution of all core and preinstalled applications, or the MD must provide an alternate method of restricting user access/execution to core and preinstalled applications. Core application: Any application integrated into the OS by the OS or MD vendor. Preinstalled application: Additional noncore applications included in the OS build by the OS vendor, MD vendor, or wireless carrier. Requiring all authorized applications to be in an application allow list prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the allow list. Failure to configure an application allow list properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DoW data accessible by these applications. The application allow list, in addition to controlling the installation of applications on the MD, must control user access/execution of all core applications (included in the OS by the OS vendor) and preinstalled applications (provided by the MD vendor and wireless carrier), or the MD must provide an alternate method of restricting user access/execution to core and preinstalled applications. SFR ID: FMT_SMF_EXT.1.1 #8
Checks: C-91101r1256308_chk

COPE: Review the configuration to determine if the work profile on the Samsung Android device is allowing users to install only applications that have been approved by the authorizing official (AO). COBO: Review the configuration to determine if the Samsung Android devices are allowing users to install only applications that have been approved by the AO. This validation procedure is performed only on the management tool. On the management tool, in the app catalog for managed Google Play, verify that only AO-approved apps are available. If on the management tool the app catalog for managed Google Play includes non-AO-approved apps, this is a finding.

Fix: F-91006r1256309_fix

COPE: Configure the work profile on Samsung Android devices to allow users to install only applications that have been approved by the AO. COBO: Configure Samsung Android devices to allow users to install only applications that have been approved by the AO. In addition to any local policy, the AO must not approve applications that have certain prohibited characteristics, which are covered in KNOX-17-005900. On the management tool, in the app catalog for managed Google Play, add each AO-approved app to be available. Note: Managed Google Play is an allowed app store.

b
The Samsung Android 17 allow list must be configured to not include applications with the following characteristics: - Backs up MD data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmits MD diagnostic data to non-DoW servers; - Voice assistant application if available when MD is locked; - Voice dialing application if available when MD is locked; - Allows synchronization of data or applications between devices associated with the user; - Payment processing; - Allows unencrypted (or encrypted but not FIPS 140-3 validated) data sharing with other MDs or printers; - Backs up its own data to a remote system; and - Renders TV shows and movies.
IA-7 - Medium - CCI-000803 - V-286420 - SV-286420r1256313_rule
RMF Control
IA-7
Severity
M
CCI
CCI-000803
Version
KNOX-17-005900
Vuln IDs
  • V-286420
Rule IDs
  • SV-286420r1256313_rule
Requiring all authorized applications to be in an application allow list prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the allow list. Failure to configure an application allow list properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DoW data accessible by these applications. Applications with the listed characteristics have features that can cause the compromise of sensitive DoW data or have features with no known application in the DoW environment. Application note: The application allow list, in addition to controlling the installation of applications on the MD, must control user access/execution of all core and preinstalled applications, or the MD must provide an alternate method of restricting user access/execution to core and preinstalled applications. Core application: Any application integrated into the OS by the OS or MD vendor. Preinstalled application: Additional noncore applications included in the OS build by the OS vendor, MD vendor, or wireless carrier. SFR ID: FMT_SMF_EXT.1.1 #8
Checks: C-91102r1256311_chk

Verify requirement KNOX-17-005800 (managed Google Play) has been implemented. Verify no apps with unapproved apps are listed in approved apps. If managed Google Play has not been implemented or unapproved apps are allowed, this is a finding.

Fix: F-91007r1256312_fix

The authorizing official (AO) must not approve applications with the following characteristics for installation by users in the work profile: - Back up MD data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmit MD diagnostic data to non-DoW servers; - Voice assistant application if available when MD is locked; - Voice dialing application if available when MD is locked; - Allows synchronization of data or applications between devices associated with the user; - Payment processing; - Allows unencrypted (or encrypted but not FIPS 140-3 validated) data sharing with other MDs, display screens (screen mirroring), or printers; - Apps that backup their own data to a remote system; and - Apps that render TV shows and movies. Implement managed Google Play (refer to requirement KNOX-17-005800).

b
The Samsung Android 17 allow list must be configured to not include artificial intelligence (AI) applications that process device data in the cloud, including Google Gemini.
IA-7 - Medium - CCI-000803 - V-286421 - SV-286421r1256316_rule
RMF Control
IA-7
Severity
M
CCI
CCI-000803
Version
KNOX-17-006000
Vuln IDs
  • V-286421
Rule IDs
  • SV-286421r1256316_rule
Sensitive DoW data could be exposed when an AI app processes device data in the cloud. SFR ID: FMT_SMF_EXT.1.1 #8
Checks: C-91103r1256314_chk

Review managed Samsung Android 17 device configuration settings to determine if the mobile device has an AI application that processes device data in the cloud, including Google Gemini. Verify requirement KNOX-17-009100 (disallow modify accounts) has been implemented. Verify that the Knox Platform for Enterprise (KPE) API "isIntelligenceOnlineProcessingAllowed()" returns false or that the KSP configuration has the restriction "Allow process data only on device" set to true. If any AI application that processes data in the cloud are included in the MDM console of allowed apps or "Allow process data only on device" is not set to true, this is a finding.

Fix: F-91008r1256315_fix

This validation procedure is performed only on the EMM administration console. On the EMM console: 1. Review the list of selected managed Google Play apps. 2. Verify no AI applications that process device data in the cloud, including Google Gemini, are included. Note: This restriction does not include Galaxy on-device AI. Galaxy on-device AI is a ""built-in" capability of Android 17 and processes device data on the device." If the EMM console device policy includes AI applications that process device data in the cloud, including Google Gemini, this is a finding. Disallow modify accounts (refer to requirement KNOX-17-009100). If "disallow modify accounts" has not been implemented, this is a finding. Apply the "Disallow Intelligence Online Processing" using the KPE API or KSP. The KPE API is allowIntelligenceOnlineProcessing(false) and the KSP restriction is "Allow process data only on device", which should be set to true.

b
Samsung Android 17 must be configured to not display the following (work profile) notifications when the device is locked: All notifications.
AC-11 - Medium - CCI-000060 - V-286422 - SV-286422r1256816_rule
RMF Control
AC-11
Severity
M
CCI
CCI-000060
Version
KNOX-17-006100
Vuln IDs
  • V-286422
Rule IDs
  • SV-286422r1256816_rule
Many mobile devices display notifications on the lock screen so that users can obtain relevant information in a timely manner without having to frequently unlock the phone to determine if there are new notifications. However, in many cases, these notifications can contain sensitive information. When they are available on the lock screen, an adversary can see them merely by being in close physical proximity to the device. Configuring the MOS to not send notifications to the lock screen mitigates this risk. The requirement statement specifies the DoW-mandated configuration of this MDFPP element. The STIG author must select "all notifications" if there is no other means to administratively restrict applications from issuing notifications in the locked state where those notifications could include DoW sensitive information. SFR ID: FMT_SMF_EXT.1.1 #18
Checks: C-91104r1256317_chk

Review the configuration to determine if the Samsung Android devices are not displaying (work environment) notifications when the device is locked. Notifications of incoming phone calls are acceptable even when the device is locked. This validation procedure is performed on both the management tool administration console and the Samsung Android device. On the management tool, in the work profile restrictions section, verify "Unredacted Notifications" is set to "Disallow". COPE: On the Samsung Android device: 1. Open Settings >> Notifications >> Lock screen. 2. Verify configuration of "Sensitive work profile notifications" is disabled. If on the management tool "Unredacted Notifications" is not set to "Disallow", or on the Samsung Android device "Sensitive work profile notifications" is not disabled, this is a finding. COBO: On the Samsung Android device: 1. Open Settings >> Notifications. 2. Verify "Lock screen" menu is disabled. If on the management tool "Unredacted Notifications" is not set to "Disallow", or on the Samsung Android device "Notifications" menu is not disabled, this is a finding.

Fix: F-91009r1256318_fix

Configure the Samsung Android devices to not display (Work Environment) notifications when the device is locked. On the management tool, in the Work profile restrictions section, set "Unredacted Notifications" to "Disallow".

c
Samsung Android 17 must be configured to enable encryption for data at rest on removable storage media or, alternately, the use of removable storage media must be disabled.
SC-28 - High - CCI-001199 - V-286424 - SV-286424r1256322_rule
RMF Control
SC-28
Severity
H
CCI
CCI-001199
Version
KNOX-17-006300
Vuln IDs
  • V-286424
Rule IDs
  • SV-286424r1256322_rule
The MOS must ensure the data being written to the mobile device's removable media is protected from unauthorized access. If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can read removable media directly, thereby circumventing operating system controls. Encrypting the data ensures confidentiality is protected even when the operating system is not running. SFR ID: FMT_SMF_EXT.1.1 #20, #47d
Checks: C-91106r1256320_chk

Review the configuration to determine if the Samsung Android devices are either enabling data at rest protection for removable media or disabling their use. This requirement is not applicable for devices that do not support removable storage media. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions, verify "Mount physical media" is set to "Disallow". On the Samsung Android device, verify that a microSD card cannot be mounted. The device should ignore the inserted SD card and no notifications for the transfer of media files should appear, nor should any files be listed using a file browser, such as Samsung My Files. If on the management tool "Mount physical media" is not set to "Disallow", or on the Samsung Android device a microSD card can be mounted, this is a finding.

Fix: F-91011r1256321_fix

Configure the Samsung Android devices to enable data at rest protection for removable media, or alternatively, disable their use. This requirement is not applicable for devices that do not support removable storage media. On the management tool, in the device restrictions, set "Mount physical media" to "Disallow". This disables the use of all removable storage, e.g., microSD cards, USB thumb drives, etc. If the deployment requires the use of microSD cards, Knox Platform for Enterprise (KPE) can be used to allow them in a STIG-approved configuration. In this case, do not configure this policy, and instead replace with KPE policy (innately by the management tool or via Knox Service Plugin [KSP]) "Enforce external storage encryption" with value "enable".

b
Samsung Android 17 must be configured to disable authentication mechanisms providing user access to protected data other than a Password Authentication Factor: Face authentication factor (unless NIAP-validated).
IA-2 - Medium - CCI-000765 - V-286425 - SV-286425r1256325_rule
RMF Control
IA-2
Severity
M
CCI
CCI-000765
Version
KNOX-17-006400
Vuln IDs
  • V-286425
Rule IDs
  • SV-286425r1256325_rule
Note: This requirement is not applicable for specific biometric authentication factors included in the product's Common Criteria evaluation. The biometric factor can be used to authenticate the user to unlock the mobile device. Unapproved/evaluated biometric mechanisms could allow unauthorized users to have access to DoW sensitive data if compromised. By not permitting the use of unapproved/evaluated biometric authentication mechanisms, this risk is mitigated. SFR ID: FMT_SMF_EXT.1.1 #22, FIA_UAU.5.1
Checks: C-91107r1256323_chk

Note: This requirement is not applicable for specific biometric authentication factors included in the product's Common Criteria evaluation. Review the configuration to determine if the Samsung Android devices are disabling face recognition. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool in the device restrictions, verify "Face recognition" is set to "Disable". On the Samsung Android device: 1. Open Settings >> Lock screen and AOD >> Screen lock and biometrics. 2. Enter current password. 3. Open "Face recognition" and, if required, register a face. 4. Verify the "Face unlock" option is disabled and cannot be enabled. If on the management tool "Face recognition" is not set to "Disable", or on the Samsung Android device "Face unlock" can be enabled, this is a finding.

Fix: F-91012r1256324_fix

Note: This requirement is not applicable for specific biometric authentication factors included in the product's Common Criteria evaluation. Configure the Samsung Android devices to disable face recognition. On the management tool, in the device restrictions, set "Face Recognition" to "Disable".

b
Samsung Android 17 must be configured to disable developer modes.
CM-7 - Medium - CCI-000381 - V-286428 - SV-286428r1256330_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
KNOX-17-006700
Vuln IDs
  • V-286428
Rule IDs
  • SV-286428r1256330_rule
Developer modes expose features of the MOS that are not available during standard operation. An adversary may leverage a vulnerability inherent in a developer mode to compromise the confidentiality, integrity, and availability of DoW sensitive information. Disabling developer modes mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #26
Checks: C-91110r1256328_chk

Review the configuration to determine if the Samsung Android devices are disabling developer modes. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions, verify "Debugging Features" is set to "Disallow". On the Samsung Android device: 1. Open Settings >> About phone >> Software information. 2. Tap on the Build Number to try to enable "Developer Options" and validate that action is blocked. If on the management tool "Debugging Features" is not set to "Disallow" or on the Samsung Android device "Developer options" action is not blocked, this is a finding.

Fix: F-91015r1256329_fix

Configure the Samsung Android devices to disable developer modes. On the management tool, in the device restrictions, set "Debugging Features" to "Disallow".

b
The Samsung Android 17 work profile must be configured to enable audit logging.
AU-6 - Medium - CCI-000154 - V-286430 - SV-286430r1256333_rule
RMF Control
AU-6
Severity
M
CCI
CCI-000154
Version
KNOX-17-006900
Vuln IDs
  • V-286430
Rule IDs
  • SV-286430r1256333_rule
Audit logs enable monitoring of security-relevant events and subsequent forensics when breaches occur. For audit logs to be useful, administrators must have the ability to view the audit logs. SFR ID: FMT_SMF_EXT.1.1 #32
Checks: C-91112r1256331_chk

COPE: Review the configuration to determine if the Samsung Android device's work profile is enabling audit logging. This validation procedure is performed on the management tool only. On the management tool, in the Work profile restrictions, verify "Security logging" is set to "Enable". If on the management tool "Security logging" is not set to "Enable", this is a finding. COBO: Review the configuration to determine if the Samsung Android device is enabling audit logging. This validation procedure is performed on the management tool only. On the management tool, in the device restrictions, verify "Security logging" is set to "Enable". If on the management tool "Security logging" is not set to "Enable", this is a finding.

Fix: F-91017r1256332_fix

Configure the Samsung Android device's work profile to enable audit logging (COPE). Configure the Samsung Android devices to enable audit logging (COBO). On the management tool, in the work profile restrictions section, set "Security logging" to "Enable".

a
Samsung Android 17 must be configured to display the DoW advisory warning message at startup or each time the user unlocks the device.
AC-8 - Low - CCI-000048 - V-286432 - SV-286432r1256337_rule
RMF Control
AC-8
Severity
L
CCI
CCI-000048
Version
KNOX-17-007100
Vuln IDs
  • V-286432
Rule IDs
  • SV-286432r1256337_rule
Before granting access to the system, the mobile operating system is required to display the DoW-approved system use notification message or banner that provides privacy and security notices consistent with applicable Federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Required banners help ensure that DoW can audit and monitor the activities of mobile device users without legal restriction. System use notification messages can be displayed when individuals first access or unlock the mobile device. The banner must be implemented as a "click-through" banner at device unlock (to the extent permitted by the operating system). A "click-through" banner prevents further activity on the information system unless and until the user executes a positive action to manifest agreement by clicking on a box indicating "OK." The approved DoW text must be used exactly as required in the Knowledge Service referenced in DODI 8500.01. For devices accommodating banners of 1300 characters, the banner text is: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. For devices with severe character limitations, the banner text is: I've read & consent to terms in IS user agreem't. The administrator must configure the banner text exactly as written without any changes. SFR ID: FMT_SMF_EXT.1.1 #36
Checks: C-91114r1256335_chk

Confirm if Method #1 or #2 is used at the Samsung device site and follow the appropriate procedure. This validation procedure is performed on both the management tool and the Samsung Android device. Validation procedure for Method #1: Place the DoW warning banner in the user agreement signed by each Samsung Android device user. Review the signed user agreements for several Samsung Android device users and verify the agreement includes the required DoW warning banner text. Validation procedure for Method #2 (preferred method): Configure the warning banner text in the lock screen message on each managed mobile device. On the management tool, in the device restrictions section, verify "Lock Screen Message" is set to the DoW-mandated warning banner text. On the Samsung Android device, verify the required DoW warning banner text is displayed on the lock screen. If the warning text has not been placed in the signed user agreement, or if on the management tool "Lock Screen Message" is not set to the DoW-mandated warning banner text, or on the Samsung Android device the required DoW warning banner text is not displayed on the lock screen, this is a finding.

Fix: F-91019r1256336_fix

Configure the DoW warning banner by either of the following methods (required text is found in the Vulnerability Description): Method #1: Place the DoW warning banner in the user agreement signed by each Samsung Android device user. Method #2 (preferred method): Configure the warning banner text in the Lock screen message on each managed mobile device. On the management tool, in the device restrictions section, set "Lock Screen Message" to the DoW-mandated warning banner text.

b
Samsung Android 17 must be configured to disable USB mass storage mode.
SC-41 - Medium - CCI-002546 - V-286434 - SV-286434r1256341_rule
RMF Control
SC-41
Severity
M
CCI
CCI-002546
Version
KNOX-17-007300
Vuln IDs
  • V-286434
Rule IDs
  • SV-286434r1256341_rule
USB mass storage mode enables the transfer of data and software from one device to another. This software can include malware. When USB mass storage is enabled on a mobile device, it becomes a potential vector for malware and unauthorized data exfiltration. Prohibiting USB mass storage mode mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #39
Checks: C-91116r1256339_chk

Review the configuration to determine if the Samsung Android device is disabling USB mass storage mode. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions, verify "USB file transfer" has been set to "Disallow". On the Samsung Android device, from the "USB for charging phone" notification, verify that "Transferring files/Android Auto" and "Transferring images" are not options. If on the management tool "USB file transfer" is not set to "Disallow", or on the Samsung Android device "Transferring files/Android Auto" or "Transferring images" options are available, this is a finding.

Fix: F-91021r1256340_fix

Configure the Samsung Android device to disable USB mass storage mode. On the management tool, in the device restrictions, set "USB file transfer" to "Disallow". DeX drag and drop file transfer capabilities will be prohibited, but all other DeX capabilities remain usable.

b
Samsung Android 17 must be configured to not allow backup of [all applications, configuration data] to locally connected systems.
SC-4 - Medium - CCI-001090 - V-286435 - SV-286435r1256343_rule
RMF Control
SC-4
Severity
M
CCI
CCI-001090
Version
KNOX-17-007400
Vuln IDs
  • V-286435
Rule IDs
  • SV-286435r1256343_rule
Data on mobile devices is protected by numerous mechanisms, including user authentication, access control, and cryptography. When the data is backed up to an external system (either locally connected or cloud based), many, if not all, of these mechanisms are no longer present. This leaves the backed-up data vulnerable to attack. Disabling backup to external systems mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #40
Checks: C-91117r1256342_chk

Verify requirement KNOX-17-007300 (disallow USB file transfer) has been implemented. If "Disallow USB file transfer" has not been implemented, this is a finding.

Fix: F-91022r1255954_fix

Ensure "USB file transfer" has been disallowed (refer to requirement KNOX-17-007300).

b
Samsung Android 17 must be configured to not allow backup of [all applications, configuration data] to remote systems. (This requirement applies to the work profile for COPE.) - Disable Data Sync Framework.
SC-4 - Medium - CCI-001090 - V-286436 - SV-286436r1256345_rule
RMF Control
SC-4
Severity
M
CCI
CCI-001090
Version
KNOX-17-007500
Vuln IDs
  • V-286436
Rule IDs
  • SV-286436r1256345_rule
Backups to remote systems (including cloud backup) can leave data vulnerable to breach on the external systems, which often offer less protection than the MOS. Where the remote backup involves a cloud-based solution, the backup capability is often used to synchronize data across multiple devices. In this case, DoW devices may synchronize DoW sensitive information to a user's personal device or other unauthorized computers that are vulnerable to breach. Disallowing remote backup mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #40
Checks: C-91118r1256344_chk

Verify requirement KNOX-17-009100 (disallow modify accounts) has been implemented. If "disallow modify accounts" has not been implemented, this is a finding.

Fix: F-91023r1255957_fix

Disallow modify accounts (refer to requirement KNOX-17-009100).

b
Samsung Android 17 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
AC-18 - Medium - CCI-001443 - V-286438 - SV-286438r1256349_rule
RMF Control
AC-18
Severity
M
CCI
CCI-001443
Version
KNOX-17-007800
Vuln IDs
  • V-286438
Rule IDs
  • SV-286438r1256349_rule
If no authentication is required to establish personal hotspot connections (Wi-Fi and Bluetooth), an adversary may be able to use that device to perform attacks on other devices or networks without detection. A sophisticated adversary may also be able to exploit unknown system vulnerabilities to access information and computing resources on the device. Requiring authentication to establish personal hotspot connections mitigates this risk. Application note: If hotspot functionality is permitted, it must be authenticated via a preshared key. There is no requirement to enable hotspot functionality, and it is recommended this functionality be disabled by default. SFR ID: FMT_SMF_EXT.1.1 #41
Checks: C-91120r1256347_chk

This is a "User-Based Enforcement (UBE)" control. Check a sample of Samsung phones at the site and verify the Wi-Fi hotspot preshared key (password) is set to "WPA3-Personal". 1. Navigate to Settings >> Connections >> Mobile Hotspot and Tethering. 2. Tap on "Mobile Hotspot". 3. Tap on the "Network name" field to bring up the configuration options. 4. Click on the "Security" link and select "WPA3-Personal". If the Wi-Fi hotspot security is not set to "WPA3-Personal", this is a finding.

Fix: F-91025r1256348_fix

This is a "User-Based Enforcement (UBE)" control. Train users to not change the default Wi-Fi hotspot security setting: 15-character complex Wi-Fi hotspot preshared key (password) ("WPA3-Personal"). (KNOX-17-009300) If the required preshared key is not set up, train users to use the following procedure to set up the required setting: 1. Navigate to Settings >> Connections >> Mobile Hotspot and Tethering. 2. Tap on "Mobile Hotspot". 3. Tap on the "Network name" field to bring up the configuration options. 4. Click on the "Security" link and select "WPA3-Personal".

b
Samsung Android 17 must be configured to disable exceptions to the access control policy that prevent application processes and groups of application processes from accessing all data stored by other application processes and groups of application processes.
SC-39 - Medium - CCI-002530 - V-286440 - SV-286440r1256353_rule
RMF Control
SC-39
Severity
M
CCI
CCI-002530
Version
KNOX-17-008000
Vuln IDs
  • V-286440
Rule IDs
  • SV-286440r1256353_rule
App data sharing gives apps the ability to access the data of other apps for enhanced user functionality. However, sharing also poses a significant risk that unauthorized users or apps will obtain access to DoW sensitive information. To mitigate this risk, there are data sharing restrictions, primarily from sharing data from personal (unmanaged) apps and work (managed) apps. If a user is allowed to make exceptions to the data sharing restriction policy, the user could enable unauthorized sharing of data, leaving it vulnerable to breach. Limiting the granting of exceptions to either the administrator or common application developer mitigates this risk. Copy/paste of data between applications in different application processes or groups of application processes is considered an exception to the access control policy and therefore, the administrator must be able to enable/disable the feature. Other exceptions include allowing any data or application sharing between process groups. SFR ID: FMT_SMF_EXT.1.1 #42, FDP_ACF_EXT.1.2
Checks: C-91122r1256351_chk

Review the Samsung documentation and inspect the configuration to verify the Samsung Android device is enabling an access control policy that prevents application processes and groups of application processes from accessing all data stored by other application processes and groups of application processes. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the work profile restrictions, set "Cross profile copy/paste" to "Disallow". On the Samsung Android device: 1. Using any work app, copy text to the clipboard. 2. Using any personal app, verify the clipboard text cannot be pasted. If on the management tool "Cross profile copy/paste" is not set to "Disallow", or on the Samsung Android device the clipboard text can be pasted into a personal app, this is a finding.

Fix: F-91027r1256352_fix

Configure the Samsung Android device to enable an access control policy that prevents application processes and groups of application processes from accessing all data stored by other application processes and groups of application processes. On the management tool, in the work profile restrictions section, set "Cross profile copy/paste" to "Disallow".

a
Samsung Android 17 must be configured to disable all Bluetooth profiles except for HSP (Headset Profile), HFP (Hands-Free Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile).
CM-7 - Low - CCI-000381 - V-286444 - SV-286444r1256457_rule
RMF Control
CM-7
Severity
L
CCI
CCI-000381
Version
KNOX-17-008400
Vuln IDs
  • V-286444
Rule IDs
  • SV-286444r1256457_rule
Some Bluetooth profiles provide the capability for remote transfer of sensitive DoW data without encryption or otherwise do not meet DoW IT security policies and therefore must be disabled. SFR ID: FMT_SMF_EXT.1.1/BLUETOOTH BT-8
Checks: C-91126r1256354_chk

Review the Samsung documentation and inspect the configuration to verify the Samsung Android devices are paired only with devices that support HSP, HFP, SPP, A2DP, AVRCP, and PBAP Bluetooth profiles. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions section, verify "Bluetooth" is set to the authorizing official (AO)-approved selection: "Allow" if the AO has approved the use of Bluetooth or "Disallow" if the AO has not approved its use. On the Samsung Android device: 1. Open Settings >> Connections >> Bluetooth. 2. Verify all listed paired Bluetooth devices use only authorized Bluetooth profiles. If on the management tool "Bluetooth" is not set to the AO-approved value, or the Samsung Android device is paired with a device that uses unauthorized Bluetooth profiles, this is a finding.

Fix: F-91031r1256456_fix

Configure the Samsung Android devices to disable Bluetooth, or if the AO has approved the use of Bluetooth (for example, for hands-free use), train users to only pair devices that support HSP, HFP, SPP, A2DP, AVRCP, and PBAP profiles. On the management tool, in the device restrictions section, set "Bluetooth" to the AO-approved selection: "Allow" if the AO has approved the use of Bluetooth or "Disallow" if the AO has not approved its use. The user training requirement is satisfied in requirement KNOX-16-009400. If a COBO deployment requires the use of specific Bluetooth profiles, Knox Platform for Enterprise (KPE) can be used to allow them in a STIG-approved configuration. In this case, do not configure this policy, and instead replace with KPE policy (innately by the management tool or via Knox Service Plugin [KSP]) "Add Bluetooth UUIDs To WhiteList" with values "HSP_UUID, HFP_UUID, SPP_UUID, A2DP_ADVAUDIODIST_UUID, AVRCP_CONTROLLER_UUID, AVRCP_TARGET_UUID" and default deny list as "enable".

b
Samsung Android 17 must be configured to disable ad hoc wireless client-to-client connection capability.
SC-40 - Medium - CCI-002536 - V-286445 - SV-286445r1256821_rule
RMF Control
SC-40
Severity
M
CCI
CCI-002536
Version
KNOX-17-008500
Vuln IDs
  • V-286445
Rule IDs
  • SV-286445r1256821_rule
Ad hoc wireless client-to-client connections allow mobile devices to communicate with each other directly, circumventing network security policies and making the traffic invisible. This could allow the exposure of sensitive DoW data and increase the risk of downloading and installing malware of the DoW mobile device. SFR ID: FMT_SMF_EXT.1.1 WL-5/PP-Module for WLAN Clients
Checks: C-91127r1256819_chk

Review the configuration to determine if the Samsung Android devices are disallowing Wi-Fi Direct. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the user restrictions, verify "Wi-Fi Direct" has been set to "Disallow". On the Samsung Android device: 1. Open Settings >> Connections >> Wi-Fi. 2. From the hamburger menu, select Wi-Fi Direct. 3. Verify that Wi-Fi Direct cannot be selected. If on the management tool "Wi-Fi Direct" is not set to "Disallow", or on the Samsung Android device a Wi-Fi Direct device is listed that can be connected to, this is a finding.

Fix: F-91032r1256820_fix

Configure the Samsung Android devices to disallow Wi-Fi Direct. On the management tool, in the user restrictions, set "Wi-Fi Direct" to "Disallow". Wi-Fi Direct connections and pairing between devices will become unavailable.

b
Samsung Android must be enrolled as a COPE device.
CM-6 - Medium - CCI-000366 - V-286447 - SV-286447r1256459_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-008800
Vuln IDs
  • V-286447
Rule IDs
  • SV-286447r1256459_rule
The work profile is the designated application group for the COPE use case. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91129r1256458_chk

Review the configuration to determine if the Samsung Android devices are enrolled in a DoW-approved use case. This validation procedure is performed on both the management tool administration console and the Samsung Android device. On the management tool, verify the default enrollment is set to "Work profile for company-owned devices". On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> Device admin apps. 2. Verify the management tool agent is listed. 3. Navigate to the app drawer. 4. Verify a "Personal" and "Work" tab are present. If on the management tool the default enrollment is not set as "Work profile for company-owned devices", or on the Samsung Android device the "Personal" and "Work" tabs are not present or the management tool agent is not listed, this is a finding.

Fix: F-91034r1256361_fix

Enroll the Samsung Android devices in a DoW-approved use case. On the management tool, configure the default enrollment as "Work profile for company-owned devices". Refer to the management tool documentation to determine how to configure the device enrollment.

b
Samsung Android must be configured to disallow configuration of the device's date and time.
CM-6 - Medium - CCI-000366 - V-286448 - SV-286448r1256365_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-008900
Vuln IDs
  • V-286448
Rule IDs
  • SV-286448r1256365_rule
Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events. Periodically synchronizing internal clocks with an authoritative time source is necessary to correctly correlate the timing of events that occur across the enterprise. The three authoritative time sources for Samsung Android are an authoritative time server that is synchronized with redundant United States Naval Observatory (USNO) time servers as designated for the appropriate DoW network (NIPRNet or SIPRNet), the Global Positioning System (GPS), or the wireless carrier. Time stamps generated by the audit system in Samsung Android must include both date and time. The time may be expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91130r1256363_chk

Review the configuration to determine if the Samsung Android devices are disallowing the users from changing the date and time. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions, verify "Configure Date/Time" is set to "Disallow". On the Samsung Android device: 1. Open Settings >> General management >> Date and time. 2. Verify "Automatic date and time" is on and the user cannot disable it. If on the management tool "Configure Date/Time" is not set to "Disallow", or on the Samsung Android device "Automatic date and time" is not set or the user can disable it, this is a finding.

Fix: F-91035r1256364_fix

Configure the Samsung Android devices to disallow users from changing the date and time. On the management tool, in the device restrictions, set "Configure Date/Time" to "Disallow".

b
Samsung Android's work profile must have the DoW root and intermediate PKI certificates installed.
CM-6 - Medium - CCI-000366 - V-286449 - SV-286449r1256461_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-009000
Vuln IDs
  • V-286449
Rule IDs
  • SV-286449r1256461_rule
DoW root and intermediate PKI certificates are used to verify the authenticity of PKI certificates of users and web services. If the root and intermediate certificates are not available, an adversary could falsely sign a certificate in such a way that it could not be detected. Providing access to the DoW root and intermediate PKI certificates greatly diminishes the risk of this attack. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91131r1256460_chk

COPE: Review the configuration to determine if the Samsung Android's work profile has the DoW root and intermediate PKI certificates installed. This validation procedure is performed on both the management tool and the Samsung Android device. The current DoW root and intermediate PKI certificates may be obtained in self-extracting zip files at https://cyber.mil/pki-pke (for NIPRNet). On the management tool, in the work profile policy management, verify the DoW root and intermediate PKI certificates are installed. On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> View security certificates. 2. In the "User" tab, verify the DoW root and intermediate PKI certificates are listed in the work profile. If on the management tool the DoW root and intermediate PKI certificates are not listed in the work profile, or on the Samsung Android device the DoW root and intermediate PKI certificates are not listed in the work profile, this is a finding. COBO: Review the configuration to determine if the Samsung Android devices have the DoW root and intermediate PKI certificates installed. This validation procedure is performed on both the management tool and the Samsung Android device. The current DoW root and intermediate PKI certificates may be obtained in self-extracting zip files at https://cyber.mil/pki-pke (for NIPRNet). On the management tool, in the device policy management, verify the DoW root and intermediate PKI certificates are installed. On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> View security certificates. 2. In the User tab, verify the DoW root and intermediate PKI certificates are listed in the device. If on the management tool the DoW root and intermediate PKI certificates are not listed in the device, or on the Samsung Android device the DoW root and intermediate PKI certificates are not listed in the device, this is a finding.

Fix: F-91036r1256367_fix

Install the DoW root and intermediate PKI certificates into the Samsung Android devices (install in work profile for COPE). The current DoW root and intermediate PKI certificates may be obtained in self-extracting zip files at https://cyber.mil/pki-pke (for NIPRNet). On the management tool, in the device policy management (Work profile for COPE), install the DoW root and intermediate PKI certificates.

b
Samsung Android's work profile must be configured to prevent users from adding personal email accounts to the work email app.
CM-6 - Medium - CCI-000366 - V-286450 - SV-286450r1256371_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-009100
Vuln IDs
  • V-286450
Rule IDs
  • SV-286450r1256371_rule
If the user is able to add a personal email account (POP3, IMAP, EAS) to the work email app, it could be used to forward sensitive DoW data to unauthorized recipients. Restricting email account addition to the administrator or to allow listed accounts mitigates this vulnerability. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91132r1256369_chk

Review the configuration to determine if the Samsung Android devices are preventing users from adding personal email accounts to the work email app. On the management tool, in the device restrictions section, verify "Modify accounts" is set to "Disallow". COPE: On the Samsung Android device: 1. Open Settings >> Accounts and backup >> Manage accounts. 2. Navigate to the "Work" tab. 3. Verify no account can be added. COBO: On the Samsung Android device: 1. Open Settings >> Accounts and backup >> Manage accounts. 2. Verify no account can be added. If on the management tool "Modify accounts" is not set to "Disallow", or on the Samsung Android device an account can be added, this is a finding.

Fix: F-91037r1256370_fix

Configure the Samsung Android devices to prevent users from adding personal email accounts to the work email app. On the management tool, in the work profile restrictions, set "Modify accounts" to "Disallow" (COPE). On the management tool, in the device restrictions, set "Modify accounts" to "Disallow" (COBO).

a
Samsung Android's work profile must be configured to enable Common Criteria (CC) mode.
CM-6 - Low - CCI-000366 - V-286451 - SV-286451r1256374_rule
RMF Control
CM-6
Severity
L
CCI
CCI-000366
Version
KNOX-17-009200
Vuln IDs
  • V-286451
Rule IDs
  • SV-286451r1256374_rule
The CC mode feature is a superset of other features and behavioral changes that are mandatory MDFPP requirements. If CC mode is not implemented, the device will not be operating in the NIAP-certified compliant CC mode of operation. When enforcing Android Enterprise (AE) CC mode on a Samsung Android device, additional Samsung-specific security features are also enabled. CC mode implements the following behavioral/functional changes to meet MDFPP requirements: - How the Bluetooth and Wi-Fi keys are stored using different types of encryption. - Download mode is disabled and all updates will occur via Firmware Over the Air (FOTA) only. In addition, CC mode adds new restrictions not to meet MDFPP requirements, but to offer better security above what is required: - Force password info following FOTA update for consistency. - Disable Remote unlock by FindMyMobile. - Restrict biometric attempts to 10. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91133r1256372_chk

Review the configuration to determine if the Samsung Android devices are enabling CC mode. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the work profile restrictions, verify "Common Criteria mode" is set to "Enable". On the Samsung Android device, put the device into "Download mode" (press and hold down the Home + Power + Volume Down buttons at the same time) and verify the text "Blocked by CC Mode" is displayed on the screen. If on the management tool "Common Criteria mode" is not set to "Enable", or on the Samsung Android device the text "Blocked by CC Mode" is not displayed in "Download mode", this is a finding.

Fix: F-91038r1256373_fix

Configure the Samsung Android devices to enable CC mode. On the management tool, in the work profile restrictions, set "Common Criteria mode" to "Enable".

b
Samsung Android device users must complete required training.
CM-6 - Medium - CCI-000366 - V-286452 - SV-286452r1256377_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-009300
Vuln IDs
  • V-286452
Rule IDs
  • SV-286452r1256377_rule
The security posture of Samsung devices requires the device user to configure several required policy rules on their device. User-Based Enforcement (UBE) is required for these controls. In addition, if the authorizing official (AO) has approved the use of an unmanaged personal space, the user must receive training on risks. If a user is not aware of their responsibilities and does not comply with UBE requirements, the security posture of the Samsung mobile device may become compromised, and DoW sensitive data may become compromised. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91134r1256375_chk

Review a sample of site User Agreements for Samsung device users or similar training records and training course content. Verify Samsung device users have completed required training. The intent is that required training is renewed on a periodic basis in a time period determined by the AO. If any Samsung device user has not completed required training, this is a finding.

Fix: F-91039r1256376_fix

Have all Samsung device users complete training on the following topics. Users should acknowledge they have reviewed training via a signed User Agreement or similar written record. Training topics: - Operational security concerns introduced by unmanaged applications/unmanaged personal space including applications using Global Positioning System (GPS) tracking. - Need to ensure no DoW data is saved to the personal space or transmitted from a personal app (for example, from personal email). - If the Purebred key management app is used, users are responsible for maintaining positive control of their credentialed device at all times. The DoW PKI certificate policy requires subscribers to maintain positive control of the devices that contain private keys and report any loss of control so the credentials can be revoked. Upon device retirement, turn-in, or reassignment, ensure a factory data reset is performed prior to device hand-off. Follow Mobility service provider decommissioning procedures as applicable. - How to configure the following UBE controls (users must configure the control) on the Samsung device: 1. Secure use of Calendar Alarm. 2. Local screen mirroring and MirrorLink procedures (authorized/not authorized for use). 3. Do not connect Samsung devices (via either DeX Station or dongle) to any DoW network via Ethernet connection. 4. Do not upload DoW contacts via smart call and caller ID services. 5. Do not configure a DoW network (work) VPN profile on any third-party VPN client installed in the personal space. 6. If Bluetooth connections are approved for mobile device, types of allowed connections (for example car hands-free, but not Bluetooth wireless keyboard). 7. How to perform a full device wipe. 8. Use default Wi-Fi hotspot password: 15-character complex Wi-Fi hotspot preshared password enabled ("WPA2/WPA3-personal"). - AO guidance on acceptable use and restrictions, if any, on downloading and installing personal apps and data (music, photos, etc.) in the Samsung device personal space.

c
The Samsung Android device must have the latest available Samsung Android operating system (OS) installed.
CM-6 - High - CCI-000366 - V-286453 - SV-286453r1256380_rule
RMF Control
CM-6
Severity
H
CCI
CCI-000366
Version
KNOX-17-009400
Vuln IDs
  • V-286453
Rule IDs
  • SV-286453r1256380_rule
Required security features are not available in earlier OS versions. In addition, earlier versions may have known vulnerabilities. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91135r1256378_chk

Review the configuration to confirm if the Samsung Android devices have the most recently released version of Samsung Android installed. This procedure is performed on both the management tool and the Samsung Android device. In the management tool management console, review the version of Samsung Android installed on a sample of managed devices. This procedure will vary depending on the management tool product. Refer to the notes below to determine the latest available OS version. On the Samsung Android device, to determine the installed OS version: 1. Open Settings. 2. Tap "About phone". 3. Tap "Software information". If the installed version of Android OS on any reviewed Samsung devices is not the latest released by the wireless carrier, this is a finding. Note: Some wireless carriers list the version of the latest Android OS release by mobile device model online: AT&T: https://www.att.com/devicehowto/dsm.html#!/popular/make/Samsung Verizon Wireless: https://www.verizonwireless.com/support/software-updates/ Google Android OS patch website: https://source.android.com/security/bulletin/ Samsung Android OS patch website: https://security.samsungmobile.com/securityUpdate.smsb

Fix: F-91040r1256379_fix

Install the latest released version of Samsung Android OS on all managed Samsung devices. Note: In most cases, OS updates are released by the wireless carrier (for example, Sprint, T-Mobile, Verizon Wireless, and AT&T).

b
The Samsung Android device must be configured to enable Certificate Revocation List (CRL) status checking.
CM-6 - Medium - CCI-000366 - V-286454 - SV-286454r1256383_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-009500
Vuln IDs
  • V-286454
Rule IDs
  • SV-286454r1256383_rule
A CRL allows a certificate issuer to revoke a certificate for any reason, including improperly issued certificates and compromise of the private keys. Checking the revocation status of the certificate mitigates the risk associated with using a compromised certificate. For this reason, users must not be able to disable this configuration. Samsung Android can control CRL checking but only using Knox APIs. Alternatively, CRL checking is based on app development best practice. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91136r1256381_chk

Review the configuration to confirm that revocation checking is enabled. Verify the revocation checklist is set to the required applications. This procedure is performed on the management tool. On the management tool: 1. Open Security Policy >> Certificates Policy >> Revocation section. 2. Select "Get CRL". 3. Verify Toast message "Get revocation check: true". If on the management tool the revocation check is disabled, this is a finding.

Fix: F-91041r1256382_fix

Configure the Samsung Android devices to enable CRL revocation checks for required applications. These revocation checks must be enabled using the Knox Platform for Enterprise (KPE) APIs. On the management tool, in the Certificate Policy restrictions, enable "Revocation Checks" for required applications.

b
The Samsung Android device must be configured to enforce that Wi-Fi sharing is disabled.
CM-6 - Medium - CCI-000366 - V-286455 - SV-286455r1256386_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-009600
Vuln IDs
  • V-286455
Rule IDs
  • SV-286455r1256386_rule
Wi-Fi sharing is an optional configuration of Wi-Fi tethering/mobile hotspot, which allows the device to share its Wi-Fi connection with other wirelessly connected devices instead of its mobile (cellular) connection. Wi-Fi sharing grants the "other" device access to a corporate Wi-Fi network and may possibly bypass the network access control mechanisms. This risk can be partially mitigated by requiring the use of a preshared key for personal hotspots. SFR ID: FMT_SMF.1.1 #47
Checks: C-91137r1256384_chk

Review device configuration settings to confirm Wi-Fi sharing is disabled. Mobile hotspot must be enabled to enable Wi-Fi sharing. If the authorizing official (AO) has not approved mobile hotspot, and it has been verified as disabled on the EMM console, no further action is needed. If mobile hotspot is being used, use the following procedure to verify Wi-Fi sharing is disabled. This is a "User-Based Enforcement (UBE)" control. Check a sample of Samsung phones at the site and verify that the mobile hotspot Wi-Fi sharing option is toggled to off. 1. Navigate to Settings >> Connections >> Mobile Hotspot and Tethering >> Mobile Hotspot. 2. Tap "Network name". 3. Tap "Advanced". 4. Verify that "Wi-Fi sharing" is toggled off or the option is disabled. If the Wi-Fi sharing is not set to disabled, this is a finding. On the EMM console: COBO: 1. Open "Set user restrictions". 2. Verify "Disallow sharing admin configured Wi-Fi" is toggled to "ON". COPE: 1. Open "Set user restrictions on parent". 2. Verify "Disallow sharing admin configured Wi-Fi" it toggled to "ON". If on the EMM console, "Disallow sharing admin configured Wi-Fi" is not enabled, this is a finding.

Fix: F-91042r1256385_fix

Configure the Samsung Android 17 device to disable Wi-Fi sharing. Mobile hotspot must be enabled to enable Wi-Fi sharing. If the AO has not approved mobile hotspot, and it has been disabled on the EMM console, no further action is needed. If mobile hotspot is being used, then use the following procedure and "User-Based Enforcement (UBE)" control: Train users to disable/not enable Samsung Wi-Fi sharing. Refer to STIG requirement KNOX-17-009300. 1. Navigate to Settings >> Connections >> Mobile Hotspot and Tethering >> Mobile Hotspot. 2. Tap "Network name". 3. Tap "Advanced". 4. Verify that "Wi-Fi sharing" is toggled off or the option is disabled. On the EMM console: COBO: 1. Open "Set user restrictions". 2. Toggle "Disallow sharing admin configured Wi-Fi" to "ON". COPE: 1. Open "Set user restrictions on parent". 2. Toggle "Disallow sharing admin configured Wi-Fi" to "ON". On COBO devices, Knox Platform for Enterprise (KPE) policy can be used to configure this setting without "User-Based Enforcement (UBE)" control, by setting the "Allow Wi-Fi sharing" option in KSP to disable.

b
The Samsung Android device work profile must be configured to enforce the system application disable list.
CM-6 - Medium - CCI-000366 - V-286456 - SV-286456r1256389_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-009700
Vuln IDs
  • V-286456
Rule IDs
  • SV-286456r1256389_rule
The system application disable list controls user access to/execution of all core and preinstalled applications. Core application: Any application integrated into Samsung Android 17 by Samsung. Preinstalled application: Additional noncore applications included in the Samsung Android 17 build by Samsung or the wireless carrier. Some system applications can compromise DoW data or upload users' information to non-DoW-approved servers. A user must be blocked from using such applications that exhibit behavior that can result in compromise of DoW data or DoW user information. The site administrator must analyze all preinstalled applications on the device and disable all applications not approved for DoW use by configuring the system application disable list. SFR ID: FMT_SMF.1.1 #47
Checks: C-91138r1256387_chk

Review the configuration to confirm the system application disable list is enforced. This setting is enforced by default. Verify only approved system apps have been placed on the core allow list. This procedure is performed on the management tool. Review the system app allow list and verify only approved apps are on the list. On the management tool, in the Apps management section, select "Unhide apps" and verify the names of the apps listed. If on the management tool the system app allow list contains unapproved core apps, this is a finding.

Fix: F-91043r1256388_fix

Configure the Samsung Android 17 device to enforce the system application disable list. The required configuration is the default configuration when the device is enrolled. If the device configuration is changed, use the following procedure to bring the device back into compliance: On the management tool: 1. Open "Apps management" section. 2. Select "Hide apps". 3. Enter names of apps to hide. Configure a list of approved Samsung core and preinstalled apps in the core app allow list.

b
The Samsung Android device must be provisioned as a fully managed device and configured to create a work profile.
CM-6 - Medium - CCI-000366 - V-286457 - SV-286457r1256391_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-009800
Vuln IDs
  • V-286457
Rule IDs
  • SV-286457r1256391_rule
The Android Enterprise work profile is the designated application group for the COPE use case. SFR ID: FMT_SMF.1.1 #47
Checks: C-91139r1256390_chk

Verify requirement KNOX-17-008800 (COPE enrollment) has been implemented. If "COPE enrollment" has not been implemented, this is a finding."

Fix: F-91044r1256020_fix

Implement "COPE enrollment" (refer to requirement KNOX-17-008800).

b
The Samsung Android device work profile must be configured to disable automatic completion of work space internet browser text input.
CM-6 - Medium - CCI-000366 - V-286458 - SV-286458r1256394_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-009900
Vuln IDs
  • V-286458
Rule IDs
  • SV-286458r1256394_rule
The autofill functionality in the web browser allows the user to complete a form that contains sensitive information, such as personally identifiable information (PII), without previous knowledge of the information. By allowing the use of autofill functionality, an adversary who learns a user's Android 17 device password, or who otherwise is able to unlock the device, may be able to further breach other systems by relying on the autofill feature to provide information unknown to the adversary. By disabling the autofill functionality, the risk of an adversary gaining further information about the device's user or compromising other systems is significantly mitigated. SFR ID: FMT_SMF.1.1 #47
Checks: C-91140r1256392_chk

Review the work profile Chrome Browser app on the Samsung device autofill setting. This validation procedure is performed on the management tool. On the management tool: 1. Open "Managed Configurations" section. 2. Select the Chrome Browser version from the work profile. 3. Verify "PasswordManagerEnabled" is turned "OFF". 4. Verify "AutofillAddressEnabled" is turned "OFF". 5. Verify "AutofillCreditCardEnabled" is turned "OFF". If on the management tool any of the browser autofill settings are set to "On" in the Chrome Browser Settings, this is a finding.

Fix: F-91045r1256393_fix

Configure the Samsung device to disable the autofill functionality. The required configuration is the default configuration when the device is enrolled. If the device configuration is changed, use the following procedure to bring the device back into compliance. On the management tool: 1. Open the "Managed configurations" section. 2. Select the Chrome Browser version from the work profile. 3. Ensure "PasswordManagerEnabled" is turned "OFF". 4. Ensure "AutofillAddressEnabled" is turned "OFF". 5. Ensure "AutofillCreditCardEnabled" is turned "OFF".

b
The Samsung Android device work profile must be configured to disable the autofill services.
CM-6 - Medium - CCI-000366 - V-286459 - SV-286459r1256397_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-010000
Vuln IDs
  • V-286459
Rule IDs
  • SV-286459r1256397_rule
The autofill services allow the user to complete text inputs that could contain sensitive information, such as personally identifiable information (PII), without previous knowledge of the information. By allowing the use of autofill services, an adversary who learns a user's Android 17 device password, or who otherwise is able to unlock the device, may be able to further breach other systems by relying on the autofill services to provide information unknown to the adversary. By disabling the autofill services, the risk of an adversary gaining further information about the device's user or compromising other systems is significantly mitigated. Examples of apps that offer autofill services include Samsung Pass, Google, Dashlane, LastPass, and 1Password. SFR ID: FMT_SMF.1.1 #47
Checks: C-91141r1256395_chk

Review the Samsung work profile configuration settings to confirm that autofill services are disabled. This validation procedure is performed on the management tool. On the management tool: 1. Open "Set user restrictions". 2. Verify "Disable autofill" is toggled to "ON". If on the management tool the "disallow autofill" is not selected, this is a finding.

Fix: F-91046r1256396_fix

Configure the Samsung device to disable the autofill services. On the management tool, in the work profile User Restrictions section, set "Disable autofill" to "Enable".

a
The Samsung Android device must be configured to disable the use of third-party keyboards.
CM-6 - Low - CCI-000366 - V-286460 - SV-286460r1256400_rule
RMF Control
CM-6
Severity
L
CCI
CCI-000366
Version
KNOX-17-010100
Vuln IDs
  • V-286460
Rule IDs
  • SV-286460r1256400_rule
Many third-party keyboard applications are known to contain malware. SFR ID: FMT_SMF.1.1 #47
Checks: C-91142r1256398_chk

Review the managed Samsung device configuration settings to confirm that no third-party keyboards are enabled. This procedure is performed on the management tool. On the management tool: 1. Open "Input methods". 2. Tap "Set input methods". 3. Verify only the approved keyboards are selected. If third-party keyboards are allowed, this is a finding.

Fix: F-91047r1256399_fix

Configure the Samsung device to disallow the use of third-party keyboards. On the management tool: 1. Open "Input methods". 2. Tap "Set input methods". 3. Select only the approved keyboard. Additionally, administrators can configure application allow lists for Google Play that do not have any third-party keyboards for user installation.

b
The Samsung Android device must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)].
AC-6 - Medium - CCI-002235 - V-286461 - SV-286461r1256403_rule
RMF Control
AC-6
Severity
M
CCI
CCI-002235
Version
KNOX-17-010200
Vuln IDs
  • V-286461
Rule IDs
  • SV-286461r1256403_rule
If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DoW sensitive information. SFR ID: FMT_MOF_EXT.1.2 #24
Checks: C-91143r1256401_chk

Review the device configuration to confirm the USB port is disabled except for charging the device. On the management tool: Verify "Disallow USB file transfer" is toggled to "OFF". If on the management tool the USB port is not disabled, this is a finding.

Fix: F-91048r1256402_fix

Configure the Samsung device to disable the USB port (except for charging the device). On the management tool: Toggle "Disallow USB file transfer" to "OFF".

a
The Samsung Android device must be configured to perform the following management function: Disable Phone Hub.
SC-4 - Low - CCI-001090 - V-286462 - SV-286462r1256822_rule
RMF Control
SC-4
Severity
L
CCI
CCI-001090
Version
KNOX-17-010300
Vuln IDs
  • V-286462
Rule IDs
  • SV-286462r1256822_rule
It may be possible to transfer work profile data on a DoW Android device to an unauthorized Chromebook if the user has the same Google account set up on the Chromebook. This may result in the exposure of sensitive DoW data. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91144r1256404_chk

Review the management tool to confirm Phone Hub has been disabled. On the management tool: 1. Open "Nearby notification streaming policy". 2. Verify "Nearby notification streaming policy" is set to "Disabled". 3. Open "Nearby app streaming policy". 4. Verify "Nearby app streaming policy" is set to "Disabled". If on the management tool the "Nearby Streaming Policy" is not set to "Disabled", this is a finding. Note: From a Chromebook, if a device is connected to the Phone Hub, try to set up the notifications. It will fail to connect to the device to complete the setup if Phone Hub has been disabled on the DoW Android device.

Fix: F-91049r1256405_fix

Configure the Samsung device to disable the nearby notification and app streaming policy to disable Phone Hub. On the management tool: 1. Open "Nearby notification streaming policy". 2. Set "Nearby notification streaming policy" to "Disabled". 3. Open "Nearby app streaming policy". 4. Set "Nearby app streaming policy" to "Disabled".

b
Samsung Android 17 must disable the ability of the user to wipe the device.
CM-6 - Medium - CCI-000366 - V-286463 - SV-286463r1256409_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-010500
Vuln IDs
  • V-286463
Rule IDs
  • SV-286463r1256409_rule
This feature must be disabled in order to comply with DoW electronic records retention requirements for mobile devices. Otherwise, mobile device users could wipe the device, which would violate DoW policy. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91145r1256407_chk

Verify the Android device user has been trained to not perform a factory wipe without the approval of the authorizing official (AO). Confirm by reviewing the site's mobile device training records or the User Agreement. This is a User-Based Enforcement (UBE) control. If the Android device user has not been trained to not perform a factory wipe without the approval of the AO, this is a finding.

Fix: F-91050r1256408_fix

Train users to not perform a factory reset on the Android device without AO approval. Document training via the site's mobile device training records or the User Agreement. This is a User-Based Enforcement (UBE) control. Note: It is not possible for the MDM to enforce this control when the Android device is deployed in COPE mode.

a
Samsung Android 17 must disable wireless printing.
CM-6 - Low - CCI-000366 - V-286464 - SV-286464r1256412_rule
RMF Control
CM-6
Severity
L
CCI
CCI-000366
Version
KNOX-17-010700
Vuln IDs
  • V-286464
Rule IDs
  • SV-286464r1256412_rule
Wireless printing allows the printing of sensitive DoW documents to non-DoW controlled printers, which may lead to the exposure of sensitive DoW information. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91146r1256410_chk

Review configuration settings to confirm wireless printing has been disabled. This check procedure is performed on the device management tool and the Samsung Android 17 device. On the MDM console: COBO/COPE procedures: 1. Open user restrictions. 2. Verify that "Disallow printing" is enabled. On the managed Samsung Android 16 device: COBO/COPE procedures: 1. Open a document or image from the file app and try to print. 2. Verify that the document/image does not print. If wireless printing has not been disabled, this is a finding.

Fix: F-91051r1256411_fix

Configure Samsung Android 17 device to disable wireless printing. On the MDM console, do the following: COBO procedures: 1. Open user restrictions. 2. Enable "Disallow printing". COPE procedures: 1. Open user restrictions. 2. Enable "Disallow printing".

a
Samsung Android 17 must disable screen capture.
CM-6 - Low - CCI-000366 - V-286465 - SV-286465r1256415_rule
RMF Control
CM-6
Severity
L
CCI
CCI-000366
Version
KNOX-17-010800
Vuln IDs
  • V-286465
Rule IDs
  • SV-286465r1256415_rule
The feature screen capture could lead to the exposure of sensitive DoW information. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91147r1256413_chk

Review configuration settings to confirm screen capture has been disabled. This check procedure is performed on the device management tool and the Samsung Android 17 device. On the MDM console: COBO/COPE procedures: 1. Open Camera, screen capture, and audio section. 2. Verify that "Disable Screen Capture" setting is enabled. On the managed Samsung Android 17 device: COBO: 1. Press the power button and the volume down button at the same time. Verify that the message "Taking screenshots is blocked by your admin" is displayed. COPE: 1. Open a work profile app. 2. Press the power button and the volume down button at the same time. Verify that the message "Taking screenshots is blocked by your admin" is displayed. If screen capture has not been disabled, this is a finding.

Fix: F-91052r1256414_fix

Configure Samsung Android 17 to disable screen capture. On the MDM console, do the following: COBO procedures: 1. Open Camera, screen capture, and audio section. 2. Enable the "Disable Screen Capture" setting. COPE procedures: 1. Open Camera, screen capture, and audio section. 2. Enable the "Disable Screen Capture" setting.

b
Samsung Android 17 devices must have a Mobile Threat Detection (MTD) app installed.
CM-6 - Medium - CCI-000366 - V-286466 - SV-286466r1256464_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-010900
Vuln IDs
  • V-286466
Rule IDs
  • SV-286466r1256464_rule
DoW mobile devices are in constant risk of cyber threats. Mobile Threat Detection (MTD) apps mitigate these risks by providing real-time threat detection, malware prevention, and vulnerability analysis. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91148r1256462_chk

Confirm a MTD app is installed on managed Samsung Android devices. This check procedure is performed on both the device management tool and the Samsung Android device. In the MDM console, verify a MTD app is listed as a managed app being deployed to site managed devices. On the Samsung Android device: 1. Open the Settings app. 2. Tap "Apps" then "See all apps". 3. Verify an MTD app is listed. If a MTD app is not installed on the device, this is a finding.

Fix: F-91053r1256463_fix

Install an MTD app on managed Samsung Android devices.

b
Samsung Android 17 must implement the management setting: Disable camera.
CM-6 - Medium - CCI-000366 - V-286467 - SV-286467r1256823_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-011000
Vuln IDs
  • V-286467
Rule IDs
  • SV-286467r1256823_rule
Authorizing official (AO) approval is required before the mobile device camera can be enabled for a specific user or group of users, based on a risk assessment of the operational environment. Camera use may lead to the exposure of sensitive DoW information in some operational environments. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91149r1256465_chk

Determine if the site AO has approved the use of device cameras. Look for a document showing approval for a specific user or group of users. If not approved, review configuration settings to confirm "Allow Camera" is disabled. If approved, this requirement is not applicable. Review configuration settings to confirm the device camera has been disabled. This check procedure is performed on the device management tool and the Samsung Android 17 device. On the MDM console: COBO/COPE procedures: 1. Open camera. 2. Verify the "disable camera" setting is disabled. On the managed Samsung Android 17 device: COBO and COPE: 1. Verify the camera cannot be used on the mobile device. If the device camera has not been disabled, this is a finding.

Fix: F-91054r1256419_fix

If the AO has not approved the use of device camera, configure Samsung Android 17 to disable the device camera. On the MDM console, do the following: COBO/COPE procedures: 1. Open camera. 2. Select "Disable camera".

b
The Samsung Android device must be configured to disable Wi-Fi Aware for work profile apps.
CM-6 - Medium - CCI-000366 - V-286468 - SV-286468r1256423_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-011200
Vuln IDs
  • V-286468
Rule IDs
  • SV-286468r1256423_rule
Wi-Fi Aware allows direct connections between nearby devices for fast data transfer, video streaming, and multiplayer gaming. It allows full peer-to-peer device discovery and communication where two or more devices are publishing and/or subscribing to the same known service name. There is risk that sensitive DoW information could be transferred from a DoW mobile device to a non-DoW device or from work profile apps on a DoW device to Personal Profile apps on a non-DoW device. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91150r1256421_chk

Review device configuration settings to confirm Wi-Fi Aware is disabled for each work profile app. This procedure is performed on the EMM console. For each work profile app, verify the app is configured to deny the NEARBY_WIFI_DEVICE permission. Note: Not all apps will support Wi-Fi Aware and have the NEARBY_WIFI_DEVICE permission. If on the EMM console, the NEARBY_WIFI_DEVICE permission is not set to "deny" for all work profile apps that support Wi-Fi Aware, this is a finding.

Fix: F-91055r1256422_fix

Configure the Samsung Android 17 device to disable Wi-Fi Aware for all work profile apps. On the EMM console: For each work profile app, configure the NEARBY_WIFI_DEVICE permission to "deny" to block the use of Wi-Fi Aware, if the app supports this feature. If the app does not support Wi-Fi Aware, there may not be a NEARBY_WIFI_DEVICE permission available.

b
The Samsung Android 17 device must be configured to disable Cross-Device Handoff (also called "Continuity On").
CM-6 - Medium - CCI-000366 - V-286469 - SV-286469r1256426_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-011300
Vuln IDs
  • V-286469
Rule IDs
  • SV-286469r1256426_rule
Cross-Device Handoff (also called "Continuity On") permits a user of an Android phone to transition user activities from one device to another. Handoff passes sufficient information between the devices to describe the activity, but app data synchronization associated with the activity is handled though the cloud, which should be disabled on compliant Android devices. If a user associates both DoW and personal devices to the same Google account, the user may improperly reveal information about the nature of the user's activities on an unprotected device. Disabling Cross-Device Handoff mitigates this risk. SFR ID: FMT_MOF_EXT.1.2 #47
Checks: C-91151r1256424_chk

Review device configuration settings to disable Cross-Device Handoff (also called "Continuity On"). This procedure is performed on the EMM console. Verify "TASK_CONTINUITY_HANDOFF_DISABLED" is enabled. If on the EMM console Cross-Device Handoff is not disabled, this is a finding.

Fix: F-91056r1256425_fix

Configure the Samsung Android 17 device to disable Cross-Device Handoff (also called "Continuity On"). On the EMM console: COBO and COPE: 1. Open user restrictions. 2. Enable "TASK_CONTINUITY_HANDOFF_DISABLED". API: TASK_CONTINUITY_HANDOFF_DISABLED

b
The Samsung Android 17 device must be configured to disable web-based artificial intelligence (AI) interactions.
CM-6 - Medium - CCI-000366 - V-286470 - SV-286470r1256825_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
KNOX-17-011400
Vuln IDs
  • V-286470
Rule IDs
  • SV-286470r1256825_rule
Sensitive DoW data could be exposed when an AI app processes device data in the cloud. SFR ID: FMT_SMF.1.1 #47
Checks: C-91152r1256441_chk

Verify the Samsung Android 17 device has been configured to disable web-based AI interactions. On the Android 17 phone, try to browse to unauthorized AI URLs. Examples of input include chatgpt.com, claude.ai, gemini.google.com, and v0.dev. Verify the unauthorized AI websites cannot be reached. If the Samsung Android 17 device has not been configured to disable web-based AI interactions, this is a finding.

Fix: F-91057r1256824_fix

Configure the Samsung Android 17 device to disable web-based AI interactions. For web-based AI in the browser: Create an App Configuration Policy: (Requires EMM Admin access) 1. Navigate to your EMM's Policy/App Configuration section and create a new policy targeted at Managed Devices/Android Enterprise. Select the Browser (Google Chrome) as the targeted application. Configure the URL Blocklist: Locate the URLBlocklist setting. Add the domains of the AI tools to be blocked. Examples of input include chatgpt.com, claude.ai, gemini.google.com, and v0.dev. Block Incognito Mode: 1. In the same Chrome configuration layout, look for IncognitoModeAvailability. 2. Set Incognito Mode to disabled. This ensures that users cannot bypass the URL block list by launching an anonymous browsing session. Assign and Push: Save the configuration and assign it to the device groups containing the user's COBO and COPE profiles. Configuration for other browsers depends on the deployment type. COBO: Because the first step limits the managed Google Play store to only approved apps, ensure no other browsers (like Firefox, Opera, or Edge) are approved in the app allow list. COPE: Create a Device Restrictions Policy for the Personal Profile and set "Disallow install of applications from unknown sources" to "True".