Cyber Trackr - Free Compliance Library
Cyber Trackr
The Free Compliance Library

Samsung Android OS 6 (with KNOX 2.x) Security Technical Implementation Guide

  • Version/Release: V1R1
  • Published: 2016-06-29
  • Released: 2016-06-27
  • Expand All:
  • Severity:
  • Sort:
Compare

Select any two versions of this STIG to compare the individual requirements

View

Select any old version/release of this STIG to view the previous requirements

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
b
All mobile operating system cryptography supporting DoD functionality must be FIPS 140-2 validated.
SC-13 - Medium - CCI-001145 - V-69589 - SV-84211r1_rule
RMF Control
SC-13
Severity
Medium
CCI
CCI-001145
Version
KNOX-30-000100
Vuln IDs
  • V-69589
Rule IDs
  • SV-84211r1_rule
Unapproved cryptographic algorithms cannot be relied upon to provide confidentiality or integrity, and DoD data could be compromised as a result. The most common vulnerabilities with cryptographic modules are those associated with poor implementation. FIPS 140-2 validation provides assurance that the relevant cryptography has been implemented correctly. FIPS 140-2 validation is also a strict requirement for use of cryptography in the Federal Government for protecting unclassified data. SFR ID: FCS
Checks: C-70007r1_chk

Note: This validation procedure is identical to the one for KNOX-39-015600. It only needs to be performed once. If it is found compliant on the first check, it is also compliant here. If it is determined to be a finding on the first check, it is also a finding here. Redundant checks are necessary to maintain requirements traceability and provide complete risk management information to Authorizing Officials (AOs). This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "CC Mode" settings in the "Android Restrictions" rule. 2. Verify the value is enabled. Note: If the MDM does not support CC mode, ask the MDM administrator if the Samsung APK has been installed and CC mode enabled. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "About Device". 3. Select "Software info". (Note: On some devices, this step is not needed.) 4. Verify the value of "Security software version" displays "Enforced". If the CC mode setting is not enabled, or if the "Security software version" on the device does not display "Enforced", this is a finding.

Fix: F-75763r1_fix

Configure the mobile operating system to use a FIPS 140-2 validated cryptographic module. Configure the operating system to enable CC mode. On the MDM Administration Console, enable the "CC mode" setting in the "Android Restrictions" rule. If this setting is not available on the console, install the CC mode APK, and enable CC mode from this application. This APK will be made available by Samsung.

c
The Samsung KNOX for Android platform must protect data at rest on built-in storage media.
SC-28 - High - CCI-001199 - V-69591 - SV-84213r1_rule
RMF Control
SC-28
Severity
High
CCI
CCI-001199
Version
KNOX-30-004400
Vuln IDs
  • V-69591
Rule IDs
  • SV-84213r1_rule
The mobile operating system must ensure the data being written to the mobile device's built-in storage media is protected from unauthorized access. If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can read storage media directly, thereby circumventing operating system controls. Encrypting the data ensures confidentiality is protected even when the operating system is not running. SFR ID: FMT_SMF_EXT.1.1 #25
Checks: C-70009r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Storage Encryption" check box in the "Android Restrictions" rule. (**) 2. Verify the "Storage Encryption" check box is selected. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "Lock screen and security". 3. Select "Secure startup". (Note: On some devices, shown as "Protect encrypted data".) 4. Verify "Do not require" is grayed out and "Require password when device turns on" is selected. (Note: On some devices, shown as "Require screen lock to decrypt data when device turns on".) 5. Insert a MicroSD card into the device. 6. If the MicroSD card is not already encrypted, select "Encrypt SD card". Verify "The security policy restricts use of SD cards that are not encrypted" is displayed. 7. If the MicroSD card is encrypted, verify "Decrypt SD card" is displayed and cannot be selected. If the specified encryption settings are not set to the appropriate values, this is a finding. (**) On some MDM vendor consoles, "Storage Encryption" enables both internal and external storage encryption. Note: Starting with the Galaxy S7, new devices that ship with Android 6.0 will have device encryption enabled by default that cannot be disabled.

Fix: F-75765r1_fix

Configure the mobile operating system to enable data-at-rest protection for built-in storage media. Configure the OS to encrypt all data at rest on the mobile device. On the MDM Administration Console, check the "Storage Encryption" check box in the "Android Restrictions" rule.

c
The Samsung KNOX for Android platform must protect data at rest on removable storage media.
SC-28 - High - CCI-001199 - V-69593 - SV-84215r1_rule
RMF Control
SC-28
Severity
High
CCI
CCI-001199
Version
KNOX-30-004410
Vuln IDs
  • V-69593
Rule IDs
  • SV-84215r1_rule
The mobile operating system must ensure the data being written to the mobile device's removable media is protected from unauthorized access. If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can read removable media directly, thereby circumventing operating system controls. Encrypting the data ensures confidentiality is protected even when the operating system is not running. SFR ID: FMT_SMF_EXT.1.1 #26
Checks: C-70011r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Storage Encryption" check box in the "Android Restrictions" rule. (**) 2. Verify the "Storage Encryption" check box is selected. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "Lock screen and security". 3. Insert a MicroSD card into the device. 4. If the MicroSD card is not already encrypted, select "Encrypt SD card". Verify "The security policy restricts use of SD cards that are not encrypted" is displayed. 5. If the MicroSD card is encrypted, verify "Decrypt SD card" is displayed and cannot be selected. If the specified encryption settings are not set to the appropriate values, this is a finding. (**) On some MDM vendor consoles, "Storage Encryption" enables both internal and external storage encryption. Note: Starting with the Galaxy S7, new devices that ship with Android 6.0 will have device encryption enabled by default that cannot be disabled.

Fix: F-75767r1_fix

Configure the mobile operating system to enable data-at-rest protection for removable media. Configure the OS to encrypt all data at rest on the mobile device. On the MDM Administration Console, select the "Storage Encryption" and "External Storage Encryption" check box in the "Android Restrictions" rule.

a
The Samsung KNOX for Android platform must enforce a minimum password length of six characters.
IA-5 - Low - CCI-000205 - V-69595 - SV-84217r1_rule
RMF Control
IA-5
Severity
Low
CCI
CCI-000205
Version
KNOX-34-008700
Vuln IDs
  • V-69595
Rule IDs
  • SV-84217r1_rule
Password strength is a measure of the effectiveness of a password in resisting guessing and brute force attacks. The ability to crack a password is a function of how many attempts an adversary is permitted, how quickly an adversary can do each attempt, and the size of the password space. The longer the minimum length of the password is, the larger the password space. Having a too-short minimum password length significantly reduces password strength, increasing the chance of password compromise and resulting device and data compromise. SFR ID: FMT_SMF_EXT.1.1 #01a
Checks: C-70013r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Min Length" setting in the "Android Password Restrictions" rule. 2. Verify the value of the setting is the same or greater than the required length. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "Lock screen and security". 3. Select "Screen lock type". 4. Enter current password. 5. Select "Password". 6. Attempt to enter a password with fewer characters than the required length. 7. Verify the password is not accepted. If the configured value of the "Min Length" setting is less than the required length or if the device accepts a password of less than the required length, this is a finding.

Fix: F-75769r1_fix

Configure the mobile operating system to enforce a minimum password length of six characters. On the MDM Administration Console, set the "Min Length" value to "6" or greater in the "Android Password Restrictions" rule. Note: When device encryption is enabled (always enabled by the DoD configuration), Samsung KNOX for Android automatically enforces a minimum length of "6".

a
The Samsung KNOX for Android platform must not allow more than 10 consecutive failed authentication attempts.
AC-7 - Low - CCI-000044 - V-69597 - SV-84219r1_rule
RMF Control
AC-7
Severity
Low
CCI
CCI-000044
Version
KNOX-34-008900
Vuln IDs
  • V-69597
Rule IDs
  • SV-84219r1_rule
The more attempts an adversary has to guess a password, the more likely the adversary will enter the correct password and gain access to resources on the device. Setting a limit on the number of attempts mitigates this risk. Setting the limit at 10 gives authorized users the ability to make a few mistakes when entering the password but still provides adequate protection against dictionary or brute force attacks on the password. SFR ID: FMT_SMF_EXT.1.1 #02
Checks: C-70015r1_chk

This validation procedure is performed only on the MDM Administration Console. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Maximum Failed Attempts" field in the "Android Password Restrictions" rule for the device unlock password. 2. Verify the value of the setting is 10 or less. This configuration is not available on the Samsung KNOX for Android device. If the "Maximum Failed Attempts" field in the "Android Password Restrictions" rule for the device unlock password is not set to "10" or less, this is a finding.

Fix: F-75771r1_fix

Configure the mobile operating system to allow only 10 or less consecutive failed authentication attempts. On the MDM Administration Console, set the "Maximum Failed Attempts" to "10" or less in the "Android Password Restrictions" rule for the device unlock password.

b
The Samsung KNOX for Android platform must lock the display after 15 minutes (or less) of inactivity.
AC-11 - Medium - CCI-000057 - V-69599 - SV-84221r1_rule
RMF Control
AC-11
Severity
Medium
CCI
CCI-000057
Version
KNOX-34-012100
Vuln IDs
  • V-69599
Rule IDs
  • SV-84221r1_rule
The screen lock timeout must be set to a value that helps protect the device from unauthorized access. Having a too-long timeout would increase the window of opportunity for adversaries who gain physical access to the mobile device through loss, theft, etc. Such devices are much more likely to be in an unlocked state when acquired by an adversary, thus granting immediate access to the data on the mobile device. The maximum timeout period of 15 minutes has been selected to balance functionality and security; shorter timeout periods may be appropriate depending on the risks posed to the mobile device. SFR ID: FMT_SMF_EXT.1.1 #01b
Checks: C-70019r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Max Time to Lock" setting in the "Android Password Restrictions" rule. 2. Verify the value of the setting is 15 minutes or less. On the Samsung KNOX for Android device: 1. Unlock the device. 2. Refrain from performing any activity on the device for 15 minutes. 3. Verify the device requires the user to enter the device unlock password to access the device. Note: On some devices, the max time to lock is the sum of the display screen timeout setting and the secured lock time setting on the device. On MDM configuration, the device makes a choice for these settings so the sum is 15 minutes or less. If the user does not have to unlock the device after 15 minutes of inactivity, this is a finding.

Fix: F-75775r1_fix

Configure the mobile operating system to lock the device display after 15 minutes (or less) of inactivity. On the MDM Administration Console, configure the "Max Time to Lock" option to 15 minutes in the "Android Password Restrictions" rule.

b
The Samsung KNOX for Android platform must lock the container after 15 minutes (or less) of inactivity.
CM-6 - Medium - CCI-000366 - V-69601 - SV-84223r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-34-012110
Vuln IDs
  • V-69601
Rule IDs
  • SV-84223r1_rule
The screen lock timeout must be set to a value that helps protect the device from unauthorized access. Having a too-long timeout would increase the window of opportunity for adversaries who gain physical access to the mobile device through loss, theft, etc. Such devices are much more likely to be in an unlocked state when acquired by an adversary, thus granting immediate access to the data on the mobile device. The maximum timeout period of 15 minutes has been selected to balance functionality and security; shorter timeout periods may be appropriate, depending on the risks posed to the mobile device. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70033r1_chk

This check procedure is performed on both the MDM Administration Console and the Samsung KNOX device. Check that the appropriate setting is configured on the MDM Administration Console. 1. Ask the MDM administrator to display the "Max Time to Lock" setting in the "Android KNOX Container >> Container Password Restrictions" rule. 2. Verify the value of the setting is the organization-defined value (15 minutes) or less. On the Samsung KNOX for Android device: 1. Open the KNOX Container. 2. Refrain from using the KNOX Container for 15 minutes. 3. Verify the selected value is the organization-defined value (15 minutes) or less. If the selected value is larger than 15 minutes, or if the KNOX Container does not lock after 15 minutes, this is a finding.

Fix: F-75789r1_fix

Configure the mobile operating system to initiate a session lock after a time period of inactivity. Configure the mobile operating system to lock the device after no more than 15 minutes of inactivity. On the MDM Console, set the "Max Time to Lock" to the organization-defined value (15 minutes) in the "Android KNOX Container >> Container Password Restrictions" rule.

b
The Samsung KNOX for Android platform must be configured to disable Google Play.
CM-6 - Medium - CCI-000366 - V-69603 - SV-84225r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-009000
Vuln IDs
  • V-69603
Rule IDs
  • SV-84225r1_rule
Forcing all applications to be installed from authorized application repositories can prevent unauthorized and malicious applications from being installed and executed on mobile devices. Allowing such installations and executions could cause a compromise of DoD data accessible by these unauthorized/malicious applications. SFR ID: FMT_SMF_EXT.1.1 #10a
Checks: C-70039r2_chk

Configuring an application installation policy on Samsung KNOX for Android by specifying an application repository involves two steps: 1. Disabling Google Play 2. Disabling unknown application sources This validation procedure covers the first of these steps. It is performed on both the MDM Administration Console and the Samsung KNOX for Android device. On the MDM Administration Console: 1. Ask the MDM administrator to display the "Enable Google Play" setting in the "Android Restrictions" rule (non-work environment). 2. Verify it is disabled. On the Samsung KNOX for Android device: 1. Attempt to locate the "Google Play" application. 2. Verify it is not present on the device. If the "Enable Google Play" is not disabled, or if a user can successfully launch Google Play on the device, this is a finding.

Fix: F-75793r1_fix

Configure the mobile operating system to disable unauthorized application repositories. Configure the mobile operating system to disable Google Play. On the MDM Administration Console, disable "Enable Google Play" in the "Android Restrictions" rule.

b
The Samsung KNOX for Android platform must enforce an application installation policy by disabling application installation from unknown sources.
CM-6 - Medium - CCI-000366 - V-69605 - SV-84227r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-009010
Vuln IDs
  • V-69605
Rule IDs
  • SV-84227r1_rule
Forcing all applications to be installed from authorized application repositories can prevent unauthorized and malicious applications from being installed and executed on mobile devices. Allowing such installations and executions could cause a compromise of DoD data accessible by these unauthorized/malicious applications. SFR ID: FMT_SMF_EXT.1.1 #10a
Checks: C-70041r1_chk

Configuring an application installation policy on Samsung KNOX for Android by specifying an application repository involves two steps: 1. Disabling Google Play 2. Disabling unknown application sources This validation procedure covers the second of these steps. It is performed on both the MDM Administration Console and the Samsung KNOX for Android device. On the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Unknown Sources" settings in the "Android Restrictions" rule. 2. Verify it is disabled. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "Lock screen and security". 3. Attempt to enable "Unknown sources". 4. Verify it cannot be enabled. If the "Allow Unknown Sources" setting is not disabled, or if a user can successfully enable "Unknown sources" on the device, this is a finding.

Fix: F-75795r1_fix

Configure the mobile operating system to disable unauthorized application repositories. Configure the mobile operating system to disable application installations from unknown sources. On the MDM Administration Console, disable "Allow Unknown Sources" in the "Android Restrictions" rule.

b
The Samsung KNOX for Android platform must enforce an application installation policy by specifying an application whitelist.
CM-6 - Medium - CCI-000366 - V-69607 - SV-84229r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-009100
Vuln IDs
  • V-69607
Rule IDs
  • SV-84229r1_rule
Requiring all authorized applications to be in an application whitelist prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the whitelist. Failure to configure an application whitelist properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DoD data accessible by these applications. The application whitelist, in addition to controlling the installation of applications on the MD, must control user access/execution of all core applications (included in the operating system [OS] by the OS vendor) and pre-installed applications (provided by the mobile device vendor and wireless carrier), or the mobile device must provide an alternate method of restricting user access/execution to core and pre-installed applications. SFR ID: FMT_SMF_EXT.1.1 #10b
Checks: C-70043r1_chk

This validation procedure is performed on the MDM Administration Console. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the list of whitelisted applications in the "Android Applications" rule. 2. Verify the list of whitelisted applications has been approved by the Authorizing Official (AO). Note: This list can be empty if no applications have been approved. Note: Refer to the Supplemental document for additional information. If any of the applications on the list of whitelisted applications on the MDM Administration Console have not been approved by the Authorizing Official (AO), this is a finding.

Fix: F-75797r2_fix

Configure the mobile operating system to use an application whitelist. On the MDM Administration Console, configure the list of whitelisted applications in the "Android Applications" rule and ensure only AO-approved applications are on the list. Note: This list can be empty if no applications have been approved. Note: Refer to the Supplemental document for additional information.

b
The Samsung KNOX for Android platform must not allow use of developer modes.
CM-7 - Medium - CCI-000381 - V-69609 - SV-84231r1_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
KNOX-35-020000
Vuln IDs
  • V-69609
Rule IDs
  • SV-84231r1_rule
Developer modes expose features of the mobile operating system that are not available during standard operation. An adversary may leverage a vulnerability inherent in a developer mode to compromise the confidentiality, integrity, and availability of DoD-sensitive information. Disabling developer modes mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #24
Checks: C-70045r1_chk

This check procedure is performed on both the MDM Administration Console and the Samsung KNOX device. Check that the appropriate setting is configured on the MDM Administration Console. 1. Ask the MDM administrator to display the "Disable Developer Mode" settings in the "Android Restrictions" rule. 2. Verify that the "Disable Developer Mode" setting is enabled. Note: Disabling Developer mode will also disable USB Debugging and Mock Locations. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "Developer options". (**) 3. Attempt to enable "Developer options". If the "Disable Developer Mode" setting in the MDM console is disabled, or if the user can enable "Developer options" on the device, this is a finding. Note: The "Developer Modes" configuration setting may not be available in older MDM consoles. Disabling USB Debugging and Mock Locations also disables Developer modes on the mobile device. (**) "Developer options" is initially hidden to users. To unhide this menu item: 1. Open the device settings. 2. Select "About device". 3. Select "Software info". (Note: On some devices, this step is not needed.) 4. Rapidly tap on "Build number" multiple times until the device displays the Developer Options menu item.

Fix: F-75799r1_fix

Configure the mobile operating system to disable Developer modes. Configure the platform to disable Developer mode. On the MDM Administration Console, enable the "Disable Developer Mode" setting in the "Android Restrictions" rule.

b
The Samsung KNOX for Android platform must have DoD root and intermediate PKI certificates installed on the device.
CM-6 - Medium - CCI-000366 - V-69611 - SV-84233r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-020600
Vuln IDs
  • V-69611
Rule IDs
  • SV-84233r1_rule
DoD root and intermediate PKI certificates are used to verify the authenticity of PKI certificates of users and web services. If the root and intermediate certificates are not available, an adversary could falsely sign a certificate in such a way that it could not be detected. Providing access to the DoD root and intermediate PKI certificates greatly diminishes the risk of this attack. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70047r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. The current DoD root and intermediate PKI certificates may be obtained in self-extracting zip files at http://iase.disa.mil/pki-pke (for NIPRNet) or http://iase.rel.disa.smil.mil/pki-pke/function_pages/tools.html (for SIPRNet). Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the list of server authentication certificates in the "Android Certificate Configuration" rule. 2. Verify the DoD root and intermediate PKI certificates are present. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "Lock screen and security". 3. Select "Other security settings". 4. Select "View security certificates". 5. Review Certificate Authorities listed under the "System" and "User" tabs. 6. Verify the presence of the DoD root and intermediate certificates. If the DoD root and intermediate certificates are not present in the MDM Console whitelist or on the device, this is a finding.

Fix: F-75801r1_fix

Install DoD root and intermediate certificates on the device. On the MDM Console, add the PEM encoded representations of the DoD root and intermediate certificates to the certificate whitelist in the "Android Certificate Configuration" rule. The current DoD root and intermediate PKI certificates may be obtained in self-extracting zip files at http://iase.disa.mil/pki-pke (for NIPRNet) or http://iase.rel.disa.smil.mil/pki-pke/function_pages/tools.html (for SIPRNet).

b
The Samsung KNOX for Android platform must be configured to disable Allow New Admin Install.
CM-6 - Medium - CCI-000366 - V-69613 - SV-84235r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-021000
Vuln IDs
  • V-69613
Rule IDs
  • SV-84235r1_rule
An application with administrator permissions (e.g., MDM agent) is allowed to configure policies on the device. If a user is allowed to install another MDM agent on the device, this will allow another MDM administrator (assuming it has the proper KNOX licenses) the ability to configure potentially conflicting policies on the device that may not meet DoD security requirements. Although an MDM cannot disable another MDM's policies or remove another MDM from the device, there is the potential of creating policies that could conflict with enterprise policies. Therefore, other applications requesting administrator permissions should be blocked from installation. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70049r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow New Admin Install" setting in the "Android Restrictions" rule. 2. Verify the setting is disabled. Note: With some MDM consoles, this policy is automatically configured when the user enrolls with the MDM. Note: Android Device Manager must first be disabled on the device in order to successfully apply this policy. This can only be done manually on the device by selecting "Lock screen and security", then "Other security settings", then "Device administrators", and then disable Android Device Manager. On the Samsung KNOX for Android device: 1. Attempt to install an application that requires admin permissions. 2. Verify the application is blocked from being installed. If the "Allow New Admin Install" setting in the MDM console is enabled, or if the user is able to install another application requiring admin permissions on the device, this is a finding.

Fix: F-75803r1_fix

Configure the mobile operating system to disallow new admin installations. On the MDM Administration Console, disable the "Allow New Admin Install" setting in the "Android Restrictions" rule.

b
The Samsung KNOX for Android platform must have the Application Install Blacklist configured.
CM-6 - Medium - CCI-000366 - V-69615 - SV-84237r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-021100
Vuln IDs
  • V-69615
Rule IDs
  • SV-84237r1_rule
Blacklisting all applications is required so that only whitelisted applications can be installed on the device. Requiring all authorized applications to be in an application whitelist prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the whitelist. Failure to configure an application whitelist and blacklist properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DoD data accessible by these applications. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70051r1_chk

This validation procedure is performed on the MDM Administration Console. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Application install blacklist" setting in the "Android Applications" rule. 2. Verify the setting is configured to include all applications (specified by the wildcard string ".*"). If the "Application install blacklist" setting in the MDM console does not include all applications, this is a finding.

Fix: F-75805r1_fix

Configure the mobile operating system to add all applications to the install blacklist. On the MDM Administration Console, add all applications to the "Application install blacklist" setting in the "Android Applications" rule.

b
The Samsung KNOX for Android platform whitelist must not include any pre-installed (core) applications not approved for DoD use by the Authorizing Official (AO).
CM-6 - Medium - CCI-000366 - V-69617 - SV-84239r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-021200
Vuln IDs
  • V-69617
Rule IDs
  • SV-84239r1_rule
Requiring all authorized applications to be in an application whitelist prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the whitelist. Failure to configure an application whitelist properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DoD data accessible by these applications. SFR ID: FMT_SMF_EXT.1.1 #10b
Checks: C-70053r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Application disable list" setting in the "Android Application" rule. 2. Verify the list contains all pre-installed (core) applications not approved for DoD use by the Authorizing Official (AO). Note: Refer to the Supplemental document for additional information. If the "Application disable list" configuration is not properly configured, or if the user is able to launch the applications on the list, this is a finding. Note: Core applications are pre-installed on the device and include applications integrated into the Android OS by Google and applications added to the OS load by Samsung or by the carrier.

Fix: F-75807r1_fix

Configure the mobile operating system application whitelist to exclude applications with the following characteristics: - all pre-installed (core) applications not approved for DoD use by the Authorizing Official (AO). Configure the mobile operating system to disable pre-installed applications not approved for DoD use. On the MDM Administration Console, add all pre-installed applications not approved for DoD to the "Application disable list" setting in the "Android Applications" rule. Note: Refer to the Supplemental document for additional information.

b
The Samsung KNOX for Android platform whitelist must not include applications that allow synchronization of data or applications between devices associated with the user.
CM-6 - Medium - CCI-000366 - V-69619 - SV-84241r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-021225
Vuln IDs
  • V-69619
Rule IDs
  • SV-84241r1_rule
Requiring all authorized applications to be in an application whitelist prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the whitelist. Failure to configure an application whitelist properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DoD data accessible by these applications. SFR ID: FMT_SMF_EXT.1.1 #10b
Checks: C-70055r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Application disable list" setting in the "Android Application" rule. 2. Verify the list contains all pre-installed applications that allow synchronization of data or applications between devices associated with user. Note: The following applications are known to be pre-installed applications that allow synchronization of data or applications between devices associated with user, but other applications can be found on other devices: Google Drive, Dropbox, Verizon Cloud, AT&T Locker, Microsoft OneDrive, and Microsoft OneNote. Note: Refer to the Supplemental document for additional information. If the "Application disable list" configuration is not properly configured, or if the user is able to launch the applications on the list, this is a finding.

Fix: F-75809r2_fix

Configure the mobile operating system application whitelist to exclude applications with the following characteristics: - allows synchronization of data or applications between devices associated with user Configure the mobile operating system to disable all pre-installed applications that allow synchronization of data or applications between devices associated with user. On the MDM Administration Console, add all pre-installed applications that allow synchronization of data or applications between devices associated with user to the "Application disable list" setting in the "Android Applications" rule. Note: Refer to the Supplemental document for additional information.

b
The Samsung KNOX for Android platform whitelist must not include applications that process payments.
CM-6 - Medium - CCI-000366 - V-69621 - SV-84243r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-021250
Vuln IDs
  • V-69621
Rule IDs
  • SV-84243r1_rule
Requiring all authorized applications to be in an application whitelist prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the whitelist. Failure to configure an application whitelist properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DoD data accessible by these applications. SFR ID: FMT_SMF_EXT.1.1 #10b
Checks: C-70057r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Application disable list" setting in the "Android Application" rule. 2. Verify the list contains all pre-installed payment processing applications. Note: The following applications are known to be pre-installed payment processing applications, but other applications can be found on other devices: Wallet, Isis Wallet, Softcard, Samsung Pay. Note: Refer to the Supplemental document for additional information. If the "Application disable list" configuration is not properly configured, or if the user is able to launch the applications on the list, this is a finding.

Fix: F-75811r2_fix

Configure the mobile operating system application whitelist to exclude applications with the following characteristics: - payment processing Configure the mobile operating system to disable pre-installed payment processing applications. On the MDM Administration Console, add all pre-installed payment processing applications to the "Application disable list" setting in the "Android Applications" rule. Note: Refer to the Supplemental document for additional information.

b
The Samsung KNOX for Android platform whitelist must not include applications that back up device data to non-DoD cloud servers (including user and application access to cloud backup services).
CM-6 - Medium - CCI-000366 - V-69623 - SV-84245r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-021275
Vuln IDs
  • V-69623
Rule IDs
  • SV-84245r1_rule
Requiring all authorized applications to be in an application whitelist prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the whitelist. Failure to configure an application whitelist properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DoD data accessible by these applications. SFR ID: FMT_SMF_EXT.1.1 #10b
Checks: C-70059r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Application disable list" setting in the "Android Application" rule. 2. Verify the list contains all pre-installed applications that back up mobile device data to non-DoD cloud servers (including user and application access to cloud backup services). Note: The following applications are known to be pre-installed public cloud applications, but other applications can be found on other devices: Google Drive, Dropbox, Verizon Cloud, AT&T Locker, Microsoft OneDrive, and Microsoft OneNote. Note: The following applications allows a user to configure a Samsung Account on the device that allows the user to back up files (including S Health data) to Samsung servers, as well as download applications from Samsung Apps (Galaxy Apps) store: Samsung Account application. Note: Refer to the Supplemental document for additional information. If the "Application disable list" configuration is not properly configured, or if the user is able to launch the applications on the list, this is a finding.

Fix: F-75813r2_fix

Configure the mobile operating system application whitelist to exclude applications with the following characteristics: - back up mobile device data to non-DoD cloud servers (including user and application access to cloud backup services) Configure the mobile operating system to disable pre-installed applications that back up mobile device data to non-DoD cloud servers (including user and application access to cloud backup services). On the MDM Administration Console, add all pre-installed applications that back up mobile device data to non-DoD cloud servers (including user and application access to cloud backup services) to the "Application disable list" setting in the "Android Applications" rule. Note: Refer to the Supplemental document for additional information.

b
The Samsung KNOX for Android platform must be configured to disable backup to remote systems.
CM-6 - Medium - CCI-000366 - V-69625 - SV-84247r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-021300
Vuln IDs
  • V-69625
Rule IDs
  • SV-84247r1_rule
Backups to remote systems (including cloud backup) can leave data vulnerable to breach on the external systems, which often offer less protection than the mobile operating system. Where the remote backup involves a cloud-based solution, the backup capability is often used to synchronize data across multiple devices. In this case, DoD devices may synchronize DoD-sensitive information to a user's personal device or other unauthorized computers that are vulnerable to breach. Disallowing remote backup mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #40
Checks: C-70061r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Google Backup" and "Google Auto Sync" settings in the "Android Restrictions" rule. 2. Verify the settings are disabled. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "Backup and reset" under the Google account section. 3. Verify "Back up my data" is disabled and cannot be enabled. If the "Allow Google Backup" or “Google Auto Sync" setting is enabled, this is a finding. If the user can enable the settings on the device, this is a finding. If the "Application disable list" configuration in the MDM console does not contain all pre-installed public cloud backup applications, or if the user is able to successfully launch an application on this list, this is a finding.

Fix: F-75815r1_fix

Configure the mobile operating system to disable backup to remote systems (including commercial clouds). Configure the mobile device to disable backups to Google servers, disable Google Auto Sync, and disable all pre-installed public cloud backup applications. On the MDM Administration Console, disable the "Allow Google backup" and "Google Auto Sync" settings in the "Android Restrictions" rule.

a
The Samsung KNOX for Android platform must be configured to disable Google Crash Report.
CM-7 - Low - CCI-000381 - V-69627 - SV-84249r1_rule
RMF Control
CM-7
Severity
Low
CCI
CCI-000381
Version
KNOX-35-021400
Vuln IDs
  • V-69627
Rule IDs
  • SV-84249r1_rule
Many software systems automatically send diagnostic data to the manufacturer or a third party. This data enables the developers to understand real-world field behavior and improve the product based on that information. Unfortunately, it can also reveal information about what DoD users are doing with the systems and what causes them to fail. An adversary embedded within the software development team or elsewhere could use the information acquired to breach mobile operating system security. Disabling automatic transfer of such information mitigates this risk. SFR ID: FMT_SMF_EXT.1.1#45
Checks: C-70063r1_chk

Disabling automatic transfer of diagnostic data to an external device on Samsung KNOX for Android involves three steps: 1. Disable Google Crash report 2. Configure a KNOX on-premise license 3. Disable Report diagnostic info. This validation procedure covers the first of these steps. This validation procedure is performed on the MDM Administration Console. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Google Crash Report" setting in the "Android Restrictions" rule. 2. Verify the setting is disabled. If the "Google Crash Report" configuration in the MDM console is enabled, this is a finding.

Fix: F-75817r1_fix

Configure the mobile operating system to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled. Configure the mobile operating system to disable Google Crash Report. On the MDM Administration Console, disable the "Google Crash Report" setting in the "Android Restrictions" rule.

b
The Samsung KNOX for Android platform must be configured to disable USB host storage.
CM-6 - Medium - CCI-000366 - V-69629 - SV-84251r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-021600
Vuln IDs
  • V-69629
Rule IDs
  • SV-84251r1_rule
The USB host storage feature allows the device to connect to select USB devices (e.g., USB flash drives, USB mouse, USB keyboard) using a micro USB to USB adapter cable. A user can copy sensitive DoD information to external USB storage unencrypted, resulting in compromise of DoD data. Disabling this feature mitigates the risk of compromising sensitive DoD data. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70065r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "USB host storage" setting in the "Android Restrictions" rule. 2. Verify the setting is disabled. On the Samsung KNOX for Android device: 1. Connect a Micro USB to USB OTG adaptor to the device. 2. Connect a USB thumb drive to the adaptor. 3. Verify the device cannot access the USB thumb drive. If the "USB host storage" configuration in the MDM console is enabled, or if the user is able to access the USB thumb drive from the device, this is a finding.

Fix: F-75819r1_fix

Configure the mobile operating system to disable USB host storage. On the MDM Administration Console, disable the "USB host storage" setting in the "Android Restrictions" rule.

a
The Samsung KNOX for Android platform must not allow passwords that include more than two repeating or sequential characters.
CM-6 - Low - CCI-000366 - V-69631 - SV-84253r1_rule
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
KNOX-35-021900
Vuln IDs
  • V-69631
Rule IDs
  • SV-84253r1_rule
Password strength is a measure of the effectiveness of a password in resisting guessing and brute force attacks. Passwords that contain repeating or sequential characters are significantly easier to guess than those that do not contain repeating or sequential characters. Therefore, disallowing repeating or sequential characters increases password strength and decreases risk. SFR ID: FMT_SMF_EXT.1.1 #01b
Checks: C-70067r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Max Sequential Characters" and "Max Sequential Numbers" settings in the "Android Password Restrictions" rule. 2. Verify the value of the setting is the same or less than the required length. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "Lock screen and security". 3. Select "Screen lock type". 4. Enter current password. 5. Select "Password". 6. Attempt to enter a password that contains sequential characters or sequential numbers of length greater than the required length. 7. Verify the password is not accepted. If the configured values of the "Max Sequential Character" and "Max Sequential Number" settings are greater than the required length, or if the device accepts a password that contains sequential characters or sequential numbers of length greater than the required length, this is a finding. Note: On some MDM servers, there may only be one configuration setting ("Max Sequential Characters") since this API actually disables both sequential and repeating characters.

Fix: F-75821r1_fix

Configure the mobile operating system to prevent passwords from containing more than two repeating or sequential characters. On the MDM Administration Console, set the "Max Sequential Characters" and "Max Sequential Numbers" values to "2" in the "Android Password Restrictions" rule.

b
The Samsung KNOX for Android platform must be configured to disable Multi-User mode.
CM-6 - Medium - CCI-000366 - V-69633 - SV-84255r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-022500
Vuln IDs
  • V-69633
Rule IDs
  • SV-84255r1_rule
By default, the enterprise administrator will install and enroll MDM on the device's owner user space. Since some policies configured by the MDM will only apply to the owner space, the user can bypass some of these policies by creating and switching to a guest user space. This can potentially result in compromise of the device and DoD data via installation of malicious applications. Disabling this feature will mitigate this risk. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70069r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow multi-user mode" settings in the "Android Restrictions" rule. 2. Verify the setting is disabled. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Attempt to add a user in the "User" setting. 3. Verify that the "User" setting is not available. If the "Allow multi-user mode" setting is enabled, or if the user is able to add a user, this is a finding.

Fix: F-75823r1_fix

Configure the mobile operating system to disable multi-user modes. On the MDM Administration Console, disable the "Allow multi-user mode" setting in the "Android Restrictions" rule. Note: This requirement is only applicable for tablet devices.

b
The Samsung KNOX for Android platform must be configured to disable S Voice.
CM-6 - Medium - CCI-000366 - V-69635 - SV-84257r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-022800
Vuln IDs
  • V-69635
Rule IDs
  • SV-84257r1_rule
On mobile operating system devices, users may be able to access the device's contact database or calendar to obtain phone numbers and other information using a human voice even when the mobile device is locked. Often this information is personally identifiable information (PII), which is considered sensitive. It could also be used by an adversary to profile the user or engage in social engineering to obtain further information from other unsuspecting users. Disabling access to the contact database and calendar in these situations mitigates the risk of this attack. The Authorizing Official (AO) may waive this requirement with written notice if the operational environment requires this capability. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70071r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Enable S Voice" settings in the "Android Restrictions" rule. 2. Verify the value is disabled. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "Applications". 3. Verify the S Voice application cannot be selected. If the "Enable S Voice" setting is enabled, or if the S Voice application can be launched or configured, this is a finding.

Fix: F-75825r1_fix

Configure the operating system to disable S Voice. On the MDM Administration Console, disable the "Enable S Voice" setting in the "Android Restrictions" rule.

b
The Samsung KNOX for Android platform must be configured to disable Allow NFC.
CM-6 - Medium - CCI-000366 - V-69637 - SV-84259r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-023100
Vuln IDs
  • V-69637
Rule IDs
  • SV-84259r1_rule
NFC is a wireless technology that transmits small amounts of information from the device to the NFC reader. Any data transmitted can be potentially compromised. Disabling this feature mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70073r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow NFC" setting in the "Android Restrictions" rule. 2. Verify the setting is disabled. On the Samsung KNOX for Android device: 1. Open device settings. 2. Select "NFC and payment". 3. Verify the setting is disabled. If the "Allow NFC" configuration in the MDM console is enabled, or if the setting is enabled on the device, this is a finding.

Fix: F-75827r1_fix

Configure the mobile operating system to disable NFC. On the MDM Administration Console, disable the "Allow NFC" setting in the "Android Restrictions" rule.

b
The Samsung KNOX for Android platform must be configured to disable Nearby devices.
CM-6 - Medium - CCI-000366 - V-69639 - SV-84261r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-023500
Vuln IDs
  • V-69639
Rule IDs
  • SV-84261r1_rule
The Nearby devices feature allows the user to share files with other devices that are connected on the same Wi-Fi access point using the Digital Living Network Alliance (DLNA) technology. Even though the user must allow requests from other devices, this feature can potentially result in unauthorized access to and compromise of sensitive DoD files. Disabling this feature will mitigate this risk. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70075r1_chk

This validation procedure is performed on the Samsung KNOX for Android device. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "More connection settings". 3. Select "Nearby devices". 4. Verify this is disabled. If the setting is enabled and cannot be disabled, this is a finding. Note: This setting cannot be managed by the MDM administrator and is a User Based Enforcement (UBE) requirement.

Fix: F-75829r1_fix

Configure the mobile operating system to disable "Nearby devices". Note: Most carriers have removed this feature. If the feature is not present as described, this requirement is Not Applicable (NA).

b
The Samsung KNOX for Android platform must be configured to disable USB mass storage mode.
CM-7 - Medium - CCI-000381 - V-69641 - SV-84263r1_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
KNOX-35-023600
Vuln IDs
  • V-69641
Rule IDs
  • SV-84263r1_rule
USB mass storage mode enables the transfer of data and software from one device to another. This software can include malware. When USB mass storage is enabled on a mobile device, it becomes a potential vector for malware and unauthorized data exfiltration. Prohibiting USB mass storage mode mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #39
Checks: C-70077r1_chk

This validation procedure is performed on both the MDM Administration Console and the PC. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Disable USB Media Player" check box in the "Android Restrictions" rule. 2. Verify the "Disable USB Media Player" check box is selected. Note: Disabling USB Media Player will also disable USB MTP, USB mass storage, USB vendor protocol (Smart Switch, KIES). On the Samsung KNOX for Android device: Connect the device to a PC USB connection. Note: Do not use a DoD network-managed PC for this test! On the PC: Verify the device is not shown in the PC finder. If the specified setting is not set to the appropriate value, or if the device is shown in the PC finder, this is a finding.

Fix: F-75831r1_fix

Configure the mobile operating system to disable USB mass storage mode. On the MDM Administration Console, select the "Disable USB Media Player" check box in the "Android Restrictions" rule.

b
The Samsung KNOX for Android platform must be configured to disable automatic updates of system software.
CM-6 - Medium - CCI-000366 - V-69643 - SV-84265r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-023700
Vuln IDs
  • V-69643
Rule IDs
  • SV-84265r1_rule
FOTA allows the user to download and install firmware updates over the air. These updates can include OS upgrades, security patches, bug fixes, new features, and applications. Since the updates are controlled by the carriers, DoD will not have an opportunity to review and update policies prior to update availability to end users. Disabling FOTA will mitigate the risk of allowing users access to applications that could compromise DoD sensitive data. After reviewing the update and adjusting any necessary policies (i.e., disabling applications determined to pose risk), the administrator can re-enable FOTA. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70079r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow FOTA" setting in the "Android Restrictions" rule. 2. Verify the setting is disabled. On the Samsung KNOX for Android device: 1. Open device settings. 2. Select "About device". 3. Attempt to select "Software update" or "Download updates manually". Note: Location of this menu can vary between models. If the "Allow FOTA" configuration in the MDM console is enabled, or if the user is able to successfully select software update, this is a finding. Note: After reviewing the update and adjusting any necessary policies (i.e., disabling applications determined to pose risk), the administrator can re-enable FOTA.

Fix: F-75833r1_fix

Configure the mobile operating system to disable automatic updates of system software. Configure the mobile operating system to disable FOTA. On the MDM Administration Console, disable the "Allow FOTA" setting in the "Android Restrictions" rule.

b
The Samsung KNOX for Android platform must not display notifications when the device is locked.
AC-14 - Medium - CCI-000062 - V-69645 - SV-84267r1_rule
RMF Control
AC-14
Severity
Medium
CCI
CCI-000062
Version
KNOX-35-024000
Vuln IDs
  • V-69645
Rule IDs
  • SV-84267r1_rule
Many mobile devices display notifications on the lock screen so users can obtain relevant information in a timely manner without having to frequently unlock the phone to determine if there are new notifications. However, in many cases, these notifications can contain sensitive information. When they are available on the lock screen, an adversary can see them merely by being in close physical proximity to the device. Configuring the mobile operating system to not send notifications to the lock screen mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #21
Checks: C-70081r1_chk

This check procedure is performed on both the MDM Administration Console and the Samsung KNOX device. Check that the appropriate setting is configured on the MDM Administration Console. 1. Ask the MDM administrator to display the "Notifications on lock screen" settings in the "Android Restrictions" rule. 2. Verify that the "Hide content" or "Do not show notification" setting is enabled and "Show content" setting is disabled. On the Samsung KNOX for Android device: 1. Lock the device while there are notifications shown in the notification bar. 2. Turn the display on and verify that notification contents are hidden ("Hide content") or that no notifications are shown ("Do not show notification") on the lock screen. If the "Show content" setting in the MDM console is enabled, or if the user is able to see notification content on the device lock screen, this is a finding.

Fix: F-75835r1_fix

Configure the mobile operating system to not display notifications when the device is locked. Configure the platform to disable notifications on the lock screen or hide notification details on the lock screen. On the MDM Administration Console, enable "Hide content" or "Do not show notification" and disable "Show content" in the "Notifications on lock screen" setting in the "Android Restrictions" rule.

b
The Samsung KNOX for Android platform must not allow backup to locally connected systems.
AC-20 - Medium - CCI-000097 - V-69647 - SV-84269r1_rule
RMF Control
AC-20
Severity
Medium
CCI
CCI-000097
Version
KNOX-35-024200
Vuln IDs
  • V-69647
Rule IDs
  • SV-84269r1_rule
Data on mobile devices is protected by numerous mechanisms, including user authentication, access control, and cryptography. When the data is backed up to an external system (either locally connected or cloud based), many if not all of these mechanisms are no longer present. This leaves the backed-up data vulnerable to attack. Disabling backup to external systems mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #40
Checks: C-70083r1_chk

This validation procedure is performed on both the MDM Administration Console and the PC. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Disable USB Media Player" check box in the "Android Restrictions" rule. 2. Verify the "Disable USB Media Player" check box is selected. Note: Disabling USB Media Player will also disable USB MTP, USB mass storage, and USB vendor protocol (Smart Switch, KIES). On the Samsung KNOX for Android device: Connect the device to a PC USB connection. Note: Do not use a DoD network-managed PC for this test! On the PC: 1. Install and launch Samsung Smart Switch (Note: Samsung KIES for older devices) on the PC. 2. Verify the device does not connect with the Samsung Smart Switch program. If the specified setting is not set to the appropriate value, or if the device connects with the Samsung Smart Switch or KIES program, this is a finding.

Fix: F-75837r2_fix

Configure the mobile operating system to disable backup to locally connected systems. Configure the mobile operating system to disable USB Smart Switch and USB KIES. On the MDM Administration Console, select the "Disable USB Media Player" check box in the "Android Restrictions" rule. Note: Disabling USB Media Player will also disable USB MTP, USB mass storage, and USB vendor protocol (Smart Switch, KIES).

a
The Samsung KNOX for Android platform must enable virtual private networks (VPN) protection.
CM-6 - Low - CCI-000366 - V-69649 - SV-84271r1_rule
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
KNOX-35-024500
Vuln IDs
  • V-69649
Rule IDs
  • SV-84271r1_rule
A key characteristic of mobile devices is that they typically will communicate wirelessly and are often expected to reside in locations outside the physical security perimeter of a DoD facility. In these circumstances, the threat of eavesdropping is substantial. VPNs provide confidentiality and integrity protection for data transmitted over untrusted media (e.g., air) and networks (e.g., the Internet). They also provide authentication services to validate that only authorized users are able to use them. Consequently, enabling VPN protection counters threats to communications to and from mobile devices. SFR ID: FMT_SMF_EXT.1.1 #03
Checks: C-70085r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the list of configured VPN profiles in the "VPN profiles" rule. 2. Verify the list includes the organization VPN profile. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "More connection settings". 3. Select "VPN". 4. Verify the list includes the organization VPN profile. If the organization VPN profile is not included in either list, this is a finding.

Fix: F-75839r1_fix

Configure the mobile operating system to enable VPN protection. Configure the mobile operating system with the organization VPN profile. On the MDM Administration Console, configure the organization VPN profile in the "VPN profiles" rule.

b
The Samsung KNOX for Android platform must be configured to disable authentication mechanisms providing user access to protected data other than a Password Authentication Factor (e.g., using a fingerprint), unless the mechanism is DoD-approved.
CM-6 - Medium - CCI-000366 - V-69651 - SV-84273r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-024600
Vuln IDs
  • V-69651
Rule IDs
  • SV-84273r1_rule
The fingerprint reader can be used to authenticate the user in order to unlock the mobile device. At this time, no biometric reader has been approved for DoD use on mobile devices. This technology would allow unauthorized users to have access to DoD sensitive data if compromised. By not permitting the use of non-password authentication mechanisms, users are forced to use passcodes that meet DoD passcode requirements. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70087r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Minimum Password Complexity" setting in the "Android Restrictions" rule. 2. Verify the settings are "Alphanumeric". 3. Ask the MDM administrator to display the "Enable Fingerprint for Lock screen authentication" setting in the "Android Restrictions" rule. 4. Verify the setting is disabled. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "Lock screen and security". 3. Select "Lock screen type". 4. Verify "Swipe", "Pattern", "PIN", "Fingerprints", and "None" are disabled (grayed out) and cannot be enabled. If "Fingerprint for Lock screen authentications" is enabled, or if "Minimum Password Complexity" is not configured to "Alphanumeric", or if the user can enable the settings on the device, this is a finding.

Fix: F-75841r1_fix

Configure the mobile operating system to not allow authentication mechanisms other than a Password Authentication Factor, where the authentication provides user access to protected data. Configure the mobile operating system to configure Minimum Password Complexity and disable fingerprint for the lock screen password. On the MDM Administration Console, configure "Minimum Password Complexity" to Alphanumeric and disable "Enable Fingerprint for Lock screen authentication" setting in the "Android Restrictions" rule.

b
The Samsung KNOX for Android platform must disable authentication mechanisms providing user access to protected data other than a Password Authentication Factor.
CM-7 - Medium - CCI-000381 - V-69653 - SV-84275r1_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
KNOX-35-024605
Vuln IDs
  • V-69653
Rule IDs
  • SV-84275r1_rule
The fingerprint reader can be used to authenticate the user in order to unlock the mobile device. At this time, no biometric reader has been approved for DoD use on mobile devices. This technology would allow unauthorized users to have access to DoD sensitive data if compromised. By not permitting the use of non-password authentication mechanisms, users are forced to use passcodes that meet DoD passcode requirements. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70089r1_chk

Note: This validation procedure is identical to the one for KNOX-39-024600. It only needs to be performed once. If it is found compliant on the first check, it is also compliant here. If it is determined to be a finding on the first check, it is also a finding here. Redundant checks are necessary to maintain requirements traceability and provide complete risk management information to Authorizing Officials (AOs). This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Minimum Password Complexity" setting in the "Android Restrictions" rule. 2. Verify the settings are "Alphanumeric". 3. Ask the MDM administrator to display the "Enable Fingerprint for Lock screen authentication" setting in the "Android Restrictions" rule. 4. Verify the setting is disabled. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "Lock screen and security". 3. Select "Lock screen type". 4. Verify "Swipe", "Pattern", "PIN", "Fingerprints", and "None" are disabled (grayed out) and cannot be enabled. If "Fingerprint for Lock screen authentications" is enabled, or if "Minimum Password Complexity" is not configured to "Alphanumeric", or if the user can enable the settings on the device, this is a finding.

Fix: F-75843r1_fix

Configure the mobile operating system to not allow authentication mechanisms other than a Password Authentication Factor, where the authentication provides user access to protected data. Configure the mobile operating system to configure Minimum Password Complexity and disable fingerprint for the lock screen password. On the MDM Administration Console, configure "Minimum Password Complexity" to "Alphanumeric" and disable the "Enable Fingerprint for Lock screen authentication" setting in the "Android Restrictions" rule.

b
The Samsung KNOX for Android platform must be configured to disable VPN split-tunneling (if the mobile device provides a configurable control for FDP_IFC_EXT.1.1).
CM-6 - Medium - CCI-000366 - V-69655 - SV-84277r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-024700
Vuln IDs
  • V-69655
Rule IDs
  • SV-84277r1_rule
Spilt-tunneling allows multiple simultaneous remote connections to the mobile device. Without VPN split-tunneling disabled, malicious applications can covertly off-load device data to a third-party server or set up a trusted tunnel between a non-DoD third-party server and a DoD network, providing a vector to attack the network. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70091r1_chk

Note: This validation procedure is identical to the one for KNOX-39-015600. It only needs to be performed once. If it is found compliant on the first check, it is also compliant here. If it is determined to be a finding on the first check, it is also a finding here. Redundant checks are necessary to maintain requirements traceability and provide complete risk management information to Authorizing Officials (AOs). This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "CC Mode" settings in the "Android Restrictions" rule. 2. Verify the value is enabled. Note: If the MDM does not support CC mode, ask the MDM administrator if the Samsung APK has been installed and CC mode enabled. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "About Device". 3. Select "Software info" (Note: On some devices, this step is not needed.) 4. Verify the value of "Security software version" displays "Enforced". If the CC mode setting is not enabled, or if the "Security software version" on the device does not display "Enforced", this is a finding.

Fix: F-75845r1_fix

Configure the mobile operating system to disable VPN split-tunneling (if the mobile device provides a configurable control). Configure the operating system to enable CC mode. On the MDM Administration Console, enable the "CC mode" setting in the "Android Restrictions" rule. If this setting is not available on the console, install the CC mode APK and enable CC mode from this application. This APK will be made available by Samsung.

b
The Samsung KNOX for Android platform must be configured to enable the access control policy that prevents groups of application processes from accessing all data stored by other groups of application processes.
CM-6 - Medium - CCI-000366 - V-69657 - SV-84279r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-024800
Vuln IDs
  • V-69657
Rule IDs
  • SV-84279r1_rule
The access control policy restricts processes and applications in one processing environment (container) from accessing data in another. Exceptions should only be allowed under the administrator control to protect sensitive DoD data from exposure. SFR ID: FMT_SMF_EXT.1.1 #45, FDP_ACF_EXT.1.2
Checks: C-70093r1_chk

Note: This validation procedure is identical to the one for KNOX-39-015400. It only needs to be performed once. If it is found compliant on the first check, it is also compliant here. If it is determined to be a finding on first check, it is also a finding here. Redundant checks are necessary to maintain requirements traceability and provide complete risk management information to Authorizing Officials (AOs). This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Android KNOX Container" rule. 2. Verify the existence of this rule. 3. Pushing this rule to the device that does not have a container installed will result in creation of the container. On the Samsung KNOX for Android device: 1. Verify the existence of the KNOX icon on the device home screen or application menu or the notification bar pull-down menu. 2. If available on the MDM agent, verify the container rule in the list of rules received by the MDM agent. If the MDM administrator cannot configure the "Android KNOX Container" rule, or if the KNOX icon is not present, or if the container rule is not found in the MDM agent rule list (MDM vendor-specific check), this is a finding.

Fix: F-75847r1_fix

On the MDM Administration Console, create the "Android KNOX Container" rule and push this rule to the device.

b
The Samsung KNOX for Android platform must be configured to Disable Admin Remove.
CM-6 - Medium - CCI-000366 - V-69659 - SV-84281r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-028400
Vuln IDs
  • V-69659
Rule IDs
  • SV-84281r1_rule
Security-related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security-related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large-scale environment relative to an environment in which each device must be configured separately. For these reasons, a user must not be allowed to remove the MDM from the device. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70095r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Admin Remove" settings in the "Android Restrictions" rule. 2. Verify the value is disabled. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "Lock screen and security". 3. Select "Other security settings". 4. Select "Device administrators". 5. Verify the enterprise MDM agent is on and cannot be turned off. If the "Allow Admin Remove" setting is enabled, or if the MDM agent on the device can be turned off, this is a finding.

Fix: F-75849r1_fix

Configure the operating system to disable admin removal by the user. On the MDM Administration Console, disable the "Allow Admin Remove" setting in the "Android Restrictions" rule.

b
The Samsung KNOX for Android platform must be configured to enable a Certificate Revocation Status (CRL) Check.
CM-6 - Medium - CCI-000366 - V-69661 - SV-84283r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-028500
Vuln IDs
  • V-69661
Rule IDs
  • SV-84283r1_rule
A CRL allows a certificate issuer to revoke a certificate for any reason, including improperly issued certificates and compromise of the private keys. Checking the revocation status of the certificate mitigates the risk associated with using a compromised certificate. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70097r1_chk

This validation procedure is performed on the MDM Administration Console. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Enable Certificate Revocation Status (CRL) Check" settings in the "Android Restrictions" rule. 2. Verify the value is enabled and configured for all applications. If the setting is disabled, this is a finding.

Fix: F-75851r1_fix

Configure the operating system to configure certification revocation status checking (CRL). On the MDM Administration Console, configure "Enable Certificate Revocation Status (CRL) Check" settings for all applications in the "Android Restrictions" rule.

b
The Samsung KNOX for Android platform must be configured to disable Enable Smart Lock.
CM-6 - Medium - CCI-000366 - V-69663 - SV-84285r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-030000
Vuln IDs
  • V-69663
Rule IDs
  • SV-84285r1_rule
The fingerprint reader can be used to authenticate the user in order to unlock the mobile device. At this time, no biometric reader has been approved for DoD use on mobile devices. This technology would allow unauthorized users to have access to DoD sensitive data if compromised. By not permitting the use of non-password authentication mechanisms, users are forced to use passcodes that meet DoD passcode requirements. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70099r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Minimum Password Complexity" setting in the "Android Restrictions" rule. 2. Verify the settings are "Alphanumeric". 3. Ask the MDM administrator to display the "Enable Smart Lock" setting in the "Android Restrictions" rule. 4. Verify the setting is disabled. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "Lock screen and security". 3. Select "Secure lock settings". 4. Select "Smart Lock". 5. Verify all items are disabled (grayed out) and cannot be enabled. If items are enabled or if the user can enable the settings on the device, this is a finding.

Fix: F-75853r1_fix

Configure the mobile operating system to not allow authentication mechanisms other than a Password Authentication Factor where the authentication provides user access to protected data. Configure the mobile operating system to disable Smart Lock. On the MDM Administration Console, disable the "Enable Smart Lock" setting in the "Android Restrictions" rule.

a
The Samsung KNOX for Android platform must disable the automatic transfer of diagnostic data to an external device.
CM-7 - Low - CCI-000381 - V-69665 - SV-84287r1_rule
RMF Control
CM-7
Severity
Low
CCI
CCI-000381
Version
KNOX-35-030100
Vuln IDs
  • V-69665
Rule IDs
  • SV-84287r1_rule
Many software systems automatically send diagnostic data to the manufacturer or a third party. This data enables the developers to understand real-world field behavior and improve the product based on that information. Unfortunately, it can also reveal information about what DoD users are doing with the systems and what causes them to fail. An adversary embedded within the software development team or elsewhere could use the information acquired to breach mobile operating system security. Disabling automatic transfer of such information mitigates this risk. SFR ID: FMT_SMF_EXT.1.1#45
Checks: C-70101r1_chk

Disabling automatic transfer of diagnostic data to an external device on Samsung KNOX for Android involves three steps: 1. Disable Google Crash report 2. Configure a KNOX on-premise license 3. Disable Report diagnostic info This validation procedure covers the second of these steps. This validation procedure is performed on the MDM Administration Console. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "KNOX License" settings in the "KNOX Management" rule. 2. Verify the correct DoD-issued KNOX license is configured. If the correct DoD-issued KNOX license is not configured in the "KNOX License" setting, this is a finding.

Fix: F-75855r1_fix

Configure the mobile operating system to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled. Configure the DoD-issued KNOX license. On the MDM Administration Console, configure the DoD-issued KNOX license in the "KNOX Management" rule.

a
The Samsung KNOX for Android platform must disable Report diagnostic info.
CM-7 - Low - CCI-000381 - V-69667 - SV-84289r1_rule
RMF Control
CM-7
Severity
Low
CCI
CCI-000381
Version
KNOX-35-030200
Vuln IDs
  • V-69667
Rule IDs
  • SV-84289r1_rule
Many software systems automatically send diagnostic data to the manufacturer or a third party. This data enables the developers to understand real-world field behavior and improve the product based on that information. Unfortunately, it can also reveal information about what DoD users are doing with the systems and what causes them to fail. An adversary embedded within the software development team or elsewhere could use the information acquired to breach mobile operating system security. Disabling automatic transfer of such information mitigates this risk. SFR ID: FMT_SMF_EXT.1.1#45
Checks: C-70103r1_chk

Disabling automatic transfer of diagnostic data to an external device on Samsung KNOX for Android involves three steps: 1. Disable Google Crash report 2. Configure a KNOX on-premise license 3. Disable Report diagnostic info This validation procedure covers the third of these steps. This validation procedure is performed on the Samsung KNOX for Android device. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "Privacy and safety" or "About device". 3. Verify "Report diagnostic info" setting is off. If the setting is on (enabled), this is a finding. Note: This setting cannot be managed by the MDM administrator and is a User Based Enforcement (UBE) requirement.

Fix: F-75857r1_fix

Configure the mobile operating system to disable automatic transfer of diagnostic data to an external device other than an MDM service with which the device has enrolled. Configure the mobile operating system to disable "Report diagnostic info". On the Samsung KNOX for Android device, uncheck the "Report diagnostic info" setting.

a
The Samsung KNOX for Android platform must display the DoD advisory warning message at start-up or each time the user unlocks the device.
AC-8 - Low - CCI-000048 - V-69669 - SV-84291r1_rule
RMF Control
AC-8
Severity
Low
CCI
CCI-000048
Version
KNOX-36-009700
Vuln IDs
  • V-69669
Rule IDs
  • SV-84291r1_rule
The mobile operating system is required to display the DoD-approved system use notification message or banner before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Required banners help ensure that DoD can audit and monitor the activities of mobile device users without legal restriction. System use notification messages can be displayed when individuals first access or unlock the mobile device. The banner shall be implemented as a "click-through" banner at device unlock (to the extent permitted by the operating system). A "click-through" banner prevents further activity on the information system unless and until the user executes a positive action to manifest agreement by clicking on a box indicating “OK.” The approved DoD text must be used exactly as required in the Knowledge Service (KS) referenced in DoDI 8500.01. For devices accommodating banners of 1300 characters, the banner text is: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. For devices with severe character limitations, the banner text is: I've read & consent to terms in IS user agreem't. The administrator must configure the banner text exactly as written without any changes. SFR ID: FMT_SMF_EXT.1.1 #36
Checks: C-70105r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Enable DoD Banner" check box and "Banner Text" field in the "Android Restrictions" rule. 2. Verify the "Enable DoD Banner" check box is selected. 3. Verify the correct DoD-specified warning text is displayed in the Banner Text field or the field is blank. Note: The default device banner matches the required DoD banner. If the DoD banner is enabled without entering any text, the device will display a default text. On the Samsung KNOX for Android device: 1. Reboot the device. 2. Verify the device displays the DoD banner. 3. Verify the DoD banner is set to one of the authorized messages. If the specified setting is not set to the appropriate value, or the device does not display the DoD banner on reboot, this is a finding.

Fix: F-75859r1_fix

Configure the mobile operating system to display the DoD-mandated warning banner text. On the MDM Administration Console, select the "Enable DoD Banner" check box and enter the correct text in the "Banner Text" field in the "Android Restrictions" rule. Note: On some MDM vendor consoles, the logon banner automatically is displayed upon reboot while the device is MDM enrolled. On these consoles, this control is not configurable through the MDM server or on the device.

b
The Samsung KNOX for Android platform must be configured to disable manual date and time changes.
CM-6 - Medium - CCI-000366 - V-69671 - SV-84293r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-38-012600
Vuln IDs
  • V-69671
Rule IDs
  • SV-84293r1_rule
Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events. Periodically synchronizing internal clocks with an authoritative time source is needed in order to correctly correlate the timing of events that occur across the enterprise. The three authoritative time sources for mobile operating systems are an authoritative time server that is synchronized with redundant United States Naval Observatory (USNO) time servers as designated for the appropriate DoD network (NIPRNet or SIPRNet), or the Global Positioning System (GPS), or the wireless carrier. Time stamps generated by the audit system in mobile operating systems must include both date and time. The time may be expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70113r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Disable Manual Date Time Changes" check box in the "Android Restrictions" rule. 2. Verify the check box is selected. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "Date and time". 3. Verify the "Automatic date and time" is on. 4. Verify a user cannot turn off the "Automatic date and time". If the "Disable Manual Date Time Changes" check box is not checked on the MDM administration console or the "Automatic date and time" is set to "off" on the device, or if it is possible to turn off this option on the device, this is a finding.

Fix: F-75875r1_fix

Configure the mobile operating system to synchronize the internal clock at least once every 24 hours with an authoritative time server or the GPS. On the MDM Console, select the "Disable Manual Date Time Changes" check box in the "Android Restrictions" rule.

b
The Samsung KNOX for Android container must be configured to enforce a minimum password length of four characters.
CM-6 - Medium - CCI-000366 - V-69673 - SV-84295r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-39-014900
Vuln IDs
  • V-69673
Rule IDs
  • SV-84295r1_rule
Password strength is a measure of the effectiveness of a password in resisting guessing and brute-force attacks. The ability to crack a password is a function of how many attempts an adversary is permitted, how quickly an adversary can do each attempt, and the size of the password space. The longer the minimum length of the password is, the larger the password space. Having a too-short minimum password length significantly reduces password strength, increasing the chance of password compromise and resulting device and data compromise. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70115r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Min Length" setting in the "Android KNOX Container >> Container Password Restrictions" rule. 2. Verify the value of the setting is the same or greater than the required length. On the Samsung KNOX for Android device: 1. Open the KNOX Container. 2. Select "KNOX Settings". 3. Select "Lock type". 4. Enter current password. 5. Attempt to enter a password with fewer characters than the required length. 6. Verify the password is not accepted. If the configured value of the "Min Length" setting is less than the required length, or if Samsung KNOX for Android accepts a container password with fewer characters than the required length, this is a finding. Note: This configuration setting will allow users to implement fingerprint unlock for the container, which is approved for use. However, this approval does not extend to fingerprint unlock for the Samsung device or any other DoD mobile device. The use of a password to move between container and personal areas is only required if the password is needed to provide data separation between the two processing environments. For the Samsung devices, the password is required to enable the container and implement data separation.

Fix: F-75877r1_fix

Configure the mobile device to enforce a minimum password length of "4" characters. On the MDM Console, set the "Min Length" value to "4" or greater in the "Android KNOX Container >> Container Password Restrictions" rule.

b
The Samsung KNOX for Android container must be configured to disable sharing of calendar information outside the container.
CM-6 - Medium - CCI-000366 - V-69675 - SV-84297r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-39-015100
Vuln IDs
  • V-69675
Rule IDs
  • SV-84297r1_rule
Calendar events can include potentially DoD-sensitive data such as names, contacts, dates and times, and locations. If made available outside the container, this information will be accessible to personal applications, resulting in potential compromise of DoD data. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70117r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Export Calendar to Personal Mode" setting in the "Android KNOX Container >> Container Restrictions" rule. 2. Verify the setting is disabled. On the Samsung KNOX for Android device: 1. Open the KNOX container. 2. Select "KNOX Settings". 3. Select "Share contacts and calendars". 4. Verify "Export to Personal Mode – Calendar (from KNOX)" (on some devices, shown as "Export to Personal Mode - S Planner") is disabled and attempt to enable this setting. If the "Allow Export Calendar to Personal Mode" configuration in the MDM console is enabled, or if the user is able to successfully enable this setting, this is a finding.

Fix: F-75879r1_fix

Configure the mobile operating system to disable sharing of calendar information outside the container. On the MDM Administration Console, disable the "Allow Export Calendar to Personal Mode" setting in the "Android KNOX Container >> Container Restrictions" rule.

a
The Samsung KNOX for Android container must be configured to prohibit more than 10 consecutive failed authentication attempts.
CM-6 - Low - CCI-000366 - V-69677 - SV-84299r1_rule
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
KNOX-39-015200
Vuln IDs
  • V-69677
Rule IDs
  • SV-84299r1_rule
Users must not be able to override the system policy on the maximum number of consecutive failed authentication attempts because this could allow them to raise the maximum, thus giving adversaries more chances to guess/brute force passwords, which increases the risk of the mobile device being compromised. Therefore, only administrators should have the authority to set consecutive failed authentication attempt policies. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70119r1_chk

This validation procedure is performed on the MDM Administration Console only. Check whether the device lock screen setting is configured on the MDM server. 1. Ask the MDM administrator to display the "Maximum Failed Attempts" field in the "Android KNOX Container >> Container Password Restrictions" rule. 2. Verify the value of the setting is "10" or less. If there is no value configured for the "Maximum Failed Attempts" field, or if it is greater than "10", this is a finding.

Fix: F-75881r1_fix

Configure the mobile operating system to allow only "10" or less consecutive failed authentication attempts. On the MDM Administration Console, set the "Maximum Failed Attempts" to the organization-defined value in the "Android KNOX Container >> Container Password Restrictions" rule.

b
The Samsung KNOX for Android container must be configured to disable sharing of contact information outside the container.
CM-6 - Medium - CCI-000366 - V-69679 - SV-84301r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-39-015250
Vuln IDs
  • V-69679
Rule IDs
  • SV-84301r1_rule
Contacts can include DoD-sensitive data and personally identifiable information (PII) of DoD employees, including names, numbers, addresses, and email addresses. If made available outside the container, this information will be accessible to personal applications, resulting in potential compromise of DoD data. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70121r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Export Contact to Personal Mode" setting in the "Android KNOX Container >> Container Restrictions" rule. 2. Verify the setting is disabled. On the Samsung KNOX for Android device: 1. Open the KNOX container. 2. Select "KNOX Settings". 3. Select "Share contacts and calendars". 4. Verify "Export to Personal Mode - Contacts (from KNOX)" is disabled and attempt to enable this setting. If the "Export Contacts to Personal Mode" configuration in the MDM console is enabled, or if the user is able to successfully enable this setting, this is a finding.

Fix: F-75883r1_fix

Configure the mobile operating system to disable sharing of contact information outside the container. On the MDM Administration Console, disable the "Allow Export Contact to Personal Mode" setting in the "Android KNOX Container -> Container Restrictions" rule.

b
The Samsung KNOX for Android container must be configured to disable sharing of notification details outside the container when the container is locked.
CM-6 - Medium - CCI-000366 - V-69681 - SV-84303r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-39-015300
Vuln IDs
  • V-69681
Rule IDs
  • SV-84303r1_rule
Application notifications can include DoD sensitive data. If made available outside the container, this information will be accessible to personal applications, resulting in potential compromise of DoD data. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70123r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow Show detailed notifications" setting in the "Android KNOX Container >> Container Restrictions" rule. 2. Verify the setting is disabled. On the Samsung KNOX for Android device: 1. Open the KNOX container. 2. Select "KNOX Settings". 3. Select "Notifications". 4. Verify "Show details" is disabled and attempt to enable this setting. If the "Allow Show detailed notifications" configuration in the MDM console is enabled, or if the user is able to successfully enable this setting, this is a finding.

Fix: F-75885r1_fix

Configure the mobile operating system to disable sharing of notification details outside the container. On the MDM Administration Console, disable the "Allow Show detailed notifications" setting in the "Android KNOX Container >> Container Restrictions" rule.

b
The Samsung KNOX for Android container must be enabled.
CM-6 - Medium - CCI-000366 - V-69683 - SV-84305r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-39-015400
Vuln IDs
  • V-69683
Rule IDs
  • SV-84305r1_rule
The container must be enabled by the administrator/MDM or the container's protections will not apply to the mobile device. This will cause the mobile device's apps and data to be at significantly higher risk of compromise because they are not protected by encryption, isolation, etc. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70125r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Android KNOX Container" rule. 2. Verify the existence of this rule. 3. Pushing this rule to the device that does not have a container installed will result in creation of the container. On the Samsung KNOX for Android device: 1. Verify the existence of the KNOX icon on the device home screen or application menu or the notification bar pull-down menu. 2. If available on the MDM agent, verify the container rule in the list of rules received by the MDM agent. If the MDM administrator cannot configure the "Android KNOX Container" rule, or if the KNOX icon is not present, or if the container rule is not found in the MDM agent rule list (MDM vendor-specific check), this is a finding.

Fix: F-75887r1_fix

On the MDM Administration Console, create the "Android KNOX Container" rule and push this rule to the device.

c
The Samsung KNOX for Android platform must be configured to enable CC mode.
CM-6 - High - CCI-000366 - V-69685 - SV-84307r1_rule
RMF Control
CM-6
Severity
High
CCI
CCI-000366
Version
KNOX-39-015600
Vuln IDs
  • V-69685
Rule IDs
  • SV-84307r1_rule
CC mode implements several security controls required by the Mobile Device Functional Protection Profile (MDFPP). If CC mode is not implemented, DoD data is more at risk of being compromised, and the mobile device is more at risk of being compromised if lost or stolen. CC mode implements the following controls: - enables the OpenSSL FIPS crypto library - sets the password failure settings to wipe the device to 5 (5 failed consecutive attempts will wipe the device) - disables ODIN mode (download mode) SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70127r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "CC Mode" settings in the "Android Restrictions" rule. 2. Verify the value is enabled. Note: If the MDM does not support CC mode, ask the MDM administrator if the Samsung APK has been installed and CC mode enabled. On the Samsung KNOX for Android device: 1. Open the device settings. 2. Select "About Device". 3. Select "Software info". (Note: On some devices, this step is not needed.) 4. Verify the value of "Security software version" displays "Enforced". If the CC mode setting is not enabled, or if the "Security software version" on the device does not display "Enforced", this is a finding.

Fix: F-75889r1_fix

Configure the operating system to enable CC mode. On the MDM Administration Console, enable the "CC mode" setting in the "Android Restrictions" rule. If this setting is not available on the console, install the CC mode APK and enable CC mode from this application. This APK will be made available by Samsung.

b
The Samsung KNOX for Android platform must be configured to disable all Bluetooth profiles except for HSP (Headset Profile), HFP (Hands-Free Profile), and SPP (Serial Port Profile).
CM-6 - Medium - CCI-000366 - V-69687 - SV-84309r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-39-015700
Vuln IDs
  • V-69687
Rule IDs
  • SV-84309r1_rule
Some Bluetooth profiles provide the capability for remote transfer of sensitive DoD data without encryption or otherwise do not meet DoD IT security policies and therefore should be disabled. SFR ID: FMT_SMF_EXT.1.1 #20
Checks: C-70129r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Bluetooth Profiles" settings in the "Android Restrictions" rule. 2. Verify the only profiles allowed are HSP, HFP, and SPP. On the Samsung KNOX for Android device: 1. Attempt to pair a Bluetooth peripheral that uses profiles other than HSP, HFP, and SPP (e.g., a Bluetooth keyboard). 2. Verify the Bluetooth peripheral does not pair with the Samsung KNOX for Android device. If Bluetooth profiles other than HSP, HFP, and SPP are configured to be allowed, or if the device is able to pair with a Bluetooth keyboard, this is a finding.

Fix: F-75891r1_fix

Configure the mobile operating system to disable all Bluetooth profiles except for HSP, HFP, and SPP. On the MDM Administration Console, configure the "Bluetooth Profiles" setting to only allow HSP, HFP, and SPP in the "Android Restrictions" rule.

b
The Samsung KNOX for Android container must enforce an application installation policy by specifying an application whitelist.
CM-6 - Medium - CCI-000366 - V-69689 - SV-84311r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-39-020100
Vuln IDs
  • V-69689
Rule IDs
  • SV-84311r1_rule
Requiring all authorized applications to be in an application whitelist prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the whitelist. Failure to configure an application whitelist properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DoD data accessible by these applications. The application whitelist, in addition to controlling the installation of applications on the mobile device, must control user access/execution of all core applications (included in the operating system [OS] by the OS vendor) and pre-installed applications (provided by the mobile device vendor and wireless carrier), or the mobile device must provide an alternate method of restricting user access/execution to core and pre-installed applications. SFR ID: FMT_SMF_EXT.1.1 #10b
Checks: C-70131r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the list of whitelisted applications in the "Android KNOX Container >> Container Applications" rule. 2. Verify the list of whitelisted applications have been approved by the Authorizing Official (AO). Note: Refer to the Supplemental document for additional information. Note: This list can be empty if no applications have been approved. On the Samsung KNOX for Android device: 1. Open the KNOX Container. 2. Attempt to install an application that is not in the application whitelist. If any of the applications on the MDM Administration Console have not been approved by the AO, or the device allows the user to successfully install the application, this is a finding.

Fix: F-75893r2_fix

Configure the mobile device to use an application whitelist. On the MDM Administration Console, configure the list of whitelisted applications in the "Android KNOX Container >> Container Applications" rule and ensure only AO-approved applications are on the list. Note: This list can be empty if no applications have been approved. Note: Refer to the Supplemental document for additional information.

b
The Samsung KNOX for Android container must have the application install blacklist configured.
CM-6 - Medium - CCI-000366 - V-69691 - SV-84313r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-39-020300
Vuln IDs
  • V-69691
Rule IDs
  • SV-84313r1_rule
Blacklisting all applications is required so only whitelisted applications can be installed on the device. Requiring all authorized applications to be in an application whitelist prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the whitelist. Failure to configure an application whitelist and blacklist properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DoD data accessible by these applications. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70133r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Application install blacklist" setting in the "Android KNOX Container >> Container Application" rule. 2. Verify the setting is configured to all applications (specified by the wildcard string ".*"). On the Samsung KNOX for Android device: 1. Attempt to install any application that is not configured in the application install whitelist. 2. Verify that the application is blocked from being installed. If the "Application install blacklist" configuration in the MDM console has the wrong value, or if the user is able to install the application, this is a finding.

Fix: F-75895r1_fix

Configure the mobile operating system to add all applications to the install blacklist. On the MDM Administration Console, add all applications to the "Application install blacklist" setting in the "Android KNOX Container >> Container Application" rule.

b
The Samsung KNOX for Android container must be configured to disable Move Applications to Container.
CM-6 - Medium - CCI-000366 - V-69693 - SV-84315r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-39-020400
Vuln IDs
  • V-69693
Rule IDs
  • SV-84315r1_rule
Applications determined to be acceptable for personal use outside the container might not be acceptable for use within the container. The Move Applications to Container feature allows users to install personal-side applications into the container, resulting in potential compromise of DoD data. Disabling this feature mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70135r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Move Applications to Container" setting in the "Android KNOX Container >> Container Restrictions" rule. 2. Verify the setting is disabled. On the Samsung KNOX for Android device: 1. Open the KNOX Container. 2. Select "KNOX Settings". 3. Verify "Install applications" cannot be selected. (Note: If the KNOX Container is configured as a folder type, a "+" icon should not be visible in the list of applications.) If the "Move Applications to Container" configuration in the MDM console is enabled, or if the user is able to select "Install applications", this is a finding.

Fix: F-75897r1_fix

Configure the mobile operating system to disable Move Applications to Container. On the MDM Administration Console, disable the "Move Applications to Container" setting in the "Android KNOX Container >> Container Application" rule.

b
The Samsung KNOX for Android container must be configured to disable Move Files from Container to Personal.
CM-6 - Medium - CCI-000366 - V-69695 - SV-84317r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-39-020500
Vuln IDs
  • V-69695
Rule IDs
  • SV-84317r1_rule
Allowing movement of files between the container and personal side will result in both personal data and sensitive DoD data being placed in the same space. This can potentially result in DoD data being transmitted to unauthorized recipients via personal email accounts or social applications, or transmission of malicious files to DoD accounts. Disabling this feature mitigates this risk. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70137r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Move Files from Container to Personal" setting in the "Android KNOX Container >> Container Restrictions" rule. 2. Verify the setting is disabled. On the Samsung KNOX for Android device: 1. Open the KNOX Container. 2. Select "My Files" application. 3. Select a file by long pressing a selection. 4. Select "Settings". 5. Select "Move to Personal mode". 6. Verify this operation is blocked. If the "Move Files from Container to Personal" configuration in the MDM console is enabled, or if the user is able to successfully move the selected file to the personal space, this is a finding.

Fix: F-75899r1_fix

Configure the mobile operating system to disable "Move Files from Container to Personal". On the MDM Administration Console, disable the "Move Files from Container to Personal" setting in the "Android KNOX Container >> Container Restrictions" rule.

b
The Samsung KNOX for Android container must have the application disable list configured.
CM-6 - Medium - CCI-000366 - V-69697 - SV-84319r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-39-020700
Vuln IDs
  • V-69697
Rule IDs
  • SV-84319r1_rule
Applications from various sources (including the vendor, the carrier, and Google) are installed on the device at the time of manufacture. Core apps are apps preinstalled by Google. Third-party preinstalled apps included apps from the vendor and carrier. Some of the applications can compromise DoD data or upload users' information to non-DoD-approved servers. A user must be blocked from using such applications that exhibit behavior that can result in compromise of DoD data or DoD user information. The site administrator must analyze all pre-installed applications on the device and block all applications not approved for DoD use by configuring the application disable list. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70139r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Application disable list" setting in the "Android KNOX Container >> Container Application" rule. 2. Verify the list contains all core and pre-installed applications not approved for DoD use by the Authorizing Official (AO). Note: Refer to the Supplemental document for additional information. On the Samsung KNOX for Android device: 1. Open the KNOX container. 2. Attempt to launch an application that is included on the disable list. Note: This application should not be visible. If the "Application disable list" configuration in the MDM console does not contain all core and pre-installed applications not approved by DoD, or if the user is able to successfully launch an application on this list, this is a finding. Note: Core applications are apps installed in the operating system (OS) by the OS developer. In addition, third-party pre-installed apps are included in the OS build by the device vendor or wireless carrier.

Fix: F-75901r2_fix

Configure the mobile operating system to disable all pre-installed container applications that are not DoD-approved. On the MDM Administration Console, add all pre-installed container applications that are not DoD-approved to the "Application disable list" setting in the "Android KNOX Container >> Container Application" rule. Note: Refer to the Supplemental document for additional information.

b
The Samsung KNOX for Android container must be configured to disable automatic completion of browser text input.
CM-6 - Medium - CCI-000366 - V-69699 - SV-84321r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-39-021000
Vuln IDs
  • V-69699
Rule IDs
  • SV-84321r1_rule
The auto-fill functionality in the web browser allows the user to complete a form that contains sensitive information, such as personally identifiable information (PII), without previous knowledge of the information. By allowing the use of auto-fill functionality, an adversary who learns a user's mobile operating system device password, or who otherwise is able to unlock the device, may be able to further breach other systems by relying on the auto-fill feature to provide information unknown to the adversary. By disabling the auto-fill functionality, the risk of an adversary gaining further information about the device's user or compromising other systems is significantly mitigated. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70141r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow browser auto-fill" setting in the "Android KNOX Container >> Container Restrictions" rule. 2. Verify the setting is disabled. On the Samsung KNOX for Android device: 1. Open the KNOX container. 2. Launch the browser application. 3. Select the application's setting menu. 4. Select "Auto fill profile". 5. Select "Auto fill profile" and attempt to create a profile. 6. Select "Privacy" from the setting menu. 7. Attempt to enable "Save sign-in info". If the "Allow browser auto-fill" configuration in the MDM console is enabled, or if the user is able to successfully create a profile or enable "Save sign-in info", this is a finding.

Fix: F-75903r1_fix

Configure the mobile operating system to disable browser auto-fill for the container browser application. On the MDM Administration Console, disable the "Allow browser auto-fill" setting in the "Android KNOX Container >> Container Restrictions" rule.

a
The Samsung KNOX for Android container must not allow passwords that include more than two repeating or sequential characters.
CM-6 - Low - CCI-000366 - V-69701 - SV-84323r1_rule
RMF Control
CM-6
Severity
Low
CCI
CCI-000366
Version
KNOX-39-021100
Vuln IDs
  • V-69701
Rule IDs
  • SV-84323r1_rule
Password strength is a measure of the effectiveness of a password in resisting guessing and brute force attacks. Passwords that contain repeating or sequential characters are significantly easier to guess than those that do not contain repeating or sequential characters. Therefore, disallowing repeating or sequential characters increases password strength and decreases risk. SFR ID: FMT_SMF_EXT.1.1 #01b
Checks: C-70143r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Max Sequential Characters" and "Max Sequential Numbers" settings in the "Android KNOX Container >> Container Password Restrictions" rule. 2. Verify the value of the setting is the same or less than the required length. On the Samsung KNOX for Android device: 1. Open the KNOX Container. 2. Select "KNOX Settings". 3. Select "Lock type. 4. Enter current password. 5. Select "Password". 6. Attempt to enter a password that contains sequential characters or sequential numbers of length greater than the required length. 7. Verify the password is not accepted. If the configured values of the "Max Sequential Character" and "Max Sequential Number" settings are greater than the required length, or if the device accepts a password that contains sequential characters or sequential numbers of length greater than the required length, this is a finding.

Fix: F-75905r1_fix

Configure the mobile device to enforce a password that does not contain more than two sequential or repeating characters or numbers. On the MDM Administration Console, set the "Max Sequential Characters" and "Max Sequential Numbers" values to "2" in the "Android KNOX Container >> Container Password Restrictions" rule.

b
The Samsung KNOX for Android container must have the Account Whitelist configured.
CM-6 - Medium - CCI-000366 - V-69703 - SV-84325r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-39-021200
Vuln IDs
  • V-69703
Rule IDs
  • SV-84325r1_rule
Whitelisting of authorized email accounts (POP3, IMAP, EAS) prevents a user from configuring a personal email account that could be used to forward sensitive DoD data to unauthorized recipients. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70145r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Account whitelist" setting in the "Container Accounts" rule. 2. Verify the whitelist only contains DoD-approved email domains (for example, mail.mil). Note: Proper configuration of Account blacklist is required for this configuration to function correctly. On the Samsung KNOX for Android device: 1. Open the KNOX Container. 2. Open "Settings". 3. Select "Accounts". 4. Select "Add account". 5. Select "Email" (and repeat for Microsoft Exchange ActiveSync) and attempt to add an email account with a DoD-approved domain. 6. Verify the email account can be added. 7. Attempt to add an email account with a domain not approved by DoD. 8. Verify that the email account cannot be added. If the "Account whitelist" is not properly configured, or if the user is able to successfully configure the email account with a domain not approved by DoD, or if the user is not able to install the DoD-approved email account, this is a finding.

Fix: F-75907r1_fix

Configure the mobile operating system to add DoD-approved email domains to the account whitelist. On the MDM Administration Console, add all DoD-approved email domains to the "Account whitelist" setting in the "Container Accounts" rule. Note: Recommended to add .*@mail.mil.

b
The Samsung KNOX for Android container must have the Account Blacklist configured.
CM-6 - Medium - CCI-000366 - V-69705 - SV-84327r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-39-021300
Vuln IDs
  • V-69705
Rule IDs
  • SV-84327r1_rule
Blacklisting all email accounts is required so only whitelisted accounts can be configured. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70147r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Account blacklist" setting in the "Container Accounts" rule. 2. Verify the setting is configured to all email domains not approved by DoD. Note: All email domains are specified by the wildcard string ".*" On the Samsung KNOX for Android device: 1. Open the KNOX Container. 2. Open "Settings". 3. Select "Accounts". 4. Select "Add account". 5. Select "Email" (and repeat for Microsoft Exchange ActiveSync) and attempt to add an email account with a non-approved domain. 6. Verify the email account cannot be added. If the "Account blacklist" is not properly configured, or if the user is able to successfully configure the non-DoD-approved email account, this is a finding.

Fix: F-75909r1_fix

Configure the mobile operating system to add email domains not approved by DoD to the account blacklist. On the MDM Administration Console, add all email domains not approved by DoD to the "Account blacklist" setting in the "Container Accounts" rule.

b
The Samsung KNOX for Android container must have the minimum password complexity configured.
CM-6 - Medium - CCI-000366 - V-69707 - SV-84329r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-39-022000
Vuln IDs
  • V-69707
Rule IDs
  • SV-84329r1_rule
Authentication mechanisms other than a Password Authentication Factor often provide convenience to users, but many of these mechanisms have known vulnerabilities. Configuring a minimum password complexity mitigates the risk associated with a weak authentication factor. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70149r1_chk

This validation procedure is performed on both the MDM Administration Console and the Samsung KNOX for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Minimum Complexity" setting in the "Android KNOX Container >> Container Password Restrictions" rule. 2. Verify the value of the setting is Alphanumeric. On the Samsung KNOX for Android device: 1. Open the KNOX Container. 2. Select "KNOX Settings". 3. Select "Lock type". 4. Enter current password. 5. Verify "PIN" and "Pattern" are grayed out and cannot be selected. If the configured value of the "Min Complexity" setting is not "Alphanumeric", or if the user is able to select "PIN" or "Pattern", this is a finding. Note: This configuration setting will allow users to implement fingerprint unlock for the container, which is approved for use. However, this approval does not extend to fingerprint unlock for the Samsung device or any other DoD mobile device.

Fix: F-75911r1_fix

Configure the mobile device to enforce a minimum password complexity of "Alphanumeric". On the MDM Console, set the "Min Complexity" value to "Alphanumeric" in the "Android KNOX Container >> Container Password Restrictions" rule.

b
The Samsung KNOX for Android platform must be configured to enable Google Play Inside KNOX.
CM-6 - Medium - CCI-000366 - V-69749 - SV-84371r1_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
KNOX-35-009005
Vuln IDs
  • V-69749
Rule IDs
  • SV-84371r1_rule
Forcing all applications to be installed from authorized application repositories can prevent unauthorized and malicious applications from being installed and executed on mobile devices. Allowing such installations and executions could cause a compromise of DoD data accessible by these unauthorized/malicious applications. SFR ID: FMT_SMF_EXT.1.1 #45
Checks: C-70193r1_chk

This check procedure is performed on both the MDM Administration Console and the Samsung KNOX device. Check that the appropriate setting is configured on the MDM Administration Console. 1. Ask the MDM administrator to display the "Enable Google Play" setting in the "Android Restrictions" rule (work environment container). 2. Verify it is enabled. On the Samsung KNOX for Android device: 1. Attempt to locate the "Google Play" application inside the KNOX container. 2. Verify it is present inside the KNOX container. If the "Enable Google Play" is not enabled inside the KNOX container, this is a finding. Play for Work Inside KNOX is optional, and must be AO approved. If Play for Work Inside KNOX is not used, this requirement is NA.

Fix: F-75955r1_fix

Configure the mobile operating system to enable Google Play Inside KNOX container only. On the MDM Administration Console, enable "Enable Google Play" in the "Android Restrictions" rule (work environment container).