Select any two versions of this STIG to compare the individual requirements
Select any old version/release of this STIG to view the previous requirements
This requirement applies to mobile operating system (OS) smartphones and tablets. Work with traditional reviewer to review site’s physical security policy. Verify the site addresses PDAs and smartphones with embedded cameras. - Mark this as a finding if there is no written physical security policy outlining whether wireless phones with cameras are permitted or prohibited on or in this DoD facility.
Update the security documentation to include a statement if PDAs and smartphones with digital cameras (still and video) are allowed in the facility.
Note: This requirement also applies to handheld barcode scanners equipped with imagers, unless the manufacturer certifies the raw image is only used for bar code processing and is not available to any other application. Work with the traditional reviewer to interview the Security Manager. Obtain the following information: 1. Review site’s physical security policy. 2. Verify users are informed of this policy by reviewing user agreements, posted signs, or training material. 3. Powering off, removal of batteries, or blocking Infrared (IR) ports is not acceptable for disabling camera functionality, as these methods have not been tested for efficacy. 4. Mark as a finding if a written policy does not prohibit these devices in classified areas. Note: For smartphone systems, the site should consider disabling smartphone cameras via a smartphone security policy.
Update site physical security policy. Train users on policy.
Detailed Policy Requirements: This requirement applies to mobile operating system (OS) smartphones and tablets. This requirement also applies to sensitive DoD information stored on mobile OS devices that are not authorized to connect to DoD networks or store/process sensitive DoD information. Sensitive DoD data or information is defined as any data/information that has not been approved for public release by the site/Command Public Affairs Officer (PAO). In accordance with DoD policy, all components must establish Incident Handling and Response procedures. A CMI or “data spill” occurs when a classified email is inadvertently sent on an unclassified network and received on a wireless email device. Classified information may also be transmitted through some other form of file transfer to include web browser downloads and files transferred through tethered connections. Smartphones are not authorized for processing classified data. A data spill also occurs if a classified document is attached to an otherwise unclassified email. For this case, on a smartphone, a data spill will only occur if the classified attached document is viewed or opened by the smartphone user since the smartphone system only downloads an attachment on the smartphone if the user views or opens the attachment. The site's Incident Handling and Response procedures should reference NSA/CSS Storage Device Declassification Manual 9-12, Section 5, for smartphone destruction procedures. Check Procedures: Interview the IAO. Verify classified incident handling, response, and reporting procedures are documented in site smartphone procedures or security policies. Mark as a finding if classified incident handling, response, and reporting procedures are not documented in site smartphone procedures or security policies. This requirement applies at both sites where smartphones are issued and managed and at sites where the smartphone management server is located. ---At the smartphone management server site, verify Incident Handling and Response procedures include actions to sanitize the smartphone management server and email servers (e.g., Exchange, Oracle mail). ---At smartphone sites, verify Incident Handling and Response procedures include actions for incident reporting and actions to safeguard classified smartphone devices. The following actions will be followed for all smartphones involved in a data spill: -BlackBerry smartphones: follow procedures in the DoD Data Spill Procedures Guide for BlackBerry Smartphones located at http://iase.disa.mil/stigs/net_perimeter/wireless/smartphone.html. -Windows Mobile, Android, and iOS smartphones: the smartphone will be destroyed. Mark as a finding if Incident Handling and Response procedures do not include required information.
A Classified Message Incident (CMI) procedure or policy must be published for the site.
Detailed Policy Requirements: This requirement applies to mobile operating system (OS) smartphones and tablets. This requirement also applies to sensitive DoD information stored on mobile OS devices that are not authorized to connect to DoD networks or store/process sensitive DoD information. Sensitive DoD data or information is defined as any data/information that has not been approved for public release by the site/Command Public Affairs Officer (PAO). If a data spill occurs on a smartphone, the following actions must be completed: - The smartphone management server and email servers (i.e., Exchange, Oracle mail, etc.) are handled as classified systems until they are sanitized according to appropriate procedures. (See NSA/CSS Storage Device Declassification Manual 9-12 for sanitization procedures.) - The smartphone is handled as a classified device and destroyed according to DoD guidance for destroying classified equipment or sanitized as directed in Check WIR-SPP-003-01. Check Procedures: Interview the IAO. Determine if the site has had a data spill within the previous 24 months. If yes, review written records, incident reports, and/or after action reports and determine if required procedures were followed. Mark as a finding if the site had a data spill within the previous 24 months and required procedures were not followed.
If a data spill occurs on a wireless email device or system at a site, the site must follow required procedures.
This requirement applies to mobile operating system (OS) smartphones and tablets. Prior to disposing of a smartphone (for example, if the smartphone is transferred to another DoD or government agency), follow the disposal procedures found in the STIG/ISCG Technology Overview document of the STIG/ISCG for the smartphone of interest. For example, look in the BlackBerry Overview document in the BlackBerry STIG for the disposal procedures for a BlackBerry smartphone or the Windows Mobile Overview in the Good Mobile Messaging STIG for the disposal procedures for a Windows Mobile smartphone. Interview the IAO. Verify proper procedures are being followed and the procedures are documented. Check to see how retired, discarded, or transitioned smartphones were disposed of during the previous 6 – 12 months and verify compliance with requirements. Note: The site can find disposal procedures listed in the smartphone STIG/ISCG. Mark as a finding if procedures are not documented, or if documented, they were not followed.
Prior to disposing of a smartphone or transitioning it to another user, either in DoD or another agency, follow required procedures.
This requirement applies to mobile operating system (OS) smartphones and tablets. This requirement does not apply to the SME PED as it is the only smartphone approved for classified data use. Interview the IAO. Verify written policy and training material exists (or requirement is listed on a signed user agreement) stating smartphones must not be used to transmit classified information. Mark as a finding if written policy or training material does not exist, stating smartphones must not be used to transmit classified information.
Do not process, send, receive, or use classified data on smartphones.
Detailed Policy Requirements: This requirement applies to mobile operating system (OS) smartphones and tablets. All smartphone users must receive required training on the following topics before they are issued a smartphone. a. Requirement that personally-owned PEDs are not used to transmit, receive, store, or process DoD information unless approved by the DAA and the owner signs forfeiture agreement in case of a security incident. b. Procedures for wireless device usage in and around classified processing areas. c. Requirement that PEDs with digital cameras (still and video) are not allowed in any SCIF or other areas where classified documents or information is stored, transmitted, or processed. d. Procedures for a data spill. e. Requirement that wireless email devices and systems are not used to send, receive, store, or process classified messages. f. Requirement that smartphone devices and systems will not be connected to classified DoD networks or information systems. g. Requirement that a user immediately notify appropriate site contacts (i.e., IAO, smartphone management server administrator, supervisor, etc.) when his/her smartphone has been lost or stolen. h. Secure Bluetooth Smart Card Reader (SCR) usage: --Secure pairing procedures. --Perform secure pairing immediately after the SCR is reset. --Accept only Bluetooth connection requests from devices they control. --Monitor Bluetooth connection requests and activity in order to detect possible attacks and unauthorized activity. i. Procedures on how to sign and encrypt email. j. If Short Message Service (SMS) and/or Multi-media Messaging Service (MMS) are used, IA awareness training material should include SMS/MMS security issues. k. Requirement that Over-The-Air (OTA) wireless software updates should only come from DoD sources. Software updates from the wireless carrier or other non-DoD sources will not be used until the download has been tested and approved by the IAO. l. When smartphone Wi-Fi Service is used, the following training will be completed: --Procedures for setting up a secure Wi-Fi connection and verifying that the active connection is to a known access point. --Approved connection options (i.e., enterprise, home, etc.). --Requirements for home Wi-Fi connections. --The Wi-Fi radio will be disabled by the user whenever a Wi-Fi connection is not being used.--The Wi-Fi radio must never be enabled while the smartphone is connected to a PC. m. Do not discuss sensitive or classified information on non-secure (devices not FIPS 140-2 certified or NSA Type-1 certified for voice) cellular phones, cordless phones, and two-way radios used for voice communications. n. Do not connect PDAs and smartphones to any workstation that stores, processes, or transmits classified data. (Exception: SME PED) o. Manually download updates to antivirus and personal firewall application at least every 14 days if automatic updating is not available. (Applies only if specific PDA/smartphone device has an antivirus/personal firewall application(s).) p. The installation of user owned applications, including geo-location aware applications, on the mobile device will be based on the Command’s Mobile Device Personal Use Policy. q. The use of the mobile OS device to view and/or download personal email will be based the Command’s Mobile Device Personal Use Policy. r. The download of user owned data (music files, picture files, etc.) on the mobile device will be based the Command’s Mobile Device Personal Use Policy. s. The use of the mobile device to connect to user social media web accounts will be based the Command’s Mobile Device Personal Use Policy. t. When the Bluetooth radio is authorized for use with an approved smartcard reader or handsfree headset, the user will disable the Bluetooth radio whenever a Bluetooth connection is not being used. Additional BlackBerry requirements: a. Procedures for conducting an AutoBerry scan, requirements for reporting the results of the scan to site IAO or BlackBerry Administrator, and to completion of mitigation actions recommended by the tool after the scan. b. If the use of the BlackBerry Keeper is approved by the DAA, users are trained on password configuration and change requirements. --Passwords must be changed at least every 90 days. c. When SCR is used with a PC, users with PC administrative rights will not disable the RIM Bluetooth Lockdown tool on the PC. d. Procedures on how to verify and/or set the Bluetooth SCR device property, Trusted field, to be set to “Prompt.”. This is the default value. This property is set on the BlackBerry device in the Bluetooth Device Properties immediately after the Bluetooth pairing connection alert. e. When using an approved Bluetooth headset or handsfree device the following procedures will be followed: -The user will pair only an approved device to the BlackBerry handheld. -If the user receives a request for Bluetooth pairing on their BlackBerry handheld from a Bluetooth device other than their smart card reader (CAC reader) or headset, the request will not be accepted by the user. -Pairing of a Bluetooth headset with the BlackBerry handheld will be completed in a non-public area whenever possible. Additional iPhone/iPad/iPod Touch requirements: a. Procedure on how to disable the device Bluetooth radio. The Bluetooth radio must be disabled at all times. (Some iPhone security systems will alert the system administrator and IAO if the user has turned on the Bluetooth radio.) b. Procedure on how to disable the device Wi-Fi radio. The Wi-Fi radio will only be used when authorized. (Some iPhone security systems will alert the system administrator and IAO if the user has turned on the Wi-Fi radio.) c. If a user connects their device to a PC with iTunes, the user may receive a prompt asking if they want to install an available update of Apple iOS. The user should always refuse the update. Apple iOS updates will always be completed by the site system administrator. d. Procedure on how to disable Location Services on the device. Location Services must be disabled for all applications or enabled only for applications approved by the DAA for location based services. e. Procedure to disable "Ask to Join Networks" Wi-Fi feature. This feature must be disabled at all times. f. Procedure to disable "AutoFill" in the Safari web browser. This feature must be disabled at all times. g. The iOS device should sync to a minimum number of approved machines, should not sync to laptops that travel with the device, and should always use encrypted backups. The act of connecting an iOS device to a PC can put it at risk of attack if the PC is compromised. h. Procedure on how to enable/disable the device Personal Hotspot service and connect only via USB connections. Personal Hotspot or Tethered Modem services will only be used with IAO approval. Wi-Fi or Bluetooth connections to the Personal Hotspot are not authorized. Additional Android requirements: a. Procedure on how to disable the device Bluetooth radio. The Bluetooth radio will only be used when needed when a connection to the Bluetooth CAC reader is required. When not using the CAC reader, the radio will be disabled. b. Procedure on how to disable the device Wi-Fi radio. The Wi-Fi radio will only be used when authorized. c. Procedure on how to disable Location Services on the device. Location Services must be disabled for all applications or enabled only for applications approved by the DAA for location based services. d. Procedure on how to enable/disable the device Personal Hotspot service. Wi-Fi or Bluetooth connection to a personal Hotspot is not authorized. Additional training requirements for mobile device not authorized to connect to a DoD network or store/process sensitive DoD information (Non-enterprise activated). a. Mobile Device (Non-Enterprise Activated) must not be connected to a DoD wired or wireless network. Allowed exception: the device can be connected to a DoD managed Internet-Gateway-only connected Wi-Fi access point (AP). b. Mobile Device (Non-Enterprise Activated) must not have sensitive or classified data stored or processed on the device. c. Mobile Device (Non-Enterprise Activated) must not be used to connect to a DoD email system. d. The user will read and be familiar with the local site and/or Command must publish a Personal Use Policy for site/Command managed or owned mobile devices (smartphones and tablets). Note: Listing training requirements in the User Agreement is an acceptable procedure for informing/training users on many of the required training topics. Check Procedures: - Review site smartphone training material to see if it contains the required content. Note: Some training content may be listed in the User Agreement signed by the user. - Verify site training records show that smartphone users received required training and training occurred before the user was issued a smartphone or tablet. Check training records for approximately five users, picked at random. Mark as a finding if training material does not contain required content.
All smartphone users will complete required training.
Detailed Policy Requirements: This requirement applies to mobile operating system (OS) smartphones and tablets. The site (location where smartphones are issued and managed and the site where the smartphone management server is located) must publish procedures to follow if a smartphone has been lost or stolen. The procedures should include (as appropriate): -Smartphone user notifies IAO, SM, and other site personnel, as required by the site’s Incident Response Plan, within the timeframe required by the site’s Incident Response Plan. -The IAO notifies the smartphone management server system administrator and other site personnel, as required by the site’s Incident Response Plan, within the timeframe required by the site’s Incident Response Plan. The site smartphone management server administrator sends a wipe command to the smartphone and then disables the user account on the management server or removes the smartphone from the user account. Check procedures: Interview the IAO. Review the site’s Incident Response Plan or other policies and determine if the site has a written plan of action. Mark as a finding if the site does not have a written plan of action following a lost or stolen smartphone.
Publish procedures to follow if a smartphone is lost or stolen.
Detailed Policy Requirements: The smartphone system administrator must perform a Wipe command on all new or reissued smartphones and reload system software and load a STIG or ISCG-compliant security policy on the smartphone before issuing it to DoD personnel and placing the device on a DoD network. When wireless activation is performed, the activation password is passed to the user in a secure manner (e.g., activation password is encrypted and emailed to an individual). Check Procedures: Interview the IAO. Verify required procedures are followed. Mark as a finding if required procedures were not followed.
Smartphone system administrator must perform a Wipe command on all new or reissued smartphones.
Detailed Policy Requirements: Software updates must come from either DoD sources or DoD approved sources. Smartphone system administrators should push OTA software updates from the smartphone management server, when this feature is available. Otherwise the site administrator should verify the non-DoD source of the update has been approved by IT management. Check Procedures: Interview the IAO and smartphone management server system administrator. -Verify the site smartphone handheld administrator and the smartphone management server administrator are aware of the requirement. -Determine what procedures are used at the site for installing software updates on site-managed smartphones. Mark as a finding if the site does not have procedures in place so users can down-load software updates from a DoD source or DoD approved source.
Ensure smartphone software updates originate from DoD sources or approved non-DoD sources only. Users do not accept Over-The-Air (OTA) wireless software updates from non-approved sources.
Interview the IAO or smartphone system administrator and determine if smartphone IM is used on site-managed smartphones. If yes, determine what server the smartphone IM system connects to. - The server should be managed by a DoD site. - The IM system must be compliant with the Instant Messaging STIG. Mark as a finding if the IM server the smartphone IM app connects to is not managed by a DoD site.
Apply the Instant Messaging (IM) STIG requirements for the IM application on smartphones.
Detailed Policy Requirements: -The site wireless security policy or wireless remote access policy shall include information on locations where smartphone Wi-Fi access is approved or disapproved. The following locations will be specifically listed in the policy: -Site-managed Wi-Fi access point connected to the NIPRNet (Enclave-NIPRNet Connected) -Site-managed Wi-Fi access point connected to the Internet only (Internet Gateway Only Connection) -Public Wi-Fi Hotspot -Hotel Wi-Fi Hotspot -Home Wi-Fi network (user managed) Note: DoD smartphones will not be used to connect to Public or Hotel Hotspots. Note: Apple iOS devices (iPhone, iPad, and iPod touch) will not be used to connect to site-managed Wi-Fi access points connected to the NIPRNet (Enclave-NIPRNet Connected). Check Procedures: Interview the IAO. Review the site policy. Verify it contains the required information. Mark as a finding if site policy does not contain the required information.
Smartphone Wi-Fi security policy includes required content.
The DAA may approve the use of software certificates until approved CAC readers are available and can be purchased and fielded by the site. If user software certificates are used on site managed smartphones instead of the CAC, verify the DAA has approved their use (in a letter, memo, SSP, etc.) and that a DoD-approved CAC reader is not available for the smartphone. Mark as a finding if the site uses software certificates on site managed smartphones and the DAA has not approved their use.
Obtain DAA approval for the use of software certificates or purchase approved CAC readers.
This requirement applies to mobile operating system (OS) smartphones and tablets. Interview the IAO. Determine if any site smartphones were reported lost or stolen within the previous 24 months. If yes, review written records, incident reports, and/or after action reports and determine if required procedures were followed. Mark as a finding if the site had a lost or stolen smartphone within the previous 24 months and required procedures were not followed.
Required actions must be followed at the site when a smartphone is reported lost or stolen.
Detailed Policy Requirements: The IAO and the site wireless device administrator must ensure all wireless remote access users receive training on the following topics before they are authorized to access a DoD network via a wireless remote access device: - Maintaining physical control of the device - Reducing exposure of sensitive data - Backing up data frequently - User authentication, anti-virus, personal firewall, and content encryption requirements - Enabling wireless interfaces only when needed - Enable VPN connection to the DoD network immediately after establishing a wireless connection - All Internet browsing will be done via the VPN connection to the DoD network - No split tunneling of VPN - Locations where wireless remote access is authorized or not authorized (i.e., home, airport, hotel, etc.) - Wireless client configuration requirements - Use of WPA2 Personal (AES) on home WLAN - Home WLAN password and SSID requirements - Discontinue the use of devices suspected of being tampered with and notify the site IAO. For iOS devices, add: -User should select “Forget this Network” while still in physical range. (This prevents the iPhone from automatically joining networks later that may share the same SSID. The user will not be able to “forget” individual networks when out of range and will have to reset all network settings.) Check Procedures: Review site wireless device and/or IA awareness training material to verify it contains the required content. Note: Some training content may be listed in the User Agreement signed by the user. Verify site training records show authorized wireless remote access users received required training and training occurred before the users were issued a device. Check training records for approximately five users, picked at random. Mark as a finding if training material does not contain the required content or if wireless remote access users have not received required training.
Complete required training
Detailed Policy Requirements: A site's Remote Access Policy will be written and signed by the site DAA, Commander, Director, or other appropriate manager. Recommend the policy includes required security controls for the DoD-owned/operated wireless client (laptop or PDA): - Device unlock password requirements - Anti-virus application - Personal firewall - Client software patches kept up to date - Internet browsing though enterprise Internet gateway - Device security policy managed by centrally-managed policy manager - Anti-spyware app (recommended) - Procedures after client is lost, stolen, or other security incident occurs - Host-based Wireless Intrusion Detection and Prevention System (WIDPS)/monitor WIDPS - Configuration requirements of wireless client - Home WLAN authentication requirements. - Home WLAN SSID requirements. - Separate WLAN access point required for home WLAN - 8+-character authentication password required for home WLAN. - Use of third-party Internet portals (kiosks) (approved or not approved) - Use of personally-owned or contractor-owned client devices (approved or not approved) - Implementation of health check of client device before connection is allowed - Places where remote access is approved (home, hotels, airport, etc.) - Roles and responsibilities: --Which users or groups of users are and are not authorized to use organization's WLANs --Which parties are authorized and responsible for installing and configuring APs and other WLAN equipment - WLAN infrastructure security: --Physical security requirements for WLANs and WLAN devices, including limitations on the service areas of WLANs --Types of information that may and may not be sent over WLANs, including acceptable use guidelines - WLAN client device security: --The conditions under which WLAN client devices are and are not allowed to be used and operated. --Standard hardware and software configurations that must be implemented on WLAN client devices to ensure the appropriate level of security. --Limitations on how and when WLAN client’s device may be used, such as specific locations. - Guidelines on reporting losses of WLAN client devices and reporting WLAN security incidents - Guidelines for the protection of WLAN client devices to reduce theft Check Procedures: Interview the IAO and/or the site wireless device administrator and determine if the site has a wireless remote access policy (or a wireless section in a general remote access policy). Verify the policy has been signed by the site DAA, Commander, Director, or other appropriate managers. Mark as a finding if a wireless remote access policy does not exist or is not signed.
Publish required policy.
Review the site's SSP and verify it includes a listing of approved wireless remote access equipment and locations (home, hotel, etc.). Mark as a finding if the site SSP does not reference approved wireless remote access equipment and locations.
Update SSP with wireless remote access information.
This requirement applies to mobile operating system (OS) smartphones and tablets. All smartphone users must receive required smartphone training annually. Mark as a finding if training records do not show users receiving required training at least annually.
Complete required training annually for all smartphone users.