Unified Endpoint Management Agent Security Requirements Guide

Description

This Security Requirements Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: [email protected]

Details

Version / Release: V1R1

Published: 2020-12-14

Updated At: 2021-02-04 18:26:53

Actions

Download

Filter

Findings
Severity Open Not Reviewed Not Applicable Not a Finding
Overall 0 0 0 0
Low 0 0 0 0
Medium 0 0 0 0
High 0 0 0 0
Drop CKL or SCAP (XCCDF) results here.

    Vuln Rule Version CCI Severity Title Description Status Finding Details Comments
    SV-234235r617416_rule SRG-APP-000089-UEM-100002 CCI-000169 MEDIUM The UEM Agent must provide an alert via the trusted channel to the UEM Server in the event of any of the following audit events: -successful application of policies to a mobile device -receiving or generating periodic reachability events -change in enrollment state -failure to install an application from the UEM Server -failure to update an application from the UEM Server. Alerts providing notification of a change in enrollment state facilitate verification of the correct operation of security functions. When an UEM server receives such an alert from an UEM Agent, it indicates the security policy may no longer be enforced o
    SV-234236r617390_rule SRG-APP-000089-UEM-100004 CCI-000169 MEDIUM The UEM Agent must generate a UEM Agent audit record of the following auditable events:-startup and shutdown of the UEM Agent-UEM policy updated-any modification commanded by the UEM Server. Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. Audit records can be generated from various components within the
    SV-234237r617354_rule SRG-APP-000089-UEM-100012 CCI-000169 MEDIUM The UEM Agent must be configured to enable the following function: read audit logs of the managed endpoint device. Audit logs and alerts enable monitoring of security-relevant events and subsequent forensics when breaches occur. They help identify when the security posture of the device is not as expected. This enables the UEM administrator to take an appropriate reme
    SV-234238r617417_rule SRG-APP-000097-UEM-100005 CCI-000132 MEDIUM The UEM Agent must record within each UEM Agent audit record the following information: -date and time of the event -type of event -subject identity -(if relevant) the outcome (success or failure) of the event. Audit logs enable monitoring of security-relevant events and subsequent forensics when breaches occur. For audit logs to be useful, administrators must have the ability to view them. Satisfies: FAU_GEN.1.2(2) Refinement
    SV-234239r617354_rule SRG-APP-000175-UEM-100008 CCI-000185 MEDIUM The UEM Agent must not install policies if the policy-signing certificate is deemed invalid. It is critical that the UEM agent only use validated certificates for policy updates. Otherwise, there is no assurance that a malicious actor has not inserted itself in the process of packaging the code or policy. Satisfies: FMT_POL_EXT.2.2
    SV-234240r617354_rule SRG-APP-000176-UEM-100001 CCI-000186 MEDIUM The UEM Agent must use managed endpoint device key storage for all persistent secret and private keys. If validated secure storage locations are not used for keys, they could be compromised. Satisfies: FCS_STG_EXT.1(2)
    SV-234241r617354_rule SRG-APP-000358-UEM-100003 CCI-001851 MEDIUM The UEM Agent must queue alerts if the trusted channel is not available. Alerts providing notification of a change in enrollment state facilitate verification of the correct operation of security functions. When an UEM server receives such an alert from an UEM Agent, it indicates the security policy may no longer be enforced o
    SV-234242r617354_rule SRG-APP-000358-UEM-100013 CCI-001851 MEDIUM The UEM Agent must be configured to enable the following function: transfer managed endpoint device audit logs read by the UEM Agent to an UEM server or third-party audit management server. Audit logs and alerts enable monitoring of security-relevant events and subsequent forensics when breaches occur. They help identify when the security posture of the device is not as expected. This enables the UEM administrator to take an appropriate reme
    SV-234243r617354_rule SRG-APP-000427-UEM-100007 CCI-002470 MEDIUM The UEM Agent must only accept policies and policy updates that are digitally signed by a certificate that has been authorized for policy updates by the UEM Server. It is critical that the UEM agent only use validated certificates for policy updates. Otherwise, there is no assurance that a malicious actor has not inserted itself in the process of packaging the code or policy. Satisfies: FMT_POL_EXT.2.1
    SV-234244r617354_rule SRG-APP-000427-UEM-100009 CCI-002470 MEDIUM The UEM Agent must perform the following functions: Import the certificates to be used for authentication of UEM Agent communications. It is critical that the UEM agent only use validated certificates for policy updates. Otherwise, there is no assurance that a malicious actor has not inserted itself in the process of packaging the code or policy. Satisfies: FMT_SMF_EXT.4.1
    SV-234245r617354_rule SRG-APP-000516-UEM-100006 CCI-000366 MEDIUM The UEM Agent must record the reference identifier of the UEM Server during the enrollment process. Audit logs enable monitoring of security-relevant events and subsequent forensics when breaches occur. For audit logs to be useful, administrators must have the ability to view them. Satisfies: FIA_ENR_EXT.2.1
    SV-234246r617392_rule SRG-APP-000516-UEM-100010 CCI-000366 MEDIUM The UEM Agent must perform the following functions: -enroll in management -configure whether users can unenroll from management -configure periodicity of reachability events. Access control of mobile devices to DoD sensitive information or access to DoD networks must be controlled so that DoD data will not be compromised. The primary method of access control of mobile devices is via enrollment of authorized mobile devices on t
    SV-234247r617393_rule SRG-APP-000516-UEM-100011 CCI-000366 MEDIUM The UEM Agent must be configured to perform one of the following actions upon an attempt to unenroll the mobile device from management: -prevent the unenrollment from occurring -wipe the device to factory default settings -wipe the work profile with all associated applications and data. Access control of mobile devices to DoD sensitive information or access to DoD networks must be controlled so that DoD data will not be compromised. The primary method of access control of mobile devices is via enrollment of authorized mobile devices on t
    SV-234248r617402_rule SRG-APP-000555-UEM-100014 CCI-002450 HIGH All UEM Agent cryptography supporting DoD functionality must be FIPS 140-2 validated. Unapproved cryptographic algorithms cannot be relied on to provide confidentiality or integrity, and DoD data could be compromised as a result. The most common vulnerabilities with cryptographic modules are those associated with poor implementation. FIPS