DISA STIG library Y26M10
| Ref | Title | Text | |
|---|---|---|---|
| KNOX-16-000700 | Samsung Android must not accept the certificate when it cannot establish a connection to determine the validity of a certificate. | Verify requirement KNOX-16-009300 (Common Criteria mode) has been implemented. If "Common Criteria mode" has not been implemented, this is a finding. | |
| KNOX-16-004900 | Samsung Android must be configured to enforce a minimum password length of six characters. | Review the configuration to determine if the Samsung Android devices are enforcing a minimum password length of six characters. This validation procedure is performed on both the management tool and the Samsung Android device. On the manage | |
| KNOX-16-005000 | Samsung Android must be configured to not allow passwords that include more than four repeating or sequential characters. | Review the configuration to determine if the Samsung Android devices are disallowing passwords containing more than four repeating or sequential characters. This validation procedure is performed on both the management tool and the Samsung | |
| KNOX-16-005100 | Samsung Android must be configured to lock the display after 15 minutes (or less) of inactivity. | Review the configuration to determine if the Samsung Android devices are locking the device display after 15 minutes (or less) of inactivity. This validation procedure is performed on both the management tool and the Samsung Android device. | |
| KNOX-16-005200 | Samsung Android must be configured to enable a screen-lock policy that will lock the display after a period of inactivity - Disable trust agents. | Review the configuration to determine if the Samsung Android devices are disabling Trust Agents. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restri | |
| KNOX-16-005300 | Samsung Android must be configured to not allow more than 10 consecutive failed authentication attempts. | Review the configuration to determine if the Samsung Android devices are allowing only 10 or fewer consecutive failed authentication attempts. This validation procedure is performed on both the management tool and the Samsung Android device | |
| KNOX-16-005400 | Samsung Android must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including DoW-approved commercial app repository, management tool server, or mobile application store. | Review the configuration to determine if the Samsung Android devices are disabling unauthorized application repositories. This validation procedure is performed on both the management tool and the Samsung Android device. On the management t | |
| KNOX-16-005500 | Samsung Android's Work profile must be configured to enforce an application installation policy by specifying an application allowlist that restricts applications by the following characteristics: Names. | COPE: Review the configuration to determine if the Work profile on the Samsung Android device is allowing users to install only applications that have been approved by the authorizing official (AO). COBO: Review the configuration to determi | |
| KNOX-16-005600 | Samsung Android's Work profile must be configured to not allow installation of applications with the following characteristics: - Back up MD data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmit MD diagnostic data to non-DoW servers; - Voice assistant application if available when MD is locked; - Voice dialing application if available when MD is locked; - Allows synchronization of data or applications between devices associated with user; and… | Verify requirement KNOX-16-005500 (managed Google Play) has been implemented. Verify no apps with unapproved apps are listed in approved apps. If managed Google Play has not been implemented or unapproved apps are allowed, this is a finding | |
| KNOX-16-005700 | Samsung Android allowlist must be configured to not include artificial intelligence (AI) applications that process device data in the cloud, including Google Gemini. | Review managed Samsung Android 16 device configuration settings to determine if the mobile device has an AI application that processes device data in the cloud, including Google Gemini. Verify requirement KNOX-16-009200 (disallow modify acc | |
| KNOX-16-005800 | Samsung Android must be configured to not display the following (Work Environment) notifications when the device is locked: All notifications. | Review the configuration to determine if the Samsung Android devices are not displaying (Work Environment) notifications when the device is locked. Notifications of incoming phone calls are acceptable even when the device is locked. This va | |
| KNOX-16-006000 | Samsung Android must be configured to enable encryption for data at rest on removable storage media or, alternately, the use of removable storage media must be disabled. | Review the configuration to determine if the Samsung Android devices are either enabling data-at-rest protection for removable media or disabling their use. This requirement is not applicable for devices that do not support removable storag | |
| KNOX-16-006100 | Samsung Android must be configured to disable authentication mechanisms providing user access to protected data other than a Password Authentication Factor: Face recognition. | Note: This requirement is not applicable for specific biometric authentication factors included in the product's Common Criteria evaluation. Review the configuration to determine if the Samsung Android devices are disabling Face Recognition | |
| KNOX-16-006400 | Samsung Android must be configured to disable developer modes. | Review the configuration to determine if the Samsung Android devices are disabling developer modes. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device res | |
| KNOX-16-006700 | Samsung Android must be configured to display the DoW advisory warning message at startup or each time the user unlocks the device. | Confirm if Method #1 or #2 is used at the Samsung device site and follow the appropriate procedure. This validation procedure is performed on both the management tool and the Samsung Android device. Validation procedure for Method #1: Place | |
| KNOX-16-007200 | Samsung Android must be configured to disable USB mass storage mode. | Review the configuration to determine if the Samsung Android devices are disabling USB mass storage mode. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the devi | |
| KNOX-16-007300 | Samsung Android must be configured to not allow backup of all applications and configuration data to locally connected systems. | Verify requirement KNOX-16-007200 (disallow USB file transfer) has been implemented. If "Disallow USB file transfer" has not been implemented, this is a finding. | |
| KNOX-16-007400 | Samsung Android must be configured to not allow backup of all applications and configuration data to remote systems. (This requirement applies to the Work Profile for COPE.) - Disable Data Sync Framework. | Verify requirement KNOX-16-009200 (disallow modify accounts) has been implemented. If "disallow modify accounts" has not been implemented, this is a finding. | |
| KNOX-16-007500 | Samsung Android must be configured to not allow backup of all applications and configuration data to remote systems. - Disable Backup Services. | Review the configuration to determine if the Samsung Android devices are disabling backup to remote systems (including commercial clouds). This validation procedure is performed on both the management tool and the Samsung Android device. On | |
| KNOX-16-007700 | Samsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key. | This is a "User-Based Enforcement (UBE)" control. Check a sample of Samsung phones at the site and verify the Wi-Fi hotspot preshared key (password) is set to "WPA3-Personal". 1. Go to Settings >> Connections >> Mobile Hotspot and Tethering | |
| KNOX-16-008300 | Samsung Android must be configured to disable all Bluetooth profiles except for Headset Profile (HSP), Hands-Free Profile (HFP), Serial Port Profile (SPP), Advanced Audio Distribution Profile (A2DP), Audio/Video Remote Control Profile (AVRCP), and Phone Book Access Profile (PBAP). | Review the Samsung documentation and inspect the configuration to verify the Samsung Android devices are paired only with devices that support HSP, HFP, SPP, A2DP, AVRCP, and PBAP Bluetooth profiles. This validation procedure is performed o | |
| KNOX-16-008400 | Samsung Android must be configured to disable ad hoc wireless client-to-client connection capability. | Review the configuration to determine if the Samsung Android devices are disallowing Wi-Fi Direct. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the user restri | |
| KNOX-16-008600 | Samsung Android's Work profile must allow only the Administrator (management tool) to perform the following management function: Install/remove DoW root and intermediate PKI certificates. | COPE: Review the configuration to determine if the Samsung Android devices' Work profile is preventing users from removing DoW root and intermediate PKI certificates. This validation procedure is performed on both the management tool and th | |
| KNOX-16-008700 | Samsung Android must be enrolled as a COBO device. | Review the configuration to determine if the Samsung Android devices are enrolled in a DoW-approved use case. This validation procedure is performed on both the management tool Administration Console and the Samsung Android device. On the m | |
| KNOX-16-008900 | Samsung Android must be configured to disallow configuration of the device's date and time. | Review the configuration to determine if the Samsung Android devices are disallowing the users from changing the date and time. This validation procedure is performed on both the management tool and the Samsung Android device. On the manage | |
| KNOX-16-009000 | Samsung Android's Work profile must have the DoW root and intermediate PKI certificates installed. | COPE: Review the configuration to determine if the Samsung Android's Work profile has the DoW root and intermediate PKI certificates installed. This validation procedure is performed on both the management tool and the Samsung Android devic | |
| KNOX-16-009100 | Samsung Android's Work profile must be configured to enable audit logging. | COPE: Review the configuration to determine if the Samsung Android devices' Work profile is enabling audit logging. This validation procedure is performed on the management tool only. On the management tool, in the Work profile restrictions | |
| KNOX-16-009200 | Samsung Android's Work profile must be configured to prevent users from adding personal email accounts to the work email app. | Review the configuration to determine if the Samsung Android devices are preventing users from adding personal email accounts to the work email app. On the management tool, in the device restrictions section, verify "Modify accounts" is set | |
| KNOX-16-009300 | Samsung Android's Work profile must be configured to enable Common Criteria (CC) mode. | Review the configuration to determine if the Samsung Android devices are enabling CC mode. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the Work profile restri | |
| KNOX-16-009400 | Samsung Android device users must complete required training. | Review a sample of site User Agreements for Samsung device users or similar training records and training course content. Verify Samsung device users have completed required training. The intent is that required training is renewed on a per | |
| KNOX-16-009500 | The Samsung Android device must have the latest available Samsung Android operating system (OS) installed. | Review the configuration to confirm if the Samsung Android devices have the most recently released version of Samsung Android installed. This procedure is performed on both the management tool and the Samsung Android device. In the manageme | |
| KNOX-16-009600 | The Samsung Android device must be configured to enable Certificate Revocation List (CRL) status checking. | Review the configuration to confirm that revocation checking is enabled. Verify the revocation checklist is set to the required applications. This procedure is performed on the management tool. On the management tool: 1. Open Certificates P | |
| KNOX-16-009700 | The Samsung Android device must be configured to enforce that Wi-Fi Sharing is disabled. | Review device configuration settings to confirm Wi-Fi Sharing is disabled. Mobile Hotspot must be enabled to enable Wi-Fi Sharing. If the authorizing official (AO) has not approved Mobile Hotspot, and it has been verified as disabled on the | |
| KNOX-16-009800 | The Samsung Android device work profile must be configured to enforce the system application disable list. | Review the configuration to confirm the system application disable list is enforced. This setting is enforced by default. Verify only approved system apps have been placed on the core allowlist. This procedure is performed on the management | |
| KNOX-16-010200 | The Samsung Android device must be configured to disable the use of third-party keyboards. | Review the managed Samsung device configuration settings to confirm that no third-party keyboards are enabled. This procedure is performed on the management tool. On the management tool: 1. Open "Input methods". 2. Tap "Set input methods". | |
| KNOX-16-010300 | The Samsung Android device must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)]. | Review the device configuration to confirm the USB port is disabled except for charging the device. On the management tool: Verify "Disallow usb file transfer" is toggled to "OFF". If on the management tool the USB port is not disabled, thi | |
| KNOX-16-010400 | The Samsung Android device must be configured to perform the following management function: Disable Phone Hub. | Review the management tool to confirm Phone Hub has been disabled. On the management tool: 1. Open "Nearby notification streaming policy". 2. Verify "Nearby notification streaming policy" is set to "Disabled". 3. Open "Nearby app streaming | |
| KNOX-16-010500 | The Samsung Android device must be configured to disable Wi-Fi Aware for Work Profile apps. | Review device configuration settings to confirm Wi-Fi Aware is disabled for each work profile app. This procedure is performed on the EMM console. For each Work Profile app, verify the app is configured to deny the NEARBY_WIFI_DEVICE permis | |
| KNOX-16-011000 | Samsung Android 16 must disable the ability of the user to wipe the device. | Review configuration settings to confirm the user is unable to perform a factory reset and the admin has the ability to inject a recovery account on the device to unlock Factory Reset Protection (FRP). This check procedure is performed on t | |
| KNOX-16-011200 | Samsung Android 16 must disable wireless printing. | Review configuration settings to confirm wireless printing has been disabled. This check procedure is performed on the device management tool and the Samsung Android 16 device. On the MDM console: COBO/COPE procedures: 1. Open user restrict | |
| KNOX-16-011300 | Samsung Android 16 must disable screen capture. | Review configuration settings to confirm screen capture has been disabled. This check procedure is performed on the device management tool and the Samsung Android 16 device. On the MDM console: COBO/COPE procedures: 1. Open Camera >> Screen | |
| KNOX-16-011400 | Samsung Android 16 devices must have a Mobile Threat Detection (MTD) app installed. | Confirm an MTD app is installed on managed Samsung Android devices. This check procedure is performed on both the device management tool and the Samsung Android device. In the MDM console, verify an MTD app is listed as a managed app being | |
| KNOX-16-011500 | Samsung Android 16 must implement the management setting: disable Camera. | Determine if the site AO has approved the use of device cameras. Look for a document showing approval for a specific user or group of users. If not approved, review configuration settings to confirm "Allow Camera" is disabled. If approved, |
43 of 43.