BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

GOOG-17-006200 Google Android 17 must be configured to disable trust agents.

DISA STIG library Y26M06
All changes in this version
first version loaded CAT II

Maps to IA-2(1) via CCI-000765

Title

Google Android 17 must be configured to disable trust agents.

Control

Review device configuration settings to confirm that trust agents are disabled. This procedure is performed on both the EMM administration console and the managed Google Android 17 device. On the EMM console: COBO: 1. Open "Lock screen restrictions". 2. Verify that "Disable trust agents" is toggled to "ON". COPE: 1. Open "Lock screen restrictions". 2. Select "Personal Profile". 3. Verify that "Disable trust agents" is toggled to "ON". 4. Select "Work Profile". 5. Verify that "Disable trust agents" is toggled to "ON". ____________________________ On the managed Google Android 17 device: COBO and COPE: 1. Open Settings. 2. Tap "Security & privacy". 3. Tap "More security & privacy". 4. Tap "Trust agents". 5. Verify that all listed trust agents are disabled and cannot be enabled. If on the EMM console "disable trust agents" is not selected, or on the managed Google Android 17 device a trust agent can be enabled, this is a finding.

Discussion

Trust agents allow a user to unlock a mobile device without entering a passcode when the mobile device is, for example, connected to a user-selected Bluetooth device or in a user-selected location. This technology would allow unauthorized users to have access to DoW sensitive data if compromised. By not permitting the use of nonpassword authentication mechanisms, users are forced to use passcodes that meet DoW passcode requirements. SFR ID: FMT_SMF_EXT.1.1 #22, FIA_UAU.5.1

Related controls

CCI-000765

Fix

Configure the Google Android 17 device to disable trust agents. On the EMM console: COBO: 1. Open "Lock screen restrictions". 2. Toggle "Disable trust agents" to "ON". COPE: 1. Open "Lock screen restrictions". 2. Select "Personal Profile". 3. Toggle "Disable trust agents" to "ON". 4. Select "Work Profile". 5. Toggle "Disable trust agents" to "ON". Configuration API: KEYGUARD_DISABLE_TRUST_AGENTS