Mobile STIGs

CAT I 3

Any vulnerability, the exploitation of which will directly and immediately result in loss of confidentiality, availability or integrity.

1. GOOG-16-010500 CAT I V-276775 · PP-MDF-993300

   The Google Android device must be configured to disable Wi-Fi Aware for Work Profile apps.

   Maps to CM-6 via CCI-000366
   Check

   Review device configuration settings to confirm Wi-Fi Aware is disabled for each work profile app. This procedure is performed on the EMM console. For each Work Profile app, verify the app is configured to deny the NEARBY_WIFI_DEVICE permission. Note: Not all apps will support Wi-Fi Aware and have the NEARBY_WIFI_DEVICE permission. If on the EMM console the NEARBY_WIFI_DEVICE permission is not set to "deny" for all Work Profile apps that support Wi-Fi Aware, this is a finding.

   Fix

   Configure the Google Android 16 device to disable Wi-Fi Aware for all Work Profile apps. On the EMM console: For each Work Profile app, configure the NEARBY_WIFI_DEVICE permission to "deny" to block the use of Wi-Fi Aware, if the app supports this feature. If the app does not support Wi-Fi Aware, there may not be a NEARBY_WIFI_DEVICE permission available.

2. GOOG-16-010800 CAT I V-276777 · PP-MDF-993300

   Android 16 devices must have the latest available Google Android 16 operating system installed.

   Maps to CM-6 via CCI-000366
   Check

   Review device configuration settings to confirm the Google Android device has the most recently released version of managed Google Android 16 installed. This procedure is performed on both the EMM Administration Console and the managed Google Android 16 device. On the EMM console, review the version of Google Android 16 installed on a sample of managed devices. This procedure will vary depending on the EMM product. On the managed Google Android 16 device, to determine the installed operating system version: COBO and COPE: 1. Open Settings. 2. Tap "About phone". 3. Verify "Build number". If the installed version of the Google Android 16 operating system on any reviewed device is not the latest released by Google, this is a finding. Google's Android operating system patch website: https://source.android.com/security/bulletin/. Android versions for Pixel devices: https://developers.google.com/android/images.

   Fix

   Install the latest released version of the Google Android 16 operating system on all managed Google devices. Note: Google Android device operating system updates are released directly by Google or can be distributed via the EMM. Check each device manufacturer and/or carriers for current updates.

3. GOOG-16-012500 CAT I V-276783 · PP-MDF-993300

   Google Android 16 must be configured to disable "Private Space" use.

   Maps to CM-6(1) via CCI-000370
   Check

   Review the Google Android 16 work profile configuration settings to confirm that Private Space is disabled. This procedure is performed only on the EMM Administration Console. On the EMM console: COBO: 1. Open "Set user restrictions". 2. Verify that "Disallow add private profile" is set to "ON". COPE: 1. Open "Set user restrictions". 2. Verify that "Disallow add private profile" is set to "ON". If on the EMM console "Disallow add private profile" is not selected, this is a finding.

   Fix

   Configure the Google Android 16 device to disable "Private Space". On the EMM console: COBO: 1. Open "Set user restrictions". 2. Toggle "Disallow add private profile" to "ON". COPE: 1. Open "Set user restrictions". 2. Toggle "Disallow add private profile" to "ON". Configuration API: DISALLOW_ADD_PRIVATE_PROFILE