Mobile STIGs

CAT II 33

Any vulnerability, the exploitation of which has a potential to result in loss of confidentiality, availability or integrity.

1. KNOX-16-004900 CAT II V-276562 · PP-MDF-333024

   Samsung Android must be configured to enforce a minimum password length of six characters.

   Maps to IA-5(1) via CCI-004066
   Check

   Review the configuration to determine if the Samsung Android devices are enforcing a minimum password length of six characters. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device password policies, verify "minimum password length" is set to "6". On the Samsung Android device: 1. Open Settings >> Lock screen and AOD >> Screen lock and biometrics. 2. Enter current password. 3. Tap "PIN". 4. Verify the text "PIN must contain at least", followed by a value of at least "6 digits", appears above the PIN entry. If on the management tool "minimum password length" is not set to "6", or on the Samsung Android device the text "PIN must contain at least" is followed by a value of less than "6 digits", this is a finding.

   Fix

   Configure the Samsung Android devices to enforce a minimum password length of six characters. On the management tool, in the device password policies, set "minimum password length" to "6". API: setPasswordMinimumLength

2. KNOX-16-005000 CAT II V-276563 · PP-MDF-333025

   Samsung Android must be configured to not allow passwords that include more than four repeating or sequential characters.

   Maps to IA-5(1) via CCI-004066
   Check

   Review the configuration to determine if the Samsung Android devices are disallowing passwords containing more than four repeating or sequential characters. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device password policies, verify "minimum password quality" is set to "Numeric(Complex)" or better. On the Samsung Android device: 1. Open Settings >> Lock screen and AOD >> Screen lock and biometrics. 2. Enter current password. 3. Tap "PIN". 4. Verify PINs with more than four repeating or sequential numbers are not accepted. If on the management tool "minimum password quality" is not set to "Numeric(Complex)" or better, or on the Samsung Android device a password with more than four repeating or sequential numbers is accepted, this is a finding.

   Fix

   Configure the Samsung Android devices to disallow passwords containing more than four repeating or sequential characters. On the management tool, in the device password policies, set "minimum password quality" to "Numeric(Complex)" or better. If the management tool does not support "Numeric(Complex)" but does support "Numeric", Knox Platform for Enterprise (KPE) can be used to achieve STIG compliance. In this case, configure this policy with value "Numeric" and use an additional KPE policy (innately by the management tool or via KSP) "Maximum Numeric Sequence Length" with value "4". API: setPasswordQuality or setRequiredPasswordComplexity

3. KNOX-16-005100 CAT II V-276560 · PP-MDF-333030

   Samsung Android must be configured to lock the display after 15 minutes (or less) of inactivity.

   Maps to AC-11 via CCI-000057
   Check

   Review the configuration to determine if the Samsung Android devices are locking the device display after 15 minutes (or less) of inactivity. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device password policies, verify "max time to screen lock" is set to "15 minutes" or less. On the Samsung Android device: 1. Open Settings >> Lock screen and AOD. 2. Verify "Secure lock settings" is present and tap it. 3. Enter current password. 4. Tap "Auto lock when screen turns off". 5. Verify the listed timeout values are 15 minutes or less. If on the management tool "max time to screen lock" is not set to "15 minutes" or less, or on the Samsung Android device "Secure lock settings" is not present and the listed Screen timeout values include durations of more than 15 minutes, this is a finding.

   Fix

   Configure the Samsung Android devices to lock the device display after 15 minutes (or less) of inactivity. On the management tool, in the device password policies, set "max time to screen lock" to "15 minutes" or less. A device password must be set for "max time to screen lock" to become active. API: setMaximumTimeToLock

4. KNOX-16-005200 CAT II V-276557 · PP-MDF-333030

   Samsung Android must be configured to enable a screen-lock policy that will lock the display after a period of inactivity - Disable trust agents.

   Maps to IA-2(1) via CCI-000765
   Check

   Review the configuration to determine if the Samsung Android devices are disabling Trust Agents. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions, verify "Trust Agents" are set to "Disable". On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> Trust agents. 2. Verify all listed Trust Agents are disabled and cannot be enabled. If a Trust Agent is not disabled in the list, verify for that Trust Agent, all of its listed Trustlets are disabled and cannot be enabled. If on the management tool "Trust Agents" are not set to "Disable", or on the Samsung Android device a "Trust Agent" or "Trustlet" can be enabled, this is a finding. Note: If the management tool has been correctly configured but a Trust Agent is still enabled, configure the "List of approved apps listed in managed Google Play" to disable it; refer to KNOX-16-005500. Exception: Trust Agents may be used if the authorizing official (AO) allows a screen lock timeout after four hours (or more) of inactivity. This may be applicable to tactical use case.

   Fix

   Configure the Samsung Android devices to disable Trust Agents. On the management tool, in the device restrictions, set "Trust Agents" to "Disable". API: setKeyguardDisabledFeatures, KEYGUARD_DISABLE_TRUST_AGENTS or setTrustAgentConfiguration

5. KNOX-16-005300 CAT II V-276559 · PP-MDF-333040

   Samsung Android must be configured to not allow more than 10 consecutive failed authentication attempts.

   Maps to AC-7 via CCI-000044
   Check

   Review the configuration to determine if the Samsung Android devices are allowing only 10 or fewer consecutive failed authentication attempts. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device password policies, verify "max password failures for local wipe" is set to "10" attempts or less. On the Samsung Android device: 1. Open Settings >> Lock screen and AOD. 2. Verify "Secure lock settings" is present and tap it. 3. Enter current password. 4. Verify "Auto factory reset" is grayed out, and cannot be configured. Note: When "Auto factory reset" is grayed out, this indicates the Administrator (MDM) is in control of the setting to wipe the device after 10 or fewer consecutive failed authentication attempts. If on the management tool "max password failures for local wipe" is not set to "10" attempts or less, or on the Samsung Android device the "Auto factory reset" menu can be configured, this is a finding.

   Fix

   Configure the Samsung Android devices to allow only 10 or fewer consecutive failed authentication attempts. On the management tool, in the device password policies, set "max password failures for local wipe" to "10" attempts or fewer. A device password must be set for "max password failures for local wipe" to become active. API: setMaximumFailedPasswordsForWipe

6. KNOX-16-005400 CAT II V-276542 · PP-MDF-333050

   Samsung Android must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including DoW-approved commercial app repository, management tool server, or mobile application store.

   Maps to CM-6 via CCI-000366
   Check

   Review the configuration to determine if the Samsung Android devices are disabling unauthorized application repositories. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the Work profile restrictions, verify "installs from unknown sources globally" is set to "Disallow". On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> Install unknown apps. 2. Verify each app listed has the status "Disabled" under the app name or no apps are listed. On COPE devices, confirm this in both the "Personal" and "Work" tabs. If on the management tool "installs from unknown sources globally" is not set to "Disallow", or on the Samsung Android device an app is listed with a status other than "Disabled", this is a finding.

   Fix

   Configure the Samsung Android devices to disable unauthorized application repositories. COPE: On the management tool, in the Work profile restrictions, set "installs from unknown sources globally" to "Disallow". COBO: On the management tool, in the device restrictions, set "installs from unknown sources globally" to "Disallow". Note: Google Play must not be disabled. Disabling Google Play will cause system instability and critical updates will not be received. API: addUserRestriction, DISALLOW_INSTALL_UNKNOWN_SOURCES_GLOBALLY

7. KNOX-16-005500 CAT II V-276614 · PP-MDF-333060

   Samsung Android's Work profile must be configured to enforce an application installation policy by specifying an application allowlist that restricts applications by the following characteristics: Names.

   Maps to CM-7(2) via CCI-001764
   Check

   COPE: Review the configuration to determine if the Work profile on the Samsung Android device is allowing users to install only applications that have been approved by the authorizing official (AO). COBO: Review the configuration to determine if the Samsung Android devices are allowing users to install only applications that have been approved by the AO. This validation procedure is performed only on the management tool. On the management tool, in the app catalog for managed Google Play, verify that only AO-approved apps are available. If on the management tool the app catalog for managed Google Play includes non-AO-approved apps, this is a finding.

   Fix

   COPE: Configure the Work profile on Samsung Android devices to allow users to install only applications that have been approved by the AO. COBO: Configure Samsung Android devices to allow users to install only applications that have been approved by the AO. In addition to any local policy, the AO must not approve applications that have certain prohibited characteristics; these are covered in KNOX-16-005600. On the management tool, in the app catalog for managed Google Play, add each AO-approved app to be available. Note: Managed Google Play is an allowed App Store.

8. KNOX-16-005600 CAT II V-276615 · PP-MDF-333070

   Samsung Android's Work profile must be configured to not allow installation of applications with the following characteristics: - Back up MD data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmit MD diagnostic data to non-DoW servers; - Voice assistant application if available when MD is locked; - Voice dialing application if available when MD is locked; - Allows synchronization of data or applications between devices associated with user; and…

   Maps to IA-7 via CCI-000803
   Check

   Verify requirement KNOX-16-005500 (managed Google Play) has been implemented. Verify no apps with unapproved apps are listed in approved apps. If managed Google Play has not been implemented or unapproved apps are allowed, this is a finding.

   Fix

   The authorizing official (AO) must not approve applications with the following characteristics for installation by users in the Work profile: - Back up MD data to non-DoW cloud servers (including user and application access to cloud backup services); - Transmit MD diagnostic data to non-DoW servers; - Voice assistant application if available when MD is locked; - Voice dialing application if available when MD is locked; - Allows synchronization of data or applications between devices associated with user; - Payment processing; and - Allows unencrypted (or encrypted but not FIPS 140-2/140-3-validated) data sharing with other MDs, display screens (screen mirroring), or printers. - Apps that backup their own data to a remote system. - Apps that render TV shows and movies. Implement managed Google Play (refer to requirement KNOX-16-005500).

9. KNOX-16-005700 CAT II V-276569 · PP-MDF-333070

   Samsung Android allowlist must be configured to not include artificial intelligence (AI) applications that process device data in the cloud, including Google Gemini.

   Maps to IA-7 via CCI-000803
   Check

   Review managed Samsung Android 16 device configuration settings to determine if the mobile device has an AI application that processes device data in the cloud, including Google Gemini. Verify requirement KNOX-16-009200 (disallow modify accounts) has been implemented. Verify the KPE API "isIntelligenceOnlineProcessingAllowed()" returns false or that the KSP configuration has the restriction "Allow process data only on device" set to true. If any AI applications that processes data in the cloud are included in the MDM console of allowed apps or "Allow process data only on device" is not set to true, this is a finding.

   Fix

   This validation procedure is performed only on the EMM Administration Console. On the EMM console: 1. Review the list of selected Managed Google Play apps. 2. Verify no AI applications that processes device data in the cloud, including Google Gemini, are included. Note: This restriction does not include Galaxy on device AI. Galaxy on device AI is a "built-in" capability of Android 16 and processes device data on the device. If the EMM console device policy includes AI applications that processes device data in the cloud, including Google Gemini, this is a finding. Disallow modify accounts (refer to requirement KNOX-16-009200). If "disallow modify accounts" has not been implemented, this is a finding. Apply the "Disallow Intelligence Online Processing" using the KPE API or KSP. The KPE API is allowIntelligenceOnlineProcessing(false) and the KSP restriction is "Allow process data only on device", which should be set to true. KPE: allowIntelligenceOnlineProcessing

10. KNOX-16-005800 CAT II V-276558 · PP-MDF-333080

    Samsung Android must be configured to not display the following (Work Environment) notifications when the device is locked: All notifications.

    Maps to AC-11(1) via CCI-000060
    Check

    Review the configuration to determine if the Samsung Android devices are not displaying (Work Environment) notifications when the device is locked. Notifications of incoming phone calls are acceptable even when the device is locked. This validation procedure is performed on both the management tool Administration Console and the Samsung Android device. On the management tool, in the Work profile restrictions section, verify "Unredacted Notifications" is set to "Disallow". COPE: On the Samsung Android device: 1. Open Settings >> Notifications >> Lock screen. 2. Verify configuration of "Sensitive work profile notifications" is disabled. If on the management tool "Unredacted Notifications" is not set to "Disallow", or on the Samsung Android device "Sensitive work profile notifications" is not disabled, this is a finding. COBO: On the Samsung Android device: 1. Open Settings >> Notifications. 2. Verify "Lock screen" menu is disabled. If on the management tool "Unredacted Notifications" is not set to "Disallow", or on the Samsung Android device "Notifications" menu is not disabled, this is a finding.

    Fix

    Configure the Samsung Android devices to not display (Work Environment) notifications when the device is locked. On the management tool, in the Work profile restrictions section, set "Unredacted Notifications" to "Disallow". API: setKeyguardDisabledFeatures, KEYGUARD_DISABLE_UNREDACTED_NOTIFICATIONS

11. KNOX-16-006100 CAT II V-276556 · PP-MDF-333110

    Samsung Android must be configured to disable authentication mechanisms providing user access to protected data other than a Password Authentication Factor: Face recognition.

    Maps to IA-2(1) via CCI-000765
    Check

    Note: This requirement is not applicable for specific biometric authentication factors included in the product's Common Criteria evaluation. Review the configuration to determine if the Samsung Android devices are disabling Face Recognition. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool in the device restrictions, verify "Face recognition" is set to "Disable". On the Samsung Android device: 1. Open Settings >> Lock screen and AOD >> Screen lock and biometrics. 2. Enter current password. 3. Open "Face recognition" and, if required, register a face. 4. Verify the "Face unlock" option is disabled and cannot be enabled. If on the management tool "Face recognition" is not set to "Disable", or on the Samsung Android device "Face unlock" can be enabled, this is a finding.

    Fix

    Note: This requirement is not applicable for specific biometric authentication factors included in the product's Common Criteria evaluation. Configure the Samsung Android devices to disable Face Recognition. On the management tool, in the device restrictions, set "Face Recognition" to "Disable". API: setKeyguardDisabledFeatures, KEYGUARD_DISABLE_FACE

12. KNOX-16-006400 CAT II V-276540 · PP-MDF-333130

    Samsung Android must be configured to disable developer modes.

    Maps to CM-7 via CCI-000381
    Check

    Review the configuration to determine if the Samsung Android devices are disabling developer modes. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions, verify "Debugging Features" is set to "Disallow". On the Samsung Android device: 1. Open Settings >> About phone >> Software information. 2. Tap on the Build Number to try to enable "Developer Options" and validate that action is blocked. If on the management tool "Debugging Features" is not set to "Disallow" or on the Samsung Android device "Developer options" action is not blocked, this is a finding.

    Fix

    Configure the Samsung Android devices to disable developer modes. On the management tool, in the device restrictions, set "Debugging Features" to "Disallow". API: addUserRestriction, DISALLOW_DEBUGGING_FEATURES

13. KNOX-16-007200 CAT II V-276547 · PP-MDF-333230

    Samsung Android must be configured to disable USB mass storage mode.

    Maps to SC-41 via CCI-002546
    Check

    Review the configuration to determine if the Samsung Android devices are disabling USB mass storage mode. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions, verify "USB file transfer" has been set to "Disallow". On the Samsung Android device, from the "USB for file transfer" notification, verify that a "File Transfer" is not an option. If on the management tool "USB file transfer" is not set to "Disallow", or on the Samsung Android device a "File Transfer" is an option, this is a finding.

    Fix

    Configure the Samsung Android devices to disable USB mass storage mode. On the management tool, in the device restrictions, set "USB file transfer" to "Disallow". DeX drag and drop file transfer capabilities will be prohibited, but all other DeX capabilities remain usable. API: addUserRestriction, DISALLOW_USB_FILE_TRANSFER

14. KNOX-16-007300 CAT II V-276548 · PP-MDF-333240

    Samsung Android must be configured to not allow backup of all applications and configuration data to locally connected systems.

    Maps to SC-4 via CCI-001090
    Check

    Verify requirement KNOX-16-007200 (disallow USB file transfer) has been implemented. If "Disallow USB file transfer" has not been implemented, this is a finding.

    Fix

    Ensure "USB file transfer" has been disallowed (refer to requirement KNOX-16-007200). API: addUserRestriction, DISALLOW_USB_FILE_TRANSFER

15. KNOX-16-007400 CAT II V-276543 · PP-MDF-333250

    Samsung Android must be configured to not allow backup of all applications and configuration data to remote systems. (This requirement applies to the Work Profile for COPE.) - Disable Data Sync Framework.

    Maps to SC-4 via CCI-001090
    Check

    Verify requirement KNOX-16-009200 (disallow modify accounts) has been implemented. If "disallow modify accounts" has not been implemented, this is a finding.

    Fix

    Disallow modify accounts (refer to requirement KNOX-16-009200). API: addUserRestriction, DISALLOW_MODIFY_ACCOUNTS

16. KNOX-16-007500 CAT II V-276625 · PP-MDF-333250

    Samsung Android must be configured to not allow backup of all applications and configuration data to remote systems. - Disable Backup Services.

    Maps to SC-4 via CCI-001090
    Check

    Review the configuration to determine if the Samsung Android devices are disabling backup to remote systems (including commercial clouds). This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions section, verify "Backup service" is set to "Disable". On the Samsung Android device: 1. Open Settings >> Accounts and backup. 2. Verify any backup service listed cannot be configured to back up data. If on the management tool "Backup service" is not set to "Disable", or on the Samsung Android device a listed backup service can be configured to back up data, this is a finding.

    Fix

    Configure the Samsung Android devices to disable backup to remote systems (including commercial clouds). On the management tool, in the device restrictions, set "Backup service" to "Disable". API: setBackupServiceEnabled

17. KNOX-16-007700 CAT II V-276539 · PP-MDF-333260

    Samsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key.

    Maps to AC-17(1), AC-18(1) via CCI-001443, CCI-002314
    Check

    This is a "User-Based Enforcement (UBE)" control. Check a sample of Samsung phones at the site and verify the Wi-Fi hotspot preshared key (password) is set to "WPA3-Personal". 1. Go to Settings >> Connections >> Mobile Hotspot and Tethering >> Mobile Hotspot. 2. Select Network name >> Password >> Band. 3. Click the "Security" link, and verify "WPA3-Personal" has been selected. If the Wi-Fi hotspot security is not set to "WPA3-Personal", this is a finding.

    Fix

    This is a (UBE) control. Train users to not change the default Wi-Fi hotspot security setting: 15-character complex Wi-Fi hotspot preshared key (password) ("WPA3-Personal"). (KNOX-16-009400). If the required preshared key is not set up, train users to use the following procedure to set up the required setting: 1. Go to Settings >> Network & Internet >> Hotspot & tethering. 2. Enable "Wi-Fi hotspot". 3. Tap "Wi-Fi Hotspot" to the left of the slide to show the configuration options. 4 Click the "Security" link and select "WPA3-Personal". API: addUserRestriction, DISALLOW_CONFIG_TETHERING

18. KNOX-16-008400 CAT II V-276549 · PP-MDF-333330

    Samsung Android must be configured to disable ad hoc wireless client-to-client connection capability.

    Maps to SC-40 via CCI-002536
    Check

    Review the configuration to determine if the Samsung Android devices are disallowing Wi-Fi Direct. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the user restrictions, verify "Wi-Fi Direct" has been set to "Disallow". On the Samsung Android device: 1. Open Settings >> Connections >> Wi-Fi. 2. From the hamburger menu, select Wi-Fi Direct. 3. Verify that Wi-Fi Direct cannot be selected. If on the management tool "Wi-Fi Direct" is not set to "Disallow", or on the Samsung Android device a Wi-Fi direct device is listed that can be connected to, this is a finding.

    Fix

    Configure the Samsung Android devices to disallow Wi-Fi Direct. On the management tool, in the user restrictions, set "Wi-Fi Direct" to "Disallow". Wi-Fi direct connections and pairing between devices will become unavailable. API: addUserRestriction, DISALLOW_WIFI_DIRECT

19. KNOX-16-008600 CAT II V-276537 · PP-MDF-333350

    Samsung Android's Work profile must allow only the Administrator (management tool) to perform the following management function: Install/remove DoW root and intermediate PKI certificates.

    Maps to CM-6(1) via CCI-000370
    Check

    COPE: Review the configuration to determine if the Samsung Android devices' Work profile is preventing users from removing DoW root and intermediate PKI certificates. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the Work profile restrictions, verify "Configure credentials" is set to "Disallow". On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> View security certificates. 2. In the System tab, verify no listed certificate in the Work profile can be untrusted. 3. In the User tab, verify no listed certificate in the Work profile can be removed. If on the management tool the device "Configure credentials" is not set to "Disallow", or on the Samsung Android device a certificate can be untrusted or removed, this is a finding. COBO: Review the configuration to determine if the Samsung Android devices are preventing users from removing DoW root and intermediate PKI certificates. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions, verify "Configure credentials" is set to "Disallow". On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> View security certificates. 2. In the System tab, verify no listed certificate in the device can be untrusted. 3. In the User tab, verify no listed certificate in the device can be removed. If on the management tool in the device restrictions "Configure credentials" is not set to "Disallow", or on the Samsung Android device a certificate can be untrusted or removed, this is a finding.

    Fix

    COPE: Configure the Samsung Android devices' Work profile to prevent users from removing DoW root and intermediate PKI certificates. On the management tool, in the Work profile restrictions, set "Configure credentials" to "Disallow". COBO: Configure the Samsung Android devices to prevent users from removing DoW root and intermediate PKI certificates. On the management tool, in the device restrictions, set "Configure credentials" to "Disallow". API: addUserRestriction, DISALLOW_CONFIG_CREDENTIALS

20. KNOX-16-008700 CAT II V-276632 · PP-MDF-333350

    Samsung Android must be enrolled as a COBO device.

    Maps to CM-6 via CCI-000366
    Check

    Review the configuration to determine if the Samsung Android devices are enrolled in a DoW-approved use case. This validation procedure is performed on both the management tool Administration Console and the Samsung Android device. On the management tool, verify the default enrollment is set as "Fully managed". On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> Device admin apps. 2. Verify the management tool Agent is listed. If on the management tool the default enrollment is not set as "Fully managed" or the management tool Agent is not listed, this is a finding.

    Fix

    Enroll the Samsung Android devices in a DoW-approved use case. On the management tool, configure the default enrollment as "Fully managed". Refer to the management tool documentation to determine how to configure the device enrollment.

21. KNOX-16-008900 CAT II V-276538 · PP-MDF-993300

    Samsung Android must be configured to disallow configuration of the device's date and time.

    Maps to CM-6 via CCI-000366
    Check

    Review the configuration to determine if the Samsung Android devices are disallowing the users from changing the date and time. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions, verify "Configure Date/Time" is set to "Disallow". On the Samsung Android device: 1. Open Settings >> General management >> Date and time. 2. Verify "Automatic date and time" is on and the user cannot disable it. If on the management tool "Configure Date/Time" is not set to "Disallow", or on the Samsung Android device "Automatic date and time" is not set or the user can disable it, this is a finding.

    Fix

    Configure the Samsung Android devices to disallow users from changing the date and time. On the management tool, in the device restrictions, set "Configure Date/Time" to "Disallow". API: addUserRestriction, DISALLOW_CONFIG_DATE_TIME

22. KNOX-16-009000 CAT II V-276551 · PP-MDF-993300

    Samsung Android's Work profile must have the DoW root and intermediate PKI certificates installed.

    Maps to CM-6 via CCI-000366
    Check

    COPE: Review the configuration to determine if the Samsung Android's Work profile has the DoW root and intermediate PKI certificates installed. This validation procedure is performed on both the management tool and the Samsung Android device. The current DoW root and intermediate PKI certificates may be obtained in self-extracting zip files at https://cyber.mil/pki-pke (for NIPRNet). On the management tool, in the Work profile policy management, verify the DoW root and intermediate PKI certificates are installed. On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> View security certificates. 2. In the User tab, verify the DoW root and intermediate PKI certificates are listed in the Work profile. If on the management tool the DoW root and intermediate PKI certificates are not listed in the Work profile, or on the Samsung Android device the DoW root and intermediate PKI certificates are not listed in the Work profile, this is a finding. COBO: Review the configuration to determine if the Samsung Android devices have the DoW root and intermediate PKI certificates installed. This validation procedure is performed on both the management tool and the Samsung Android device. The current DoW root and intermediate PKI certificates may be obtained in self-extracting zip files at https://cyber.mil/pki-pke (for NIPRNet). On the management tool, in the device policy management, verify the DoW root and intermediate PKI certificates are installed. On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> View security certificates. 2. In the User tab, verify the DoW root and intermediate PKI certificates are listed in the device. If on the management tool the DoW root and intermediate PKI certificates are not listed in the device, or on the Samsung Android device the DoW root and intermediate PKI certificates are not listed in the device, this is a finding.

    Fix

    Install the DoW root and intermediate PKI certificates into the Samsung Android devices (install in Work profile for COPE). The current DoW root and intermediate PKI certificates may be obtained in self-extracting zip files at https://cyber.mil/pki-pke (for NIPRNet). On the management tool, in the device policy management (Work profile for COPE), install the DoW root and intermediate PKI certificates. API: installCaCert

23. KNOX-16-009100 CAT II V-276566 · PP-MDF-993300

    Samsung Android's Work profile must be configured to enable audit logging.

    Maps to CM-6 via CCI-000366
    Check

    COPE: Review the configuration to determine if the Samsung Android devices' Work profile is enabling audit logging. This validation procedure is performed on the management tool only. On the management tool, in the Work profile restrictions, verify "Security logging" is set to "Enable". If on the management tool "Security logging" is not set to "Enable", this is a finding. COBO: Review the configuration to determine if the Samsung Android devices are enabling audit logging. This validation procedure is performed on the management tool only. On the management tool, in the device restrictions, verify "Security logging" is set to "Enable". If on the management tool "Security logging" is not set to "Enable", this is a finding.

    Fix

    Configure the Samsung Android devices' Work profile to enable audit logging. (COPE) Configure the Samsung Android devices to enable audit logging. (COBO) On the management tool, in the Work profile restrictions section, set "Security logging" to "Enable". API: setSecurityLoggingEnabled

24. KNOX-16-009200 CAT II V-276544 · PP-MDF-993300

    Samsung Android's Work profile must be configured to prevent users from adding personal email accounts to the work email app.

    Maps to CM-6 via CCI-000366
    Check

    Review the configuration to determine if the Samsung Android devices are preventing users from adding personal email accounts to the work email app. On the management tool, in the device restrictions section, verify "Modify accounts" is set to "Disallow". COPE: On the Samsung Android device: 1. Open Settings >> Accounts and backup >> Manage accounts. 2. Navigate to the "Work" tab. 3. Verify no account can be added. COBO: On the Samsung Android device: 1. Open Settings >> Accounts and backup >> Manage accounts. 2. Verify no account can be added. If on the management tool "Modify accounts" is not set to "Disallow", or on the Samsung Android device an account can be added, this is a finding.

    Fix

    Configure the Samsung Android devices to prevent users from adding personal email accounts to the work email app. On the management tool, in the Work profile restrictions, set "Modify accounts" to "Disallow". (COPE) On the management tool, in the device restrictions, set "Modify accounts" to "Disallow". (COBO) API: addUserRestriction, DISALLOW_MODIFY_ACCOUNTS

25. KNOX-16-009400 CAT II V-276633 · PP-MDF-993300

    Samsung Android device users must complete required training.

    Maps to CM-6 via CCI-000366
    Check

    Review a sample of site User Agreements for Samsung device users or similar training records and training course content. Verify Samsung device users have completed required training. The intent is that required training is renewed on a periodic basis in a time period determined by the AO. If any Samsung device user has not completed required training, this is a finding.

    Fix

    Have all Samsung device users complete training on the following topics. Users should acknowledge they have reviewed training via a signed User Agreement or similar written record. Training topics: - Operational security concerns introduced by unmanaged applications/unmanaged personal space including applications using Global Positioning System (GPS) tracking. - Need to ensure no DoW data is saved to the personal space or transmitted from a personal app (for example, from personal email). - If the Purebred key management app is used, users are responsible for maintaining positive control of their credentialed device at all times. The DoW PKI certificate policy requires subscribers to maintain positive control of the devices that contain private keys and report any loss of control so the credentials can be revoked. Upon device retirement, turn-in, or reassignment, ensure a factory data reset is performed prior to device hand-off. Follow Mobility service provider decommissioning procedures as applicable. How to configure the following UBE controls (users must configure the control) on the Samsung device: 1. Secure use of Calendar Alarm. 2. Local screen mirroring and MirrorLink procedures (authorized/not authorized for use). 3. Do not connect Samsung devices (via either DeX Station or dongle) to any DoW network via Ethernet connection. 4. Do not upload DoW contacts via smart call and caller ID services. 5. Do not configure a DoW network (work) VPN profile on any third-party VPN client installed in the personal space. 6. If Bluetooth connections are approved for mobile device, types of allowed connections (for example car hands-free, but not Bluetooth wireless keyboard). 7. How to perform a full device wipe. 8. Use default Wi-Fi hotspot password: 15-character complex Wi-Fi hotspot preshared password enabled ("WPA3-personal"). AO guidance on acceptable use and restrictions, if any, on downloading and installing personal apps and data (music, photos, etc.) in the Samsung device personal space.

26. KNOX-16-009600 CAT II V-276568 · PP-MDF-993300

    The Samsung Android device must be configured to enable Certificate Revocation List (CRL) status checking.

    Maps to CM-6 via CCI-000366
    Check

    Review the configuration to confirm that revocation checking is enabled. Verify the revocation checklist is set to the required applications. This procedure is performed on the management tool. On the management tool: 1. Open Certificates Policy >> Revocation section. 2. Select "Get CRL". 3. Verify Toast message "Get revocation check: true". If on the management tool the revocation check is disabled, this is a finding.

    Fix

    Configure the Samsung Android devices to enable CRL revocation checks for required applications. These revocation checks must be enabled using the Knox KPE APIs. On the management tool, in the Certificate Policy restrictions, enable "Revocation Checks" for required applications. KPE provides an API to check for Certificate revocation.

27. KNOX-16-009700 CAT II V-276550 · PP-MDF-993300

    The Samsung Android device must be configured to enforce that Wi-Fi Sharing is disabled.

    Maps to CM-6 via CCI-000366
    Check

    Review device configuration settings to confirm Wi-Fi Sharing is disabled. Mobile Hotspot must be enabled to enable Wi-Fi Sharing. If the authorizing official (AO) has not approved Mobile Hotspot, and it has been verified as disabled on the EMM console, no further action is needed. If Mobile Hotspot is being used, use the following procedure to verify Wi-Fi Sharing is disabled: This is a "User-Based Enforcement (UBE)" control. Check a sample of Samsung phones at the site and verify that the mobile hotspot Wi-Fi sharing option is toggled to "Off". - Go to Settings >> Connections >> Mobile Hotspot and Tethering >> Mobile Hotspot. - Tap "Network name". - Tap "Advanced". - Verify "Wi-Fi sharing" is toggled off or the option is disabled. If the Wi-Fi sharing is not set to disabled, this is a finding. On the EMM console: COBO: 1. Open "Set user restrictions". 2. Verify "Disallow sharing admin configured Wi-Fi" is toggled to "ON". COPE: 1. Open "Set user restrictions on parent". 2. Verify "Disallow sharing admin configured Wi-Fi" it toggled to "ON". If on the EMM console, "Disallow sharing admin configured Wi-Fi" is not enabled, this is a finding.

    Fix

    Configure the Samsung Android 16 device to disable Wi-Fi Sharing. Mobile Hotspot must be enabled to enable Wi-Fi Sharing. If the AO has not approved Mobile Hotspot, and it has been disabled on the EMM console, no further action is needed. If Mobile Hotspot is being used, then use the following procedure and "User-Based Enforcement (UBE)" control: Train users to disable/not enable Samsung Wi-Fi Sharing. Refer to STIG requirement KNOX-16-009700. - Go to Settings >> Connections >> Mobile Hotspot and Tethering >> Mobile Hotspot. - Tap "Network name". - Tap "Advanced". - Verify "Wi-Fi sharing" is toggled off or the option is disabled. On the EMM console: COBO: 1. Open "Set user restrictions". 2. Toggle "Disallow sharing admin configured Wi-Fi" to "ON". COPE: 1. Open "Set user restrictions on parent". 2. Toggle "Disallow sharing admin configured Wi-Fi" to "ON". On COBO devices, KPE policy can be used to configure this setting without "User-Based Enforcement (UBE)" control, by setting the "Allow Wi-Fi Sharing" option in KSP to disable. API: DISALLOW_SHARING_ADMIN_CONFIGURED_WIFI

28. KNOX-16-009800 CAT II V-276552 · PP-MDF-993300

    The Samsung Android device work profile must be configured to enforce the system application disable list.

    Maps to CM-6 via CCI-000366
    Check

    Review the configuration to confirm the system application disable list is enforced. This setting is enforced by default. Verify only approved system apps have been placed on the core allowlist. This procedure is performed on the management tool. Review the system app allowlist and verify only approved apps are on the list. On the management tool, in the Apps management section, select "Unhide apps" and verify the names of the apps listed. If on the management tool the system app allowlist contains unapproved core apps, this is a finding.

    Fix

    Configure the Samsung Android 16 device to enforce the system application disable list. The required configuration is the default configuration when the device is enrolled. If the device configuration is changed, use the following procedure to bring the device back into compliance: On the management tool: 1. Open the "Apps management" section. 2. Select "Hide apps". 3. Enter names of apps to hide. Configure a list of approved Samsung core and preinstalled apps in the core app allowlist. API: setApplicationHidden

29. KNOX-16-010300 CAT II V-276567 · PP-MDF-993300

    The Samsung Android device must be configured to disable all data signaling over [assignment: list of externally accessible hardware ports (for example, USB)].

    Maps to AC-6(10) via CCI-002235
    Check

    Review the device configuration to confirm the USB port is disabled except for charging the device. On the management tool: Verify "Disallow usb file transfer" is toggled to "OFF". If on the management tool the USB port is not disabled, this is a finding.

    Fix

    Configure the Samsung device to disable the USB port (except for charging the device). On the management tool: Toggle "Disallow usb file transfer" to "OFF". API: setUsbDataSignalingEnabled

30. KNOX-16-010500 CAT II V-279245 · PP-MDF-993300

    The Samsung Android device must be configured to disable Wi-Fi Aware for Work Profile apps.

    Maps to CM-6 via CCI-000366
    Check

    Review device configuration settings to confirm Wi-Fi Aware is disabled for each work profile app. This procedure is performed on the EMM console. For each Work Profile app, verify the app is configured to deny the NEARBY_WIFI_DEVICE permission. Note: Not all apps will support Wi-Fi Aware and have the NEARBY_WIFI_DEVICE permission. If on the EMM console, if the NEARBY_WIFI_DEVICE permission is not set to "deny" for all Work Profile apps that support Wi-Fi Aware, this is a finding.

    Fix

    Configure the Samsung Android 16 device to disable Wi-Fi Aware for all Work Profile apps. On the EMM console: For each Work Profile app, configure the NEARBY_WIFI_DEVICE permission to "deny" to block the use of Wi-Fi Aware, if the app supports this feature. If the app does not support Wi-Fi Aware, there may not be a NEARBY_WIFI_DEVICE permission available.

31. KNOX-16-011000 CAT II V-276541 · PP-MDF-993300

    Samsung Android 16 must disable the ability of the user to wipe the device.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm the user is unable to perform a factory reset and the admin has the ability to inject a recovery account on the device to unlock Factory Reset Protection (FRP). This check procedure is performed on the device management tool and the Samsung Android 16 device. On the MDM console: Verify factory reset configuration. COBO procedures: 1. Open user restrictions. 2. Verify "Disallow Factory Reset" is enabled. Verify factory reset protection policy configuration. 1. From the Android Enterprise policy management, go to the Factory Reset Protection section. 2. Verify "Factory Reset Protection" is set to "Allow/Enabled". 3. Verify the correct Google Account ID(s) is/are listed as allowed to unlock the FRP. On the managed Samsung Android 16 device, verify factory reset configuration. COBO: 1. Open Settings >> General management >> Reset. 2. Tap the "Factory data reset" option. 3. Verify the "Action not allowed" pop up appears and that the factory data reset does not proceed. If the Android device user is able to perform a factory reset or the admin cannot unlock the Android phone after an FRP event, this is a finding.

    Fix

    Configure Samsung Android 16 device to disable the ability of the user from wiping the Android device. In addition, enable the admin to inject a recovery account on the device so they can unlock FRP. On the MDM console, do the following: COBO procedures – disallow factory reset: 1. Open user restrictions. 2. Enable "Disallow Factory Reset". COBO procedures – set factory reset protection policy: 1. Select Device owner management >> Set factory reset protection. 2. From the "Accounts" section, go to Add Account >> Enter recovery account, then press "Ok". 3. From the "Enabled" section, select "Enabled" to enable factory reset protection policy. 4. Press "Save" to confirm all changes. API: addUserRestriction, DISALLOW_FACTORY_RESET and setFactoryResetProtectionPolicy

32. KNOX-16-011400 CAT II V-276635 · PP-MDF-993300

    Samsung Android 16 devices must have a Mobile Threat Detection (MTD) app installed.

    Maps to CM-6 via CCI-000366
    Check

    Confirm an MTD app is installed on managed Samsung Android devices. This check procedure is performed on both the device management tool and the Samsung Android device. In the MDM console, verify an MTD app is listed as a managed app being deployed to site managed devices. On the Samsung Android device: 1. Open the Settings app. 2. Tap "Apps", then "See all apps". 3. Verify an MTD app is listed. If an MTD app is not installed on the device, this is a finding.

    Fix

    Install an MTD app on managed Samsung Android devices.

33. KNOX-16-011500 CAT II V-276636 · PP-MDF-993300

    Samsung Android 16 must implement the management setting: disable Camera.

    Maps to CM-6 via CCI-000366
    Check

    Determine if the site AO has approved the use of device cameras. Look for a document showing approval for a specific user or group of users. If not approved, review configuration settings to confirm "Allow Camera" is disabled. If approved, this requirement is not applicable. Review configuration settings to confirm the device camera has been disabled. This check procedure is performed on the device management tool and the Samsung Android 16 device. On the MDM console: COBO/COPE procedures: 1. Open "Camera". 2. Verify that "disable camera" setting is disabled. On the managed Samsung Android 16 device: COBO and COPE: Verify the camera cannot be used on the mobile device. If the device camera has not been disabled, this is a finding.

    Fix

    If the AO has not approved the use of Samsung device camera, configure Samsung Android 16 to disable the device camera. On the MDM console, do the following: COBO/COPE Procedures: 1. Open "Camera". 2. Select "Disable camera". API: disableCamera