BaselineWatch
5 STIGs
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

Mobile STIGs

5 STIGs followed · All platforms
All 43 CAT I 2CAT II 33CAT III 8 Browse in the Register

CAT III 8

Any vulnerability, the existence of which degrades measures to protect against loss of confidentiality, availability or integrity.

  1. KNOX-16-000700 CAT III V-276553 · PP-MDF-331080

    Samsung Android must not accept the certificate when it cannot establish a connection to determine the validity of a certificate.

    Maps to IA-5(2) via CCI-000185
    Check

    Verify requirement KNOX-16-009300 (Common Criteria mode) has been implemented. If "Common Criteria mode" has not been implemented, this is a finding.

    Fix

    Implement "Common Criteria mode" (refer to requirement KNOX-16-009300). API: setCommonCriteriaModeEnabled

  2. KNOX-16-006700 CAT III V-276555 · PP-MDF-333160

    Samsung Android must be configured to display the DoW advisory warning message at startup or each time the user unlocks the device.

    Maps to AC-8 via CCI-000048
    Check

    Confirm if Method #1 or #2 is used at the Samsung device site and follow the appropriate procedure. This validation procedure is performed on both the management tool and the Samsung Android device. Validation procedure for Method #1: Place the DoW warning banner in the user agreement signed by each Samsung Android device user (preferred method). Review the signed user agreements for several Samsung Android device users and verify the agreement includes the required DoW warning banner text. Validation procedure for Method #2 (preferred method): Configure the warning banner text in the Lock screen message on each managed mobile device. On the management tool, in the device restrictions section, verify "Lock Screen Message" is set to the DoW-mandated warning banner text. On the Samsung Android device, verify the required DoW warning banner text is displayed on the Lock screen. If the warning text has not been placed in the signed user agreement, or if on the management tool "Lock Screen Message" is not set to the DoW-mandated warning banner text, or on the Samsung Android device the required DoW warning banner text is not displayed on the Lock screen, this is a finding.

    Fix

    Configure the DoW warning banner by either of the following methods (required text is found in the Vulnerability Description): Method #1: Place the DoW warning banner in the user agreement signed by each Samsung Android device user (preferred method). Method #2 (preferred method): Configure the warning banner text in the Lock screen message on each managed mobile device. On the management tool, in the device restrictions section, set "Lock Screen Message" to the DoW-mandated warning banner text. API: setDeviceOwnerLockScreenInfo

  3. KNOX-16-008300 CAT III V-276536 · PP-MDF-333320

    Samsung Android must be configured to disable all Bluetooth profiles except for Headset Profile (HSP), Hands-Free Profile (HFP), Serial Port Profile (SPP), Advanced Audio Distribution Profile (A2DP), Audio/Video Remote Control Profile (AVRCP), and Phone Book Access Profile (PBAP).

    Maps to CM-7, CM-7(1) via CCI-000381, CCI-001761
    Check

    Review the Samsung documentation and inspect the configuration to verify the Samsung Android devices are paired only with devices that support HSP, HFP, SPP, A2DP, AVRCP, and PBAP Bluetooth profiles. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions section, verify "Bluetooth" is set to the AO-approved selection: "Allow" if the AO has approved the use of Bluetooth or "Disallow" if the AO has not approved its use. On the Samsung Android device: 1. Open Settings >> Connections >> Bluetooth. 2. Verify all listed paired Bluetooth devices use only authorized Bluetooth profiles. If on the management tool "Bluetooth" is not set to the AO-approved value, or the Samsung Android device is paired with a device that uses unauthorized Bluetooth profiles, this is a finding.

    Fix

    Configure the Samsung Android devices to disable Bluetooth, or if the AO has approved the use of Bluetooth (for example, for hands-free use), train users to only pair devices that support HSP, HFP, SPP, A2DP, AVRCP, and PBAP profiles. On the management tool, in the device restrictions section, set "Bluetooth" to the AO-approved selection: "Allow" if the AO has approved the use of Bluetooth or "Disallow" if the AO has not approved its use. The user training requirement is satisfied in requirement KNOX-16-009400. If a COBO deployment requires the use of specific Bluetooth profiles, Knox Platform for Enterprise (KPE) can be used to allow them in a STIG-approved configuration. In this case, do not configure this policy, and instead replace with KPE policy (innately by the management tool or via Knox Service Plugin [KSP]) "Add Bluetooth UUIDs To White List " with values "HSP_UUID, HFP_UUID, SPP_UUID, A2DP_ADVAUDIODIST_UUID, AVRCP_CONTROLLER_UUID, AVRCP_TARGET_UUID" and default blacklist as "enable". API: addUserRestriction, DISALLOW_BLUETOOTH

  4. KNOX-16-009300 CAT III V-276554 · PP-MDF-993300

    Samsung Android's Work profile must be configured to enable Common Criteria (CC) mode.

    Maps to CM-6 via CCI-000366
    Check

    Review the configuration to determine if the Samsung Android devices are enabling CC mode. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the Work profile restrictions, verify "Common Criteria mode" is set to "Enable". On the Samsung Android device, put the device into "Download mode" (press and hold down the Home + Power + Volume Down buttons at the same time) and verify the text "Blocked by CC Mode" is displayed on the screen. If on the management tool "Common Criteria mode" is not set to "Enable", or on the Samsung Android device the text "Blocked by CC Mode" is not displayed in "Download mode", this is a finding.

    Fix

    Configure the Samsung Android devices to enable CC mode. On the management tool, in the Work profile restrictions, set "Common Criteria mode" to "Enable". API: setCommonCriteriaModeEnabled

  5. KNOX-16-010200 CAT III V-276564 · PP-MDF-993300

    The Samsung Android device must be configured to disable the use of third-party keyboards.

    Maps to CM-6 via CCI-000366
    Check

    Review the managed Samsung device configuration settings to confirm that no third-party keyboards are enabled. This procedure is performed on the management tool. On the management tool: 1. Open "Input methods". 2. Tap "Set input methods". 3. Verify only the approved keyboards are selected. If third-party keyboards are allowed, this is a finding.

    Fix

    Configure the Samsung device to disallow the use of third-party keyboards. On the management tool: 1. Open "Input methods". 2. Tap "Set input methods". 3. Select only the approved keyboard. Additionally, Administrators can configure application allowlists for Google Play that do not have any third-party keyboards for user installation. API: setPermittedInputMethods

  6. KNOX-16-010400 CAT III V-276561 · PP-MDF-993300

    The Samsung Android device must be configured to perform the following management function: Disable Phone Hub.

    Maps to SC-4 via CCI-001090
    Check

    Review the management tool to confirm Phone Hub has been disabled. On the management tool: 1. Open "Nearby notification streaming policy". 2. Verify "Nearby notification streaming policy" is set to "Disabled". 3. Open "Nearby app streaming policy". 4. Verify "Nearby app streaming policy" is set to "Disabled". If on the management tool the "Nearby Streaming Policy" is not set to "Disabled", this is a finding. Note: From a Chromebook, if a device is connected to the Phone Hub, try to set up the Notifications. It will fail to connect to the device to complete the setup if Phone Hub has been disabled on the DoW Android device.

    Fix

    Configure the Samsung device to disable the nearby notification and app streaming policy to disable Phone Hub. On the management tool: 1. Open "Nearby notification streaming policy". 2. Set "Nearby notification streaming policy" to "Disabled". 3. Open "Nearby app streaming policy". 4. Set "Nearby app streaming policy" to "Disabled". API: setNearbyNotificationStreamingPolicy

  7. KNOX-16-011200 CAT III V-276546 · PP-MDF-993300

    Samsung Android 16 must disable wireless printing.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm wireless printing has been disabled. This check procedure is performed on the device management tool and the Samsung Android 16 device. On the MDM console: COBO/COPE procedures: 1. Open user restrictions. 2. Verify that "Disallow printing" is enabled. On the managed Samsung Android 16 device: COBO/COPE procedures: 1. Open a document or image from the file app and try to print. 2. Verify the printer cannot print. If wireless printing has not been disabled, this is a finding.

    Fix

    Configure Samsung Android 16 device to disable wireless printing. On the MDM console, do the following: COBO procedures: 1. Open user restrictions. 2. Enable "Disallow printing". COPE procedures: 1. Open user restrictions. 2. Enable "Disallow printing". API: addUserRestriction, DISALLOW_PRINTING

  8. KNOX-16-011300 CAT III V-276565 · PP-MDF-993300

    Samsung Android 16 must disable screen capture.

    Maps to CM-6 via CCI-000366
    Check

    Review configuration settings to confirm screen capture has been disabled. This check procedure is performed on the device management tool and the Samsung Android 16 device. On the MDM console: COBO/COPE procedures: 1. Open Camera >> Screen Capture >> Audio section. 2. Verify that "Disable Screen Capture" setting is enabled. On the managed Samsung Android 16 device: COBO and COPE: 1. Press the Power button and the volume down button at the same time. Verify the message "Taking screenshots is blocked by your admin". If screen capture has not been disabled, this is a finding.

    Fix

    Configure Samsung Android 16 to disable screen capture. On the MDM console, do the following: COBO Procedures: 1. Open Camera >> Screen Capture >> Audio section. 2. Enable the "Disable Screen Capture" setting. COPE procedures: 1. Open Camera >> Screen Capture >> Audio section. 2. Enable the "Disable Screen Capture" setting. API: setScreenCaptureDisabled