STIGQter: STIG Summary: Google Android 11 COBO Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2020:

Google Android 11 must be configured to disable multi-user modes.

DISA Rule

SV-228590r510289_rule

Vulnerability Number

V-228590

Group Title

PP-MDF-301280

Rule Version

GOOG-11-004700

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.
• CCI-002110 - The organization defines the information system account types that support the organizational missions/business functions.

Weight

10

Fix Recommendation

Configure the Google Android 11 device to disable multi-user modes.

On the EMM console:
1. Open "Set user restrictions".
2. Toggle "Disallow modify accounts" to On.

Check Contents

Review documentation on the Google Android device and inspect the configuration on the Google Android device to disable multi-user modes.

This validation procedure is performed on both the EMM Administration Console and the Android 11 device.

On the EMM console, do the following:
1. Open "Set user restrictions".
2. Verify that "Disallow modify accounts" is toggled to On.

On the Android 11 device, do the following:
1. Go to Settings >> Accounts>> Work.
2. Validate that "Add Account" is grayed out.

If the EMM console device policy is not set to disable multi-user modes or on the Android 11 device, the device policy is not set to disable multi-user modes, this is a finding.

Vulnerability Number

V-228590

Documentable

False

Rule Version

GOOG-11-004700

Severity Override Guidance

Review documentation on the Google Android device and inspect the configuration on the Google Android device to disable multi-user modes.

This validation procedure is performed on both the EMM Administration Console and the Android 11 device.

On the EMM console, do the following:
1. Open "Set user restrictions".
2. Verify that "Disallow modify accounts" is toggled to On.

On the Android 11 device, do the following:
1. Go to Settings >> Accounts>> Work.
2. Validate that "Add Account" is grayed out.

If the EMM console device policy is not set to disable multi-user modes or on the Android 11 device, the device policy is not set to disable multi-user modes, this is a finding.

Check Content Reference

M

Target Key

4228

Comments