STIGQter: STIG Summary: Samsung Android 11 with Knox 3.x AE Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 20 Nov 2020:

Samsung Android must be configured to enable encryption for data at rest on removable storage media or alternatively, the use of removable storage media must be disabled.

DISA Rule

SV-230982r607691_rule

Vulnerability Number

V-230982

Group Title

PP-MDF-301140

Rule Version

KNOX-11-003500

Severity

CAT I

CCI(s)

• CCI-001199 - The information system protects the confidentiality and/or integrity of organization-defined information at rest.

Weight

10

Fix Recommendation

This requirement is not applicable for devices that do not support removable storage media.

Configure Samsung Android to enable data-at-rest protection for removable media, or alternatively, disable the use of removable storage media.

On the management tool, in the device restrictions section, set "Mount physical media" to "Disallow".

Check Contents

This requirement is not applicable for devices that do not support removable storage media.

If the mobile device does not support removable media, this requirement is not applicable.

Review Samsung Android configuration settings to determine if the use of removable storage media is disabled.

This validation procedure is performed on both the management tool Administration Console and the Samsung Android device.

On the management tool, in the device restrictions section, verify that "Mount physical media" is set to "Disallow".

On the Samsung Android device, verify that a microSD card cannot be mounted.

NOTE: To mount the microSD card, insert it into the SIM/SD card tray in the slot marked "microSD", and push the tray firmly back into the device. The device should ignore the inserted SD card and no notifications for the transfer of media files should appear, nor should any files be listed using a file browser, such as Samsung My Files.

If on the management tool "Mount physical media" is not set to "Disallow", or on the Samsung Android device a microSD card can be mounted, this is a finding.

Vulnerability Number

V-230982

Documentable

False

Rule Version

KNOX-11-003500

Severity Override Guidance

This requirement is not applicable for devices that do not support removable storage media.

If the mobile device does not support removable media, this requirement is not applicable.

Review Samsung Android configuration settings to determine if the use of removable storage media is disabled.

This validation procedure is performed on both the management tool Administration Console and the Samsung Android device.

On the management tool, in the device restrictions section, verify that "Mount physical media" is set to "Disallow".

On the Samsung Android device, verify that a microSD card cannot be mounted.

NOTE: To mount the microSD card, insert it into the SIM/SD card tray in the slot marked "microSD", and push the tray firmly back into the device. The device should ignore the inserted SD card and no notifications for the transfer of media files should appear, nor should any files be listed using a file browser, such as Samsung My Files.

If on the management tool "Mount physical media" is not set to "Disallow", or on the Samsung Android device a microSD card can be mounted, this is a finding.

Check Content Reference

M

Target Key

5247

Comments