STIGQter: STIG Summary: Ivanti Sentry 9.x ALG Security Technical Implementation Guide Version: 3 Release: 1 Benchmark Date: 24 Oct 2024:

The Sentry providing PKI-based mobile device authentication intermediary services must map authenticated identities to the mobile device account.

DISA Rule

SV-251028r1028194_rule

Vulnerability Number

V-251028

Group Title

SRG-NET-000166-ALG-000101

Rule Version

MOIS-AL-000430

Severity

CAT II

CCI(s)

• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.

Weight

10

Fix Recommendation

If PKI-based user authentication intermediary services are provided, configure the Sentry to map the authenticated identities to the user account.

1. In the MobileIron Core Portal, select Services >> Sentry.
2. Click the "Edit" icon the Standalone Sentry entry.
3. In the "Device Authentication Configuration" section, configure certificate mappings in the "certificate mapping" field (i.e., User UPN = Subject Alternative Name: NT Principal Name).
4. Click "Save".

Check Contents

Verify the Sentry is configured with certificate-based authentication with the appropriate certificate field user mappings.

1. In the MobileIron Core Portal, select Services >> Sentry.
2. Click the "Edit" icon for the Standalone Sentry entry.
3. In the "Device Authentication Configuration" section, verify certificate mappings are configured in the "certificate mapping" field.

If Sentry is not configured to map authenticated identities to the user accounts, this is a finding.

Vulnerability Number

V-251028

Documentable

False

Rule Version

MOIS-AL-000430

Severity Override Guidance

Verify the Sentry is configured with certificate-based authentication with the appropriate certificate field user mappings.

1. In the MobileIron Core Portal, select Services >> Sentry.
2. Click the "Edit" icon for the Standalone Sentry entry.
3. In the "Device Authentication Configuration" section, verify certificate mappings are configured in the "certificate mapping" field.

If Sentry is not configured to map authenticated identities to the user accounts, this is a finding.

Check Content Reference

M

Target Key

5439