STIGQter: STIG Summary: BlackBerry Enterprise Mobility Server 3.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 26 Jul 2023:

If the BlackBerry Connect service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to enable SSL support for BlackBerry Proxy and use only DOD approved certificates.

DISA Rule

SV-254724r879887_rule

Vulnerability Number

V-254724

Group Title

SRG-APP-000516-AS-000237

Rule Version

BEMS-03-014300

Severity

CAT II

CCI(s)

CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.

Weight

Fix Recommendation

Configure BlackBerry Connect to enable SSL with a DOD certificate.

1. Submit a CSR request to the DOD CA.
2. In BEMS Select "SSL Certificate".
3. Select "Choose File" and select the new SSL Certificate and type the "Password".
4. Configure BlackBerry Connect to send the request over SSL (see page 20 of the BEMS Configuring the BlackBerry Connect Service document).
5. Configure Connect to use SSL with BlackBerry Proxy (see page 20 of the BEMS Configuring the BlackBerry Connect Service document).

Check Contents

This requirement is not applicable if the BlackBerry Connect service is not enabled on BEMS.

Verify SSL is enabled for the BlackBerry Connect service and a DOD certificate is used as follows:

1. Browse to FQDN of the BEMS Connect server(s) on port 8082.
2. Click on the SSL certificate to verify it has been issued by the DOD CA.
3. Repeat steps 1 and 2 for each BEMS server that has the Connect service added to it.

If SSL is not enabled for BlackBerry Connect and if the SSL certificate is not a DOD CA issued certificate, this is a finding.

Vulnerability Number

V-254724

Documentable

False

Rule Version

BEMS-03-014300

Severity Override Guidance

Check Content Reference

Target Key

5488