STIGQter STIGQter: STIG Summary: Samsung Android (with Knox 2.x) STIG Version: 1 Release: 4 Benchmark Date: 22 Apr 2016: The Samsung Knox for Android container must be configured to implement the management setting: Account blacklist.

DISA Rule

SV-70413r1_rule

Vulnerability Number

V-56159

Group Title

PP-MDF-991000

Rule Version

KNOX-39-021300

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the mobile operating system to add email domains not approved by DoD to the account blacklist.

On the MDM Administration Console, add all email domains not approved by DoD to the "Account blacklist" setting in the "Container Accounts" rule.

Check Contents

This validation procedure is performed on both the MDM Administration Console and the Samsung Knox for Android device.

Check whether the appropriate setting is configured on the MDM Administration Console:
1. Ask the MDM administrator to display the "Account blacklist" setting in the "Container Accounts" rule.
2. Verify the setting is configured to all email domains not approved by DoD.

(Note: All email domains is specified by the wildcard string ".*")

On the Samsung Knox for Android device:
1. Open the Knox Container.
2. Open Settings.
3. Select Accounts.
4. Select Add account.
5. Select Email (and repeat for Microsoft Exchange ActiveSync) and attempt to add an email account with a non-approved domain.
6. Verify that the email account cannot be added.

If the "Account blacklist" is not properly configured, or if the user is able to successfully configure the non-DoD approved email account, this is a finding.

Vulnerability Number

V-56159

Documentable

False

Rule Version

KNOX-39-021300

Severity Override Guidance

This validation procedure is performed on both the MDM Administration Console and the Samsung Knox for Android device.

Check whether the appropriate setting is configured on the MDM Administration Console:
1. Ask the MDM administrator to display the "Account blacklist" setting in the "Container Accounts" rule.
2. Verify the setting is configured to all email domains not approved by DoD.

(Note: All email domains is specified by the wildcard string ".*")

On the Samsung Knox for Android device:
1. Open the Knox Container.
2. Open Settings.
3. Select Accounts.
4. Select Add account.
5. Select Email (and repeat for Microsoft Exchange ActiveSync) and attempt to add an email account with a non-approved domain.
6. Verify that the email account cannot be added.

If the "Account blacklist" is not properly configured, or if the user is able to successfully configure the non-DoD approved email account, this is a finding.

Check Content Reference

M

Target Key

2699

Comments