STIGQter STIGQter: STIG Summary: Samsung Android OS 7 with Knox 2.x Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 25 Oct 2019: The Samsung Android 7 with Knox must be configured to disable exceptions to the access control policy that prevents groups of application processes from accessing all data stored by other groups of application processes.

DISA Rule

SV-91259r1_rule

Vulnerability Number

V-76563

Group Title

PP-MDF-301260

Rule Version

KNOX-07-005500

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the Samsung Android 7 with Knox to enable the access control policy that prevents groups of application processes from accessing all data stored by other groups of application processes.

On the MDM console, create the "Android Knox Container" rule and push this rule to the device.

Check Contents

Not Applicable for the COBO use case.

Review documentation on the Samsung Android 7 with Knox and inspect the configuration on the Samsung Android 7 with Knox to verify the access control policy that prevents groups of application processes from accessing all data stored by other groups of application processes is enabled.

This validation procedure is performed on both the MDM Administration Console and the Samsung Android 7 with Knox device.

On the MDM console, do the following:
1. Ask the MDM administrator to display the "Android Knox Container" rule.
2. Verify the existence of this rule.
3. Pushing this rule to the device that does not have a container installed will result in creation of the container.

On the Samsung Android 7 with Knox device, do the following:
1. Verify the existence of the Knox icon on the device home screen or application menu or the notification bar pull-down menu.
2. If available on the MDM agent, verify the container rule in the list of rules received by the MDM agent.

If the MDM console "Android Knox Container" rule cannot be configured, or if the Knox icon is not present, or if the container rule is not found in the MDM agent rule list (MDM vendor-specific check), this is a finding.

Note: This validation procedure is identical to the one for Knox-07-012800 (Knox container must be enabled). It only needs to be performed once. If it is found compliant on the first check, it is also compliant here. If it is determined to be a finding on first check, it is also a finding here. Redundant checks are necessary to maintain requirements traceability and provide complete risk management information to Authorizing Officials (AOs).

Vulnerability Number

V-76563

Documentable

False

Rule Version

KNOX-07-005500

Severity Override Guidance

Not Applicable for the COBO use case.

Review documentation on the Samsung Android 7 with Knox and inspect the configuration on the Samsung Android 7 with Knox to verify the access control policy that prevents groups of application processes from accessing all data stored by other groups of application processes is enabled.

This validation procedure is performed on both the MDM Administration Console and the Samsung Android 7 with Knox device.

On the MDM console, do the following:
1. Ask the MDM administrator to display the "Android Knox Container" rule.
2. Verify the existence of this rule.
3. Pushing this rule to the device that does not have a container installed will result in creation of the container.

On the Samsung Android 7 with Knox device, do the following:
1. Verify the existence of the Knox icon on the device home screen or application menu or the notification bar pull-down menu.
2. If available on the MDM agent, verify the container rule in the list of rules received by the MDM agent.

If the MDM console "Android Knox Container" rule cannot be configured, or if the Knox icon is not present, or if the container rule is not found in the MDM agent rule list (MDM vendor-specific check), this is a finding.

Note: This validation procedure is identical to the one for Knox-07-012800 (Knox container must be enabled). It only needs to be performed once. If it is found compliant on the first check, it is also compliant here. If it is determined to be a finding on first check, it is also a finding here. Redundant checks are necessary to maintain requirements traceability and provide complete risk management information to Authorizing Officials (AOs).

Check Content Reference

M

Target Key

3253

Comments