STIGQter STIGQter: STIG Summary: Samsung Android OS 7 with Knox 2.x Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 25 Oct 2019: The Samsung Android 7 with Knox must implement the management setting: Container Account whitelist.

DISA Rule

SV-91291r1_rule

Vulnerability Number

V-76595

Group Title

PP-MDF-991000

Rule Version

KNOX-07-014300

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the Samsung Android 7 with Knox to enforce Container Account Whitelisting.

On the MDM console, add all DoD-approved email domains to the "Account whitelist" setting in the "Container Accounts" rule.

Note: Recommended to add .*@mail.mil.

Check Contents

Not Applicable for the COBO use case.

Review Samsung Android 7 with Knox configuration settings to determine if the mobile device is enforcing Container Account Whitelisting.

This validation procedure is performed on both the MDM Administration Console and the Samsung Android 7 with Knox device.

On the MDM console, do the following:
1. Ask the MDM administrator to display the "Account whitelist" setting in the "Container Accounts" rule.
2. Verify the whitelist only contains DoD-approved email domains (for example, mail.mil).

Note: Proper configuration of Account blacklist is required for this configuration to function correctly.

On the Samsung Android 7 with Knox device, do the following:
1. Open the Knox Container.
2. Open "Settings".
3. Select "Accounts".
4. Select "Add account".
5. Select "Email" (and repeat for Microsoft Exchange ActiveSync) and attempt to add an email account with a DoD-approved domain.
6. Verify the email account can be added.
7. Attempt to add an email account with a domain not approved by DoD.
8. Verify that the email account cannot be added.

If the MDM console "Account whitelist" is not set to contain DoD-approved email domains or on the Samsung Android 7 with Knox device, the user is able to successfully configure the email account with a domain not approved by DoD, or if the user is not able to install the DoD-approved email account, this is a finding.

Vulnerability Number

V-76595

Documentable

False

Rule Version

KNOX-07-014300

Severity Override Guidance

Not Applicable for the COBO use case.

Review Samsung Android 7 with Knox configuration settings to determine if the mobile device is enforcing Container Account Whitelisting.

This validation procedure is performed on both the MDM Administration Console and the Samsung Android 7 with Knox device.

On the MDM console, do the following:
1. Ask the MDM administrator to display the "Account whitelist" setting in the "Container Accounts" rule.
2. Verify the whitelist only contains DoD-approved email domains (for example, mail.mil).

Note: Proper configuration of Account blacklist is required for this configuration to function correctly.

On the Samsung Android 7 with Knox device, do the following:
1. Open the Knox Container.
2. Open "Settings".
3. Select "Accounts".
4. Select "Add account".
5. Select "Email" (and repeat for Microsoft Exchange ActiveSync) and attempt to add an email account with a DoD-approved domain.
6. Verify the email account can be added.
7. Attempt to add an email account with a domain not approved by DoD.
8. Verify that the email account cannot be added.

If the MDM console "Account whitelist" is not set to contain DoD-approved email domains or on the Samsung Android 7 with Knox device, the user is able to successfully configure the email account with a domain not approved by DoD, or if the user is not able to install the DoD-approved email account, this is a finding.

Check Content Reference

M

Target Key

3253

Comments