Title

The smartphone USB port must be configured as required. (Cat II impact)

Discussion

A smartphone can be jailbroken or rooted when connected to a PC with a jailbreak or rooting application installed on it. When a smartphone is jailbroken/rooted, the user or malware has root access and can bypass all device security controls. DoD sensitive data could be compromised.

Check Content

There are two methods that can used to meet this requirement. The site should choose which method to use. Method #1: Disable all function of the device USB port This is a Good security policy set check. Recommend all checks related to Good security policy set rules be reviewed using the following procedure. 1. Make a list of all Good security policy sets assigned to smartphone user accounts on the Good server using the following procedure: -Have the SA identify any non STIG-compliant policy sets and STIG-compliant policy sets on the server. --Log into the Good Mobile Control console. --Click on the Policies tab. --View all policy set on the server. -Note: STIG-compliant policy sets should be identified as such in the policy title, for example, STIG_Android_Policy_Set. It is recommended all non STIG-compliant policy sets be deleted. 2. Select each policy set users are assigned to, and in turn, verify the required settings are in the policy set. Note: If there is a finding, note the name of the non STIG-compliant policy set in the Findings Details section in VMS/Component Provided Tracking Database. --------------------- -Launch the Good Mobile Control Web console and click on the Policies tab. -Select the policy set for the Android devices and click on Android Configuration on the left side. -Click the Restrictions tab. -Verify under Hardware Functionality “Allow use of USB port” is not checked. Method #2: Enable the device USB port but disable the mass storage function of the USB port Procedure: If the USAB port is enabled (see method #1 procedure, “Allow use of USB port” is checked), then “Mass Storage” must be set to “Disable.” First, verify the Dell Setup.apk file has been installed on the mobile OS device. -Have the system administrator show that the Dell Setup.apk is in the list of installed applications on the device (Settings>Applications>Manage applications>All). If the file is not listed, confirm with the SA that the file was installed on the device during setup, run, and then removed. (Note, a future release of the Good server will include the “Mass Storage” configuration setting in the Android security policy set and setup.apk will no longer be required.) Mark as a finding if either method #1 or Method #2 has not been implemented.

Fix Text

Configure the smartphone USB port as required.

Additional Identifiers

Rule ID: SV-38765r1_rule

Vulnerability ID: V-29529

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.