Title

Use of the smartphone camera must be approved and documented in site physical security policy. (Cat III impact)

Discussion

This is an operational security issue. Sensitive DoD data could be compromised if cameras are allowed in areas not authorized by the site physical security plan.

Check Content

Review the site physical security plan. Determine if digital cameras are allowed in site facilities. Note: Some sites have a policy not allowing digital cameras in the facility but allow smartphones with cameras, when used outside the facility, for mission support functions. -If digital cameras are allowed, “Allow use of camera” can be checked. -If digital cameras are not allowed but smartphones with cameras, when used outside the facility, for mission support functions are allowed, “Allow use of camera” can be checked. -If the site physical security policy does not specifically state use of digital cameras is allowed, “Allow use of camera” must be unchecked. This is a Good security policy set check. Recommend all checks related to Good security policy set rules be reviewed using the following procedure. Note: The site has the ability to disable the camera by using the Android profile if camera use is not approved, or allow the use of the camera and if use is approved and documented in the site physical security policy. Also, the site can state in the site physical security policy that camera use outside the facility is approved, but the camera must be disabled on the phone when brought into the facility. In this case, “Allow use of camera” would not be checked. 1. Make a list of all Good security policy sets assigned to smartphone user accounts on the Good server using the following procedure: --Have the SA identify any non STIG-compliant policy sets and STIG-compliant policy sets on the server. --Log into the Good Mobile Control console. --Click on the Policies tab. --View all policy set on the server. -Note: STIG-compliant policy sets should be identified as such in the policy title, for example, STIG_Android_Policy_Set. It is recommended all non STIG-compliant policy sets be deleted. 2. Select each policy set users are assigned to, and in turn, verify the required settings are in the policy set. Note: If there is a finding, note the name of the non STIG-compliant policy set in the Findings Details section in VMS/Component Provided Tracking Database. --------------------- -Launch the Good Mobile Control Web console and click on the Policies tab. -Select the policy set for the Android devices and click on Android Configuration on the left side. -Click the Restrictions tab. -Determine if “Allow use of camera” is unchecked or checked. If checked, verify the site physical security policy allows the use of smartphone cameras. Mark as a finding if “Allow use of camera” is checked and the site physical security policy does not allow the use of smartphone cameras.

Fix Text

Disable (uncheck) "Allow use of camera" in the iOS policy on the MDM server unless documented approval exists in the site physical security policy.

Additional Identifiers

Rule ID: SV-35035r1_rule

Vulnerability ID: V-25014

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.