Title

A compliance rule must be set up in the server defining required mobile OS software versions. (Cat II impact)

Discussion

Unapproved OS versions do not support required security features. The security baseline of the Android system could be compromised if required security features are not available.

Check Content

This is a Good security policy set check. Recommend all checks related to Good security policy set rules be reviewed using the following procedure. 1. Make a list of all Good security policy sets assigned to smartphone user accounts on the Good server using the following procedure: -Have the SA identify any non STIG-compliant policy sets and STIG-compliant policy sets on the server. --Log into the Good Mobile Control console. --Click on the Policies tab. --View all policy sets on the server. -Note: STIG-compliant policy sets should be identified as such in the policy title. Examples are as follows: STIG_iOS_Policy_Set, STIG_WM6-5_Policy_Set, or STIG_Android_Policy_Set. It is recommended that all non-STIG policy sets be deleted. 2. Select each policy set users are assigned to, and in turn, verify the required settings are in the policy set. Note: If there is a finding, note the name of the non STIG-compliant policy set in the Findings Details section in VMS/Component Provided Tracking Database. --------------------------- -Launch the Good Mobile Control Web console and click on the Policies tab. -Select a policy set to review and click on the policy. -On the left tab, select Compliance Manager. -Verify “OS Version Verification” rule is listed. (Note: The rule title does not have to be exact.) -Open the rule by checking the box next to the rule, and then click on Edit. -Verify the following are set: Platform: Android Check to Run: OS Version Verification -Verify the following are checked: Android 2.2 -Verify “Failure Action” is set to “Quit Good for Enterprise”. -Verify “Check Every” is set to “1 hour”. Mark as a finding if the “OS Version Verification” rule has not been set up or is not configured as required.

Fix Text

Install the required OS version.

Additional Identifiers

Rule ID: SV-34965r1_rule

Vulnerability ID: V-25003

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.