Title

BlackBerry 10 OS device lock, when activated on a device, must place a publicly viewable pattern onto the associated display, hiding what was previously visible on the screen. (Cat II impact)

Discussion

The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identification and authentication procedures. A device lock is a temporary action taken when a user stops work but does not want to log out because of the temporary nature of the hiatus. During the device lock a publicly viewable pattern is visible on the associated display, hiding what was previously visible on the screen. Once invoked, the device lock shall remain in place until the user re-authenticates. No other system activity aside from re-authentication can unlock the system. The operating system must lock the device with a publicly viewable pattern visible on the associated display, hiding what was previously visible on the screen. This prevents others from gaining access to the device when not in the user's possession and accessing sensitive DoD information. Publicly viewable patterns can include screen saver patterns, photographic images, solid colors, or a blank screen, so long as none of those patterns convey sensitive information. Non-sensitive device information, such as battery life, signal strength, and time/date, may be viewable as part of a publically viewable pattern. However, system notifications, user or contact information must not be viewable because they may reveal owner or organizational information.

Check Content

While holding the Power button from either the Work Space or Personal Space, select "Lock" to lock the device. Ensure the Work Space content is not visible on the lock screen. Otherwise, this is a finding.

Fix Text

On BlackBerry Device Service, set "Lock Screen Preview of Work Content" to "Disallow".

Additional Identifiers

Rule ID:

Vulnerability ID: V-47231

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.