IBM MaaS360 v2.3.x MDM STIG Version Comparison

There are 5 differences between versions v1 r1 (Feb. 26, 2016) (the "left" version) and v1 r2 (Oct. 26, 2018) (the "right" version).

Check M360-01-022200 was added to the benchmark in the "right" version.

This check's original form is available here.

Title

Only authorized versions of the IBM MaaS360 server must be used.

Check Content

Interview ISSO and IBM MaaS360 MDM system administrator. Verify the site is not using the IBM MaaS360 V2 MDM or subscribing to a MaaS360 V2 MDM SaaS. If the site is using the IBM MaaS360 V2 MDM or subscribing to a MaaS360 V2 MDM SaaS, this is a finding.

Discussion

The IBM MaaS360 V2 server is no longer supported by IBM and therefore, may contain security vulnerabilities. The IBM MaaS360 V2 server is not authorized within the DoD.

Fix

Remove all versions of IBM MaaS360 V2 MDM or stop subscribing to a MaaS360 V2 MDM SaaS.