Check: KNOX-09-000945
Samsung Android OS 9 with Knox 3.x COPE Use Case KPE(Legacy) Deployment STIG:
KNOX-09-000945
(in versions v1 r5 through v1 r1)
Title
Samsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key. (Cat II impact)
Discussion
If no authentication is required to establish personal hotspot connections, an adversary may be able to use that device to perform attacks on other devices or networks without detection. A sophisticated adversary may also be able to exploit unknown system vulnerabilities to access information and computing resources on the device. Requiring authentication to establish personal hotspot connections mitigates this risk. Application note: If hotspot functionality is permitted, it must be authenticated via a preshared key. There is no requirement to enable hotspot functionality. SFR ID: FMT_SMF_EXT.1.1 #41a
Check Content
Review device configuration to confirm that unsecured hotspots are disallowed. This procedure is performed on both the MDM Administration console and the Samsung Android device. On the MDM console, for the device, in the "Knox Wifi" group, verify that "allow unsecured hotspot" is not selected. On the Samsung Android device, do the following: 1. Open Settings. 2. Tap "Connections". 3. Tap "Mobile Hotspot and Tethering". 4. Tap "Mobile Hotspot". 5. Tap Overflow menu (three vertical dots). 6. Tap "Configure Mobile Hotspot". 7. Tap "Open in Security drop down". 8. Verify that "Save" is disabled. If on the MDM console "allow unsecured hotspot" is selected, or on the Samsung Android device an Open Mobile Hotspot configuration can be saved, this is a finding.
Fix Text
Configure Samsung Android to disallow unsecured hotspots. On the MDM console, in the Knox Wifi restrictions, unselect "allow unsecured hotspot".
Additional Identifiers
Rule ID: SV-217824r617464_rule
Vulnerability ID: V-217824
Group Title: PP-MDF-301240
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-002314 |
The information system controls remote access methods. |
Controls
Number | Title |
---|---|
AC-17 (1) |
Automated Monitoring / Control |