Check: KNOX-09-000980
Samsung OS 9 with Knox 3.x COBO Use Case KPE(AE) Deployment STIG:
KNOX-09-000980
(in versions v1 r4 through v1 r1)
Title
Samsung Android must be configured to enable encryption for data at rest on removable storage media or alternately, the use of removable storage media must be disabled. (Cat I impact)
Discussion
The mobile operating system must ensure that the data being written to the mobile device's removable media is protected from unauthorized access. If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can read removable media directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. SFR ID: FMT_SMF_EXT.1.1 #21, #47f
Check Content
Review device configuration settings to confirm that mounting of physical storage media is disallowed or Knox external storage encryption is enabled. If the mobile device does not support removable media, this procedure is not applicable and is not a finding. This procedure is performed on both the MDM Administration console and the Samsung Android device. Confirm if Method #1 or Method #2 is used at the Samsung device site and follow the appropriate procedure. **** Method #1: On the MDM console, for the device, in the "Android user restrictions" group, verify that "disallow mount physical media" is selected. On the Samsung Android device, verify that a MicroSD card cannot be mounted. If on the MDM console "disallow mount physical media" is not selected, or a MicroSD card can be mounted by the Samsung Android device, this is a finding. **** Method #2: On the MDM console, for the device, in the "Knox encryption" group, verify that "enable external storage encryption" is selected. On the Samsung Android device, verify that a MicroSD card must be encrypted before use. If on the MDM console "enable external storage encryption" is not selected, or a MicroSD card can be used on the Samsung Android device without first being encrypted, this is a finding.
Fix Text
Configure Samsung Android to disallow mount of physical storage media or enable Knox external storage encryption. If the mobile device does not support removable media, this guidance is not applicable. Do one of the following: - Method #1: Disallow mounting of physical storage media. - Method #2: Enable external storage encryption. **** Method #1: On the MDM console, for the device, in the "Android user restrictions" group, select "disallow mount physical media". **** Method #2: On the MDM console, for the device, in the "Knox encryption" group, select "enable external storage encryption".
Additional Identifiers
Rule ID: SV-217689r617462_rule
Vulnerability ID: V-217689
Group Title: PP-MDF-301140
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001199 |
The information system protects the confidentiality and/or integrity of organization-defined information at rest. |
Controls
Number | Title |
---|---|
SC-28 |
Protection Of Information At Rest |