Title

Smartphone Instant Messaging (IM) client application must connect only to a DoD controlled IM server compliant with the Instant Messaging STIG. (Cat II impact)

Discussion

Non-DoD IM servers can be located anywhere in the world and may be under an adversary’s control. If a DoD smartphone IM client connects to a non-DoD IM server, malware could be installed on the smartphone/tablet from the server or sensitive DoD data on the smartphone could be transferred to the server. In addition, if malware is installed on the smartphone, this could lead to hacker attacks on the DoD enclave the smartphone connects to.

Check Content

Interview the IAO or smartphone/tablet system administrator and determine if smartphone IM is used on site-managed smartphones. If yes, determine what server the smartphone IM system connects to. - The server should be managed by a DoD site. - The IM system must be compliant with the Instant Messaging STIG. Mark as a finding if the IM server the smartphone IM app connects to is not managed by a DoD site.

Fix Text

Apply the Instant Messaging (IM) STIG requirements for the IM application on smartphones.

Additional Identifiers

Rule ID: SV-30702r3_rule

Vulnerability ID: V-24965

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.