Check: KNOX-12-110280
Samsung Android 12 with Knox 3.x COBO STIG:
KNOX-12-110280
(in versions v1 r2 through v1 r1)
Title
Samsung Android must not accept the certificate when it cannot establish a connection to determine the validity of a certificate. (Cat III impact)
Discussion
Certificate-based security controls depend on the ability of the system to verify the validity of a certificate. If the MOS were to accept an invalid certificate, it could take unauthorized actions, resulting in unanticipated outcomes. At the same time, if the MOS were to disable functionality when it could not determine the validity of the certificate, this could result in a denial of service. Therefore, the ability to provide exceptions is appropriate to balance the tradeoff between security and functionality. Always accepting certificates when they cannot be determined to be valid is the most extreme exception policy and is not appropriate in the DoD context. Involving an Administrator or user in the exception decision mitigates this risk to some degree. SFR ID: FIA_X509_EXT_2.2
Check Content
Verify requirement KNOX-12-110270 (CC Mode) has been implemented. If "CC Mode" has not been implemented, this is a finding.
Fix Text
Implement CC Mode (see requirement KNOX-12-110270).
Additional Identifiers
Rule ID: SV-251830r814246_rule
Vulnerability ID: V-251830
Group Title: PP-MDF-321080
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000185 |
The information system, for PKI-based authentication, validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information. |
Controls
Number | Title |
---|---|
IA-5 (2) |
Pki-Based Authentication |