Check: KNOX-14-210230
Samsung Android OS 14 with Knox 3.x COPE STIG:
KNOX-14-210230
(in versions v1 r2 through v1 r1)
Title
Samsung Android's Work profile must be configured to prevent users from adding personal email accounts to the work email app. (Cat II impact)
Discussion
If the user is able to add a personal email account (POP3, IMAP, EAS) to the work email app, it could be used to forward sensitive DOD data to unauthorized recipients. Restricting email account addition to the Administrator or to allowlisted accounts mitigates this vulnerability. SFR ID: FMT_MOF_EXT.1.2 #47
Check Content
Review the configuration to determine if the Samsung Android devices are preventing users from adding personal email accounts to the work email app. On the management tool, in the device restrictions section, verify "Modify accounts" is set to "Disallow". On the Samsung Android device: 1. Open Settings >> Accounts and backup >> Manage accounts. 2. Navigate to the "Work" tab. 3. Verify no account can be added. If on the management tool "Modify accounts" is not set to "Disallow", or on the Samsung Android device an account can be added, this is a finding.
Fix Text
Configure the Samsung Android devices to prevent users from adding personal email accounts to the work email app. On the management tool, in the Work profile restrictions, set "Modify accounts" to "Disallow".
Additional Identifiers
Rule ID: SV-258684r931252_rule
Vulnerability ID: V-258684
Group Title: PP-MDF-993300
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
The organization implements the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |