BlackBerry CylancePROTECT Mobile for UEM STIG

BlackBerry CylancePROTECT Mobile for UEM Security Technical Implementation Guide

The BlackBerry CylancePROTECT Mobile for UEM Security Technical Implementation Guide (V1 R2) has 14 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

14STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R2

CurrentPublished Wed Jan 24 2024 What changed in V1R2

CylancePROTECT Mobile must be configured with the following compliance actions when an Android device fails security patch compliance and attestation: -Prompt behavior: Immediate enforcement action. -Enforcement action for device: Select either "Untrust", "Delete only work data" or "Delete all data". -Enforcement action for BlackBerry Dynamics apps: Select either "Do not allow BlackBerry Dynamics apps to run" or "Delete BlackBerry Dynamics apps data".

BlackBerry CylancePROTECT Mobile for UEM Security Technical Implementation Guide

Assessment Title

Rule Text

CylancePROTECT Mobile must be configured with the following compliance actions when an Android device fails security patch compliance and attestation:
-Prompt behavior: Immediate enforcement action.
-Enforcement action for device: Select either "Untrust", "Delete only work data" or "Delete all data".
-Enforcement action for BlackBerry Dynamics apps: Select either "Do not allow BlackBerry Dynamics apps to run" or "Delete BlackBerry Dynamics apps data".

Description

Discussion Text

When a compliance failure is detected, compliance actions must be implemented immediately to limit exposure of sensitive data and unauthorized access to the mobile device.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-257268

Rule

SV-257268r918388_rule

Severity

medium

Rule Version

BBCP-00-013400

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the following compliance actions when an Android device fails security patch compliance and attestation have been configured:
-Prompt behavior: Immediate enforcement action.
-Enforcement action for device: Select either "Untrust", "Delete only work data", or "Delete all data".
-Enforcement action for BlackBerry Dynamics apps: Select either "Do not allow BlackBerry Dynamics apps to run" or "Delete BlackBerry Dynamics apps data".

1. Log on to the BlackBerry UEM console.
2. In the management console on the menu bar, click Policies and profiles >> Compliance >> Compliance.
3. Select the appropriate compliance profile (have the site system administrator identify the profile).
4. On the Android tab, verify "Required security patch level is not installed" check box has been selected.
5. Verify for "Prompt behavior" "Immediate enforcement action" has been selected.
6. Verify for "Enforcement action for device" either "Untrust", "Delete work data only", or "Delete all data" has been selected.
7. Verify for "Enforcement action for BlackBerry Dynamics apps" either "Do not allow BlackBerry Dynamics apps to run" or "Delete BlackBerry Dynamics apps data" has been selected.

If required compliance actions when an Android device fails security patch compliance and attestation have not been configured, this is a finding.

Implementation Procedure

Fix Text

Configure the following compliance actions when an Android device fails security patch compliance and attestation:
-Prompt behavior: Immediate enforcement action.
-Enforcement action for device: Select either "Untrust", "Delete only work data", or "Delete all data".
-Enforcement action for BlackBerry Dynamics apps: Select either "Do not allow BlackBerry Dynamics apps to run" or "Delete BlackBerry Dynamics apps data".

1. Log on to the BlackBerry UEM console.
2. In the management console on the menu bar, click Policies and profiles >> Compliance >> Compliance.
3. Create a new compliance profile or select and edit an existing compliance profile.
4. On the Android tab, select the "Required security patch level is not installed" check box. Add the required device models and corresponding security patches.
5. For "Prompt behavior", select "Immediate enforcement action".
6. For "Enforcement action for device" select either "Untrust", "Delete work data only", or "Delete all data".
7. For "Enforcement action for BlackBerry Dynamics apps", select either "Do not allow BlackBerry Dynamics apps to run" or "Delete BlackBerry Dynamics apps data".
8. Click "Add" or "Save".
9. Assign the profile to users and groups.

STIG check 9 of 14 in the BlackBerry CylancePROTECT Mobile for UEM STIG checklist

← Previous · V-257267CylancePROTECT Mobile must be configured with the following Android security patch compliance and hardware certificate attestation controls: -"Android hardware attestation frequency" = 6 hours -"Device grace period" = 0 hours -"Challenge frequency for noncompliant devices" = 6 hours.Next · V-257269 →CylancePROTECT Mobile must be configured with the following compliance actions when a hardware attestation failure occurs (Android only): -Prompt for compliance: Immediate enforcement action. -Enforcement action for BlackBerry Dynamics apps: Do not allow BlackBerry Dynamics apps to run.