V3R1 changes
Ivanti Sentry 9.x NDM STIG V3R1 (2024-10-24) replaced V2R1 (2024-07-24): 26 checks updated. It has 26 checks, against 26 in V2R1.
V3R1 checklistV2R1 checklist Compare V2R1 and V3R1 in STIG Compare
- 0 added
- 0 removed
- 26 updated
Updated fields: Title 26Check text 23Fix text 22CCIs 6Discussion 4
Updated in V3R1 (26)
V-250982CAT IISentry must limit the number of concurrent sessions for the CLISH interface to an organization-defined number for each administrator account and/or administrator account type.Title
Title
MobileIron Sentry must limit the number of concurrent sessions for the CLISH interface to an organization-defined number for each administrator account and/or administrator account type.
V-250983CAT IISentry must be configured to limit the network access of the Sentry System Manager Portal behind the corporate firewall and whitelist source IP range.Title
Title
MobileIron Sentry must be configured to limit the network access of the Sentry System Manager Portal behind the corporate firewall and whitelist source IP range.
V-250984CAT IISentry must initiate a session lock after a 15-minute period of inactivity.Title, Check text, Fix text
Title
MobileIron Sentry must initiate a session lock after a 15-minute period of inactivity.
Check text
Verify the System manager Timeout is set to 15 minutes.
1. Log in to the MobileIron Sentry System Manager.
2. Navigate to Settings >> Timeout.
3. Verify the System Manager timeout is set to 15.
If the System Manager timeout is not set to 15, this is a finding.
Fix text
Set the System Manager Timeout to 15 minutes.
1. Log in to the MobileIron Sentry System Manager.
2. Navigate to Settings >> Timeout.
3. Configure the System Manager timeout to 15.
4. Click "Apply" and "Save" in the top right corner.
V-250985CAT IIISentry must enforce approved authorizations for controlling the flow of management information within the network device based on information flow control policies.Title, Check text, Fix text
Title
MobileIron Sentry must enforce approved authorizations for controlling the flow of management information within the network device based on information flow control policies.
Check text
Review MobileIron Sentry configuration to determine if it enforces approved authorizations for controlling the flow of management information within the network.
Sentry receives a request from MobileIron Core and enforces verification before handling the request to validate that it is from a trusted MobileIron Core.
Therefore, if the deployment uses MobileIron Core, to verify that Sentry trusts MobileIron Core in the deployment:
1. Run the following command in MobileIron Sentry CLI:
show sentry EMM-source-verify
If this is set to "false", this is a finding.
2. Run the following command in MobileIron Sentry CLI:
show sentry emm-ips
If the Core IP is not specified, this is a finding.
3. Verify MobileIron Sentry has an ACL for Core in MobileIron Sentry System Manager.
Then:
1. In the Standalone Sentry System Manager, go to Security >> Access Control Lists.
2. Verify that an ACL is created for Core. If it is not, this is a finding.
3. Determine if MobileIron Sentry is configured with specified backend services such as Exchange Active Sync or App Tunnels.
If the backend service is not specified, this is a finding.
Refer to section "Configuring Standalone Sentry for ActiveSync" and "Configuring Standalone Sentry for AppTunnel" in "MobileIron Sentry 9.8 Guide for MobileIron Core" to ensure these services are configured in MobileIron Sentry settings in Core where applicable.
Fix text
Configure MobileIron Sentry to enforce approved authorizations for controlling the flow of management information within the network device.
Sentry receives a request from MobileIron Core and enforces verification before handling the request to validate that it is from a trusted MobileIron Core.
Therefore, if the deployment uses MobileIron Core, to ensure that Sentry trusts MobileIron Core in the deployment, run the following commands in MobileIron Sentry CLI:
1. sentry emm-source-verify true
2. sentry emm-ips <subnet_list>>
3. This can further be mitigated by creating ACLs for MobileIron Sentry System Manager.
Then:
1. In the Standalone Sentry System Manager, go to Security >> Access Control Lists.
2. Click "Add".
3. In the "Name" field, enter a name to identify the ACL.
4. In the "Description" field, enter text to clarify the purpose of the ACL.
5. Click "Save".
6. Select the new ACL that was created and click it, which should open a Modify ACL dialog box.
7. Click "Add" to add an access control entry (ACE) to the ACL.
Each ACE consists of a combination of the network hosts and services that were configured for use in ACLs.
8. Use the following guidelines to complete the form:
Source Network
Destination Network
Service
Action - Select Permit or Deny from the dropdown list.
Connections Per Minute
9. Click "Save".
10. Configure Sentry with specified backend services such as Exchange Active Sync or App Tunnels. Refer to section "Configuring Standalone Sentry for ActiveSync" and "Configuring Standalone Sentry for AppTunnel" in "MobileIron Sentry 9.8 Guide for MobileIron Core" to ensure these services are configured in MobileIron Sentry settings in Core where applicable.
V-250986CAT IIISentry must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes.Title, Check text, Fix text
Title
MobileIron Sentry must be configured to enforce the limit of three consecutive invalid logon attempts, after which time it must block any login attempt for 15 minutes.
Check text
Review MobileIron Sentry configuration to verify that it enforces the limit of three consecutive invalid logon attempts.
1. Log in to MobileIron Sentry System Manager portal.
2. Go to the "Security" tab.
3. Go to "Password Policy".
4. Look for "Number of Failed Attempts" and determine if the value is set to 3. If it is not, this is a finding.
5. Verify the Auto-Lock Time value is set to 900 seconds or more.
If the Auto-Lock Time is not set to 900 seconds or more, this is a finding.
Fix text
Configure MobileIron Sentry to enforce the limit of three consecutive invalid login attempts during a 15-minute time period.
1. Log in to MobileIron Sentry System Manager portal.
2. Go to the "Security" tab.
3. Go to "Password Policy".
4. For "Number of Failed Attempts", set value to 3.
5. For "Auto-Lock Time", set value to 900 seconds or more.
V-250987CAT IISentry must display the Standard Mandatory DOD Notice and Consent Banner in the Sentry web interface before granting access to the device.Title, Check text, Fix text, Discussion
Title
MobileIron Sentry must display the Standard Mandatory DoOD Notice and Consent Banner in the Sentry web interface before granting access to the device.
Check text
Verify that MobileIron Sentry displays "I've read and consent to terms in IS user agreem't" when logging in to the command line.
1. Log in to the Sentry System Manager or the CLI interface.
2. Verify the required login banner is displayed.
If the banner is not shown, this is a finding.
Fix text
Configure MobileIron Sentry to display "I've read and consent to terms in IS user agreem't" when logging in to the command line.
1. Log in to the Sentry System Manager.
2. Go to Settings >> Login.
3. Add the required login banner to the "Text to Display" box.
4. Click "Apply".
Discussion
Display of the DoDDOD-approved use notification before granting access to the network device ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
System use notifications are required only for access via logon interfaces with human users.
V-250988CAT ISentry must be configured to use DOD PKI as multi-factor authentication (MFA) for interactive logins.Title, Check text, Fix text, Discussion
Title
MobileIron Sentry must be configured to use DoOD PKI as multi-factor authentication (MFA) for interactive logins.
Check text
Review the MobileIron Sentry Configuration to ensure Certificate Authentication has been configured.
1. Log in to the MobileIron Sentry System Manager.
2. Go to Security tab >> Advanced >> Sign-in Authentication.
3. Determine if Certificate Authentication is activated and configured.
If Certificate Authentication is not activated and configured, this is a finding.
Fix text
Configure the MobileIron Sentry with DoDDOD PKI-based Certificate Authentication.
1. Log in to the MobileIron Sentry System Manager.
2. Go to Security tab >> Advanced >> Sign-in Authentication.
3. Select the Certificate Authentication checkbox.
4. Select the CAC or PIV checkbox.
5. Map user certificate fields in the Certificate Attribute Mapping section based on the organization's certificates.
6. Upload the Issuing CA Certificate chain.
7. Click "Apply" and "Save" in the top right corner.
8. If using DoDDOD PKI, ensure an EDIPI attribute is assigned to the user in the Security >> Local Users section.
Discussion
Multi-factor authentication (MFA) is when two or more factors are used to confirm the identity of an individual who is requesting access to digital information resources. Valid factors include something the individual knows (e.g., username and password), something the individual has (e.g., a smartcard or token), or something the individual is (e.g., a fingerprint or biometric). Legacy information system environments only use a single factor for authentication, typically a username and password combination. Although two pieces of data are used in a username and password combination, this is still considered single factor because an attacker can obtain access simply by learning what the user knows. Common attacks against single-factor authentication are attacks on user passwords. These attacks include brute force password guessing, password spraying, and password credential stuffing. MFA, along with strong user account hygiene, helps mitigate against the threat of having account passwords discovered by an attacker. Even in the event of a password compromise, with MFA implemented and required for interactive login, the attacker still needs to acquire something the user has or replicate a piece of user’s biometric digital presence.
Private industry recognizes and uses a wide variety of MFA solutions. However, DoDDOD public key infrastructure (PKI) is the only prescribed method approved for DoDDOD organizations to implement MFA. For authentication purposes, centralized DoDDOD certificate authorities (CA) issue PKI certificate key pairs (public and private) to individuals using the prescribed x.509 format. The private certificates that have been generated by the issuing CA are downloaded and saved to smartcards which, within DoDDOD, are referred to as common access cards (CAC) or personal identity verification (PIV) cards. This happens at designated DoDDOD badge facilities. The CA maintains a record of the corresponding public keys for use with PKI-enabled environments. Privileged user smartcards, or "alternate tokens", function in the same manner, so this requirement applies to all interactive user sessions (authorized and privileged users).
Note: This requirement is used in conjunction with the use of a centralized authentication server (e.g., AAA, RADIUS, LDAP), a separate but equally important requirement. The MFA configuration of this requirement provides identification and the first phase of authentication (the challenge and validated response, thereby confirming the PKI certificate that was presented by the user). The centralized authentication server will provide the second phase of authentication (the digital presence of the PKI ID as a valid user in the requested security domain) and authorization. The centralized authentication server will map validated PKI identities to valid user accounts and determine access levels for authenticated users based on security group membership and role. In cases where the centralized authentication server is not utilized by the network device for user authorization, the network device must map the authenticated identity to the user account for PKI-based authentication.
V-250989CAT IISentry device must enforce a minimum 15-character password length.Title, Check text, Fix text, CCIs
Title
MobileIron Sentry device must enforce a minimum 15-character password length.
Check text
Review MobileIron Sentry configuration to verify that a minimum 15-character password is set.
1. Log in to MobileIron Sentry System Manager portal.
2. Go to the "Security" tab.
3. Go to Identity Source >> Password Policy.
4. Verify the "Minimum Password Length" is set to 15 or more.
If the password character length is not set 15 or more, this is a finding.
Fix text
Configure the MobileIron Sentry Local User Password Policy to enforce a minimum 15-character password.
1. Log in to MobileIron Sentry System Manager portal.
2. Go to the "Security" tab.
3. Go to Password Policy.
4. Set the "Minimum Password Length" value to 15 or more.
CCIs
CCI-004066CCI-004066,CCI-000205
V-250990CAT IISentry must enforce password complexity by requiring that at least one uppercase character be used.Title, Check text, Fix text, CCIs
Title
MobileIron Sentry must enforce password complexity by requiring that at least one uppercase character be used.
Check text
Where passwords are used, verify that MobileIron Sentry serverServer enforces password complexity by requiring that at least one uppercase character be used. This requirement may be verified by demonstration, configuration review, or validated test results.
If MobileIron Sentry serverServer does not require that at least one uppercase character be used in each password, this is a finding.
Verify the local Password Policy enforces an uppercase value:
1. Log in to the System Manager of Sentry.
2. Go to Security >> Identity Source >> Password.
3. Verify "Upper Case" is checked.
If "Upper Case" is not checked, this is a finding.
Fix text
Configure MobileIron Sentry serverServer to enforce password complexity by requiring that at least one uppercase character be used.
1. Log in to the System Manager of Sentry.
2. Go to Security >> Password.
3. Check "Upper Case".
4. Select "Apply".
CCIs
CCI-004066CCI-004066,CCI-000192
V-250991CAT IISentry must enforce password complexity by requiring that at least one lowercase character be used.Title, Check text, Fix text, CCIs
Title
MobileIron Sentry must enforce password complexity by requiring that at least one lowercase character be used.
Check text
Where passwords are used, confirm that MobileIron Sentry serverServer enforces password complexity by requiring that at least one lowercase character be used. This requirement may be verified by demonstration, configuration review, or validated test results.
If MobileIron Sentry does not require that at least one lowercase character be used in each password, this is a finding.
1. Log in to the System Manager of Sentry.
2. Go to Security >> Identity Source >> Password.
3. Verify "Lower Case" is checked.
If "Lower Case" is not checked, this is a finding.
Fix text
Configure MobileIron Sentry serverServer to enforce password complexity by requiring that at least one lowercase character be used.
1. Log in to the System Manager of Sentry.
2. Go to Security >> Password.
3. Check "Lower Case".
4. Select "Apply".
CCIs
CCI-004066CCI-004066,CCI-000193
V-250992CAT IISentry must enforce password complexity by requiring that at least one numeric character be used.Title, Check text, Fix text, CCIs
Title
MobileIron Sentry must enforce password complexity by requiring that at least one numeric character be used.
Check text
Where passwords are used, confirm that MobileIron Sentry serverServer enforces password complexity by requiring that at least one numeric character be used. This requirement may be verified by demonstration, configuration review, or validated test results.
If MobileIron Sentry serverServer does not require that at least one numeric character be used in each password, this is a finding.
1. Log into the System Manager of Sentry.
2. Go to Security >> Identity Source >> Password.
3. Verify "Numeric" is checked.
If "Numeric" is not checked, this is a finding.
Fix text
Configure MobileIron Sentry serverServer to enforce password complexity by requiring that at least one numeric character be used.
1. Log in to the System Manager of Sentry.
2. Go to Security >> Password.
3. Check "Numeric".
4. Select "Apply".
CCIs
CCI-004066CCI-004066,CCI-000194
V-250993CAT IISentry must enforce password complexity by requiring that at least one special character be used.Title, Check text, Fix text, CCIs
Title
MobileIron Sentry must enforce password complexity by requiring that at least one special character be used.
Check text
Where passwords are used, confirm that MobileIron Sentry serverServer enforces password complexity by requiring that at least one special character be used.
If MobileIron Sentry serverServer does not require that at least one special character be used in each password, this is a finding.
1. Log in to the System Manager of Sentry.
2. Go to Security >> Identity Source >> Password.
3. Verify "Special Character" is checked.
If "Special Character" is not checked, this is a finding.
Fix text
Configure MobileIron Sentry serverServer to enforce password complexity by requiring that at least one special character be used.
1. Log in to the System Manager of Sentry.
2. Go to Security >> Password.
3. Check "Special Character".
4. Select "Apply".
CCIs
CCI-004066CCI-004066,CCI-001619
V-250994CAT ISentry, for PKI-based authentication, must be configured to map validated certificates to unique user accounts.Title
Title
MobileIron Sentry, for PKI-based authentication, must be configured to map validated certificates to unique user accounts.
V-250995CAT ISentry must use FIPS 140-2 approved algorithms for authentication to a cryptographic module.Title, Check text, Fix text, Discussion
Title
MobileIron Sentry must use FIPS 140-2 approved algorithms for authentication to a cryptographic module.
Check text
Verify the Sentry uses encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.
On the MobileIron Sentry CLI console, do the following:
1. SSH to MobileIron Sentry Server from any SSH client.
2. Enter the administrator credentials set at MobileIron Sentry installation.
3. Enter "enable".
4. When prompted, enter the "enable secret" set at MobileIron Sentry installation.
5. Enter "show FIPS".
6. Verify "FIPS 140 mode is enabled" is displayed.
If the MobileIron Sentry Server does not report that FIPS mode is "enabled", this is a finding.
Fix text
Configure the MobileIron Sentry serverServer to use a FIPS 140-2-validated cryptographic module.
On the MobileIron Sentry console, do the following:
1. SSH to MobileIron Sentry Server from any SSH client.
2. Enter the administrator credentials set at MobileIron Sentry installation.
3. Enter "enable".
4. When prompted, enter the "enable secret" set at MobileIron Sentry installation.
5. Enter "configure terminal".
6. Enter the following command to enable FIPS: FIPS
7. Enter the following command to proceed with the necessary reload: do reload
8. Enter "Yes" at saved configuration modified prompt.
9. Enter "Yes" at proceed do reload.
Discussion
Unapproved mechanisms that are used for authentication to the cryptographic module are not validated and therefore cannot be relied upon to provide confidentiality or integrity, and DoDDOD data may be compromised.
Sentry utilizing encryption is required to use FIPS-compliant mechanisms for authenticating to cryptographic modules.
FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoDDOD requirements. However, authentication algorithms must configure security processes to use only FIPS-approved and NIST-recommended authentication algorithms.
V-250996CAT ISentry must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirement.Title, Check text, Fix text
Title
MobileIron Sentry must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after 10 minutes of inactivity except to fulfill documented and validated mission requirement.
Check text
The MobileIron Sentry System Manager has two interfaces, a CLI restricted shell and web-based GUI. In the MobileIron Sentry MICS portal, verify that the MobileIron Sentry CLI timeout is set to 10 minutes.
1. Log in to MobileIron Sentry.
2. Go to Settings >> CLI.
3. Within CLI Configuration, verify the CLI Session Timeout(minutes) is set to greater than 10 minutes.
If the CLI Session Timeout(minutes) is not set to greater than 10 minutes, this is a finding.
Fix text
Configure the Sentry to terminate the connection associated with a device management session at the end of the session or after 10 minutes of inactivity.
1. Log in to MobileIron Sentry.
2. Go to Settings >> CLI.
3. Within CLI Configuration, input "10" for CLI Session Timeout(minutes).
4. Click "Apply".
V-250997CAT IISentry must generate unique session identifiers using a FIPS 140-2 approved random number generator.Title, Check text, Fix text
Title
MobileIron Sentry must generate unique session identifiers using a FIPS 140-2 approved random number generator.
Check text
Verify the Sentry uses encryption services that implement NIST FIPS-validated cryptography to protect the confidentiality of remote access sessions.
On the MobileIron Sentry CLI console, do the following:
1. SSH to MobileIron Sentry Server from any SSH client.
2. Enter the administrator credentials set at MobileIron Sentry installation.
3. Enter "enable".
4. When prompted, enter the "enable secret" set at MobileIron Sentry installation.
5. Enter "show FIPS".
6. Verify "FIPS 140 mode is enabled" is displayed.
If the MobileIron Sentry Server does not report that FIPS mode is "enabled", this is a finding.
Fix text
Configure the MobileIron Sentry serverServer to use a FIPS 140-2-validated cryptographic module.
On the MobileIron Sentry console, do the following:
1. SSH to MobileIron Sentry Server from any SSH client.
2. Enter the administrator credentials set at MobileIron Sentry installation.
3. Enter "enable".
4. When prompted, enter the "enable secret" set at MobileIron Sentry installation.
5. Enter "configure terminal".
6. Enter the following command to enable FIPS: FIPS
7. Enter the following command to proceed with the necessary reload: do reload
8. Enter "Yes" at saved configuration modified prompt.
9. Enter "Yes" at proceed do reload.
V-250998CAT IIISentry must generate an immediate real-time alert of all audit failure events requiring real-time alerts.Title, Check text, Fix text
Title
MobileIron Sentry must generate an immediate real-time alert of all audit failure events requiring real-time alerts.
Check text
Verify the MobileIron Sentry is configured to send alerts for failure events in MobileIron Sentry System Manager web GUI.
1. Log in to MobileIron Sentry.
2. Go to Monitoring >> Alert Configuration.
3. Verify Alert monitoring is configured.
If Alert Configuration settings are not configured, this is a finding.
Refer to the "Alert Configuration" section of the "MobileIron Sentry 9.8.0 Guide for MobileIron Core" for more information.
Fix text
Configure the MobileIron Sentry to send alerts for failure events in MobileIron Sentry System Manager web GUI.
1. Log in to MobileIron Sentry.
2. Go to Monitoring >> Alert Configuration.
3. Check "Send Notification".
4. Apply Email List.
5. Enter Alerts Per Hour.
6. Enter Batch Time Interval (min).
7. Select "Default Alert Action".
8. Apply.
9. Add Alert Notification Management.
10. Add Alert ID.
11. Add "Action" from dropdown.
12. Click "Apply" and "Save" in the top right corner.
Refer to the "Alert Configuration" section of the "MobileIron Sentry 9.8.0 Guide for MobileIron Core" for more information.
V-250999CAT IISentry must be configured to synchronize internal information system clocks using redundant authoritative time sources.Title, Check text, Fix text, CCIs
Title
MobileIron Sentry must be configured to synchronize internal information system clocks using redundant authoritative time sources.
Check text
Verify the MobileIron Sentry is configured with multiple date and time servers (NTP).
1. Log in to MobileIron Sentry.
2. Go to Settings >> Date and Time (NTP).
3. Verify the NTP servers are configured.
If NTP servers are not configured, this is a finding.
Refer to the "Date and Time (NTP)" section of the "MobileIron Sentry 9.8.0 Guide for MobileIron Core" for more information.
Fix text
Configure the MobileIron Sentry with multiple date and time servers (NTP).
1. Log in to MobileIron Sentry.
2. Go to Settings >> Date and Time (NTP).
3. Under Time Source dropdown, select "NTP".
4. Enter at least Primary and Secondary NTP servers.
5. Click "Apply" and "Save" in the top right corner.
Refer to the "Date and Time (NTP)" section of the "MobileIron Sentry 9.8.0 Guide for MobileIron Core" for more information.
CCIs
CCI-000366,CCI-004928,CCI-001893
V-251000CAT IIThe Sentry must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).Title, Check text, Fix text
Title
The MobileIron Sentry must be configured to authenticate SNMP messages using a FIPS-validated Keyed-Hash Message Authentication Code (HMAC).
Check text
On the MobileIron Sentry console, do the following to verify FIPS mode is enabled:
1. SSH to MobileIron Sentry Server from any SSH client.
2. Enter the administrator credentials set at MobileIron Sentry installation.
3. Enter "enable".
4. When prompted, enter the "enable secret" set at MobileIron Sentry installation.
5. Enter "show FIPS".
6. Verify "FIPS 140 mode is enabled" is displayed. If it is not, this is a finding.
Then:
1. Log in to MobileIron Sentry.
2. Go to Settings >> SNMP.
3. Verify SNMP server has been added.
a. If SNMP server is not added, this is a finding.
b. If SNMP server is added, go to step 4.
4. Verify SNMP Control is not disabled.
a. If SNMP Control is disabled, this is a finding.
b. If SNMP Control is not disabled, go to step 5.
5. Verify Protocol v3 is selected.
a. If Protocol v3 is not selected, this is a finding.
b. If Protocol v3 is selected, go to step 6.
6. Verify the SNMP v3 User has been added.
a. If SNMP v3 User has not been added, this is a finding.
Fix text
On MobileIron Sentry console, do the following to configure FIPS mode:
1. SSH to the MobileIron Sentry.
2. At the prompt, enter "enable" mode with the secret credentials.
3. Type Configure command.
4. Type FIPS.
5. Once reloaded, SSH to the MobileIron Sentry.
6. Run the "show FIPS".
Then:
1. Log in to MobileIron Sentry.
2. Go to Settings >> SNMP.
3. Add SNMP Trap Receiver.
4. Enable SNMP Service.
5. Select Protocol v3.
6. Add SNMP v3 Users.
7. Enter User Name.
8. Select Security Level from dropdown.
9. Select AUTH Protocol from dropdown.
10. Enter AUTH Password.
11. Select Privacy Protocol from dropdown.
12. Enter Privacy Password.
13. Click "Save".
14. Enable Link Up/Down Trap.
15. Click "Apply" to save changes.
V-251001CAT ISentry must be configured to implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions.Title, Check text, Fix text
Title
MobileIron Sentry must be configured to implement cryptographic mechanisms using a FIPS 140-2 approved algorithm to protect the confidentiality of remote maintenance sessions.
Check text
On MobileIron Sentry console, do the following to verify FIPS mode is activated to protect the confidentiality of remote maintenance sessions:
1. SSH to the MobileIron Sentry.
2. Run the "show FIPS" command.
3. Verify FIPS 140 mode is not disabled.
If FIPS 140-2 mode is disabled, this is a finding.
Fix text
Configure MobileIron Sentry to use FIPS 140-2 approved algorithms to protect the confidentiality of remote maintenance sessions:
1. SSH to the MobileIron Sentry.
2. At the prompt, enter "enable" mode with the secret credentials.
3. Type Configure command.
4. Type FIPS.
5. Once reloaded, SSH to the MobileIron Sentry.
6. Run the "show FIPS" command.
FIPS 140 mode is enabled.
V-251002CAT IIISentry must offload audit records onto a different system or media than the system being audited.Title, Check text, Fix text, Discussion
Title
MobileIron Sentry must off-load audit records onto a different system or media than the system being audited.
Check text
Verify MobileIron Sentry is configured to offload audit records to a different system.
1. Log in to MobileIron Sentry.
2. Go to Settings >> Syslog.
3. Verify that a syslog server is configured.
If the syslog server is not configured, this is a finding.
Fix text
Configure MobileIron Sentry to forward/offload audit to a different system.
1. Log in to MobileIron Sentry.
2. Go to Settings >> Syslog.
3. Configure a new syslog server if not already added.
4. Click on the syslog server(s) and in the "Modify Syslog"/"Add Syslog" pop-up dialog, under the "Facility Type", click the checkbox for "Audit".
5. Set the Admin State to "Enable".
6. Click "Apply".
Discussion
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loadingOffloading is a common process in information systems with limited audit storage capacity.
V-251003CAT IIISentry must enforce access restrictions associated with changes to the system components.Title, Check text, Fix text
Title
MobileIron Sentry must enforce access restrictions associated with changes to the system components.
Check text
Verify that only authorized administrators have permissions for changes, deletions, and updates on the MobileIron Sentry.
1. Log in to System Manager.
2. Go to Security >> Local Users.
3. Verify no unauthorized users are listed.
If unauthorized users are listed, this is a finding.
Fix text
Configure that only authorized administrators have permissions for changes, deletions, and updates on the MobileIron Sentry.
1. Log in to System Manager.
2. Go to Security >> identity Source >> Local Users.
3. Click "Add" to add authorized users.
4. If unauthorized users are listed, click the check box next to the unauthorized user and click "Delete".
V-251004CAT IIISentry must be configured to conduct backups of system level information contained in the information system when changes occur.Title, Check text, Fix text
Title
MobileIron Sentry must be configured to conduct backups of system level information contained in the information system when changes occur.
Check text
Identify/validate MobileIron Sentry support for periodic backups.
This is done via the virtual machine.
Check with the virtual team to verify backups are scheduled.
If the backups are not scheduled, this is a finding.
Fix text
Ensure the virtual solution provides periodic backups.
Refer to "MobileIron Sentry Installation Guide", section "Periodic backups for VMware", pages 6-7.
V-251005CAT IISentry must obtain its public key certificates from an appropriate certificate policy through an approved service provider.Title, Check text, Fix text
Title
MobileIron Sentry must obtain its public key certificates from an appropriate certificate policy through an approved service provider.
Check text
Determine if the MobileIron Sentry has a public certificate from an approved Certificate Authority.
From MobileIron Core:
1. Log in to the MobileIron Core.
2. Navigate to "Services".
3. Select "Sentry".
4. On each configured Sentry, select "View Certificate".
5. Validate the Public Key is issued from an approved Certificate Authority.
From MobileIron Sentry:
1. Log in to the MobileIron Sentry.
2. Navigate to "Security".
3. Scroll down to "Certificate Mgmt".
4. Select "View Certificate".
If approved certificates have not been uploaded, this is a finding.
Fix text
Configure the MobileIron Sentry with a certificate from an approved Certificate Authority.
From MobileIron Core:
1. Log in to the MobileIron Core.
2. Navigate to "Services".
3. Select "Sentry".
4. On each configured Sentry, select "Manage Certificate".
5. Upload appropriate certificate.
From MobileIron Sentry:
1. Log in to the MobileIron Sentry.
2. Navigate to "Security".
3. Select "Certificate Management".
4. Select "Manage Certificate".
5. Upload appropriate certificate.
Reference "MobileIron Sentry Guide for MobileIron Core" for uploading a certificate to MobileIron Sentry, section "Standalone Sentry Certificate".
V-251006CAT ISentry must be configured to send log data to a central log server for the purpose of forwarding alerts to the administrators and the ISSO.Title, Check text, Fix text
Title
MobileIron Sentry must be configured to send log data to a central log server for the purpose of forwarding alerts to the administrators and the ISSO.
Check text
To identify/validate MobileIron Sentry support for syslog forwarding, follow the navigation steps below.
1. Log in to the MobileIron Sentry.
2. Navigate to "Settings".
3. Scroll down to "Syslog".
4. Verify that a syslog server has been configured correctly.
a. Verify Server IP address.
b. Verify Port.
c. Verify Facility Types.
d. Verify Admin state is enabled.
If syslog forwarding has not been implemented, this is a finding.
Fix text
Configure the MobileIron Sentry to forward syslog data using the steps below Refer to "MobileIron Sentry Guide for Core", section "Syslog", page 140.
1. Log in to the MobileIron Sentry.
2. Navigate to "Settings".
3. Scroll down to "Syslog".
4. If there is no syslog server entry, ADD the server:
a. Add Server IP address.
b. Add Port.
c. Select/add Facility Types and Log Levels.
d. Enable Admin state.
V-251007CAT ISentry must be running an operating system release that is currently supported by MobileIron.Title, Check text
Title
MobileIron Sentry must be running an operating system release that is currently supported by MobileIron.
Check text
Verify the MobileIron Sentry is a supported version.
1. Enter the MobileIron Sentry System Manager Portal URL in a web browser.
2. View the version number in the top right corner.
3. Check the MI Support page (help.mobileiron.com) to ensure the MI Sentry is a supported version.
If the version number of the Sentry appliance is not supported, this is a finding.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V3R1 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.