What changed in Samsung Android 12 with Knox 3.x COBO STIG V1R3V1R3 changes

Samsung Android 12 with Knox 3.x COBO STIG V1R3 (2024-07-24) replaced V1R1 (2021-12-15): 1 check added, 1 updated. It has 31 checks, against 30 in V1R1.

V1R3 checklistV1R1 checklist Compare V1R1 and V1R3 in STIG Compare

  • 1 added
  • 0 removed
  • 1 updated

Updated fields: Check text 1Title 1Discussion 1

Added in V1R3 (1)

  • V-264379CAT IAll Samsung Android 12 installations must be removed.

Updated in V1R3 (1)

V-251811CAT IISamsung Android must be configured to enable a screen-lock policy that will lock the display after a period of inactivity - Disable trust agents.Title, Check text, Discussion

Title

Samsung Android must be configured to disableenable authenticationa mechanismsscreen-lock providingpolicy userthat accesswill tolock protectedthe datadisplay otherafter than a Passwordperiod Authenticationof Factor,inactivity including- Disable trust agents.

Check text

Review the configuration to determine if the Samsung Android devices are disabling Trust Agents. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions, verify that "Trust Agents" are set to "Disable". -On the Samsung Android device: 1. Open Settings >> Biometrics and security >> Other security settings >> Trust agents. 2. Verify that all listed Trust Agents are disabled and cannot be enabled. If a Trust Agent is not disabled in the list, verify for that Trust Agent, all of its listed Trustlets are disabled and cannot be enabled. If on the management tool "Trust Agents" are not set to "Disable", or on the Samsung Android device a "Trust Agent" or "Trustlet" can be enabled, this is a finding. Note: If the management tool has been correctly configured but a Trust Agent is still enabled, configure the "List of approved apps listed in managed Google Play" to disable it; refer to KNOX-12-110190. Exception: Trust Agents may be used if the AO allows a screen lock timeout after four hours (or more) of inactivity. This may be applicable to tactical use case.

Discussion

TrustThe agentsscreen allowlock atimeout usermust tobe unlockset to a mobilevalue that helps protect the device withoutfrom enteringunauthorized access. Having a passcodetoo-long whentimeout would increase the window of opportunity for adversaries who gain physical access to the mobile device isthrough loss, for exampletheft, connectedetc. toSuch adevices user-selectedare Bluetoothmuch devicemore orlikely to be in aan user-selectedunlocked location.state Thiswhen technologyacquired wouldby allowan unauthorizedadversary, usersthus togranting haveimmediate access to DoDthe sensitive data ifon compromised.the Bymobile notdevice. permittingThe themaximum usetimeout period of non-password15 authenticationminutes mechanisms,has thisbeen riskselected isto mitigatedbalance -functionality asand userssecurity; areshorter forcedtimeout toperiods usemay passcodesbe thatappropriate meetdepending DoDon passcodethe requirementsrisks posed to the mobile device. SFR ID: FMT_SMF_EXT.1.1 #22, FIA_UAU.5.12a

V-251811 in V1R3

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R3 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.