Review Samsung Android configuration settings to determine if the mobile device is prohibiting passwords with more than two repeating or sequential characters.
This validation procedure is performed on both the management tool and the Samsung Android device.
Confirm if Method #1 or #2 is used at the Samsung device site and follow the appropriate procedure.
****
Method #1: Require Numeric(Complex) password.
On the management tool, in the device password requirements section, verify that "minimum password quality" is set to "Numeric (Complex)".
On the Samsung Android device, do the following:
1. Open Settings >> Lock screen >> Screen lock type.
2. Enter current password.
3. Tap "PIN".
4. Enter a password with an invalid sequence and verify that text "Consecutive or repeating numbers are not allowed" is displayed above the PIN entry.
If on the management tool the "minimum password quality" is not set to "Numeric (Complex)", or on the Samsung Android device the text "Consecutive or repeating numbers are not allowed" is not displayed, this is a finding.
****
Method #2: Require Numeric password with KPE password constraints.
On the management tool, do the following:
1. In the device password requirements section, verify the "minimum password quality" is set to "Numeric".
2. In the KPE device password section, verify that "maximum sequential characters" is "2" or less.
3. In the KPE device password section, verify that "maximum sequential numbers" is "2" or less.
On the Samsung Android device, do the following:
1. Open Settings.
2. Tap "Lock screen".
3. Tap "Screen lock type".
4. Enter current password.
5. Tap "Password".
6. Verify that passwords with two or more sequential numbers are not accepted.
If on the management tool "minimum password quality" is not set to "Numeric" or "maximum sequential characters" or "maximum sequential numbers" is more than "2", or on the Samsung Android device a password with two or more sequential characters or numbers is accepted, this is a finding.
****
Note: Alphabetic, Alphanumeric, and Complex are also acceptable selections but these selections will cause the user to select a complex password, which is not required by the STIG.