Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
Samsung Android must be configured to enable Knox CC Mode.
Description
Discussion Text
The KPE CC Mode feature is a superset of other features and behavioral changes that are mandatory MDFPP requirements. If CC mode is not implemented the device will not be operating in the NIAP-certified compliant CC Mode of operation.
CC Mode implements the following behavioral/functional changes:
- FOTA signature verification uses additional SHA-512 signature check.
- Download Mode is disabled and all updates will occur via FOTA only.
- IKEv1 operates in Main Mode only.
- HTTPS audit logging in enabled.
- Certificates without a Subject Alternative Name (SAN) field are rejected.
- Certificates that do not pass Strict Host Name verification are rejected.
- Certificates provided by servers must have the Extended Key Usage field set as Server Authentication.
- Allows only authenticated Bluetooth connections.
- Additional Key Zeroization is performed.
SFR ID: FMT_SMF_EXT.1.1 #47
CC Mode implements the following behavioral/functional changes:
- FOTA signature verification uses additional SHA-512 signature check.
- Download Mode is disabled and all updates will occur via FOTA only.
- IKEv1 operates in Main Mode only.
- HTTPS audit logging in enabled.
- Certificates without a Subject Alternative Name (SAN) field are rejected.
- Certificates that do not pass Strict Host Name verification are rejected.
- Certificates provided by servers must have the Extended Key Usage field set as Server Authentication.
- Allows only authenticated Bluetooth connections.
- Additional Key Zeroization is performed.
SFR ID: FMT_SMF_EXT.1.1 #47
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.