What changed in Samsung Android OS 9 Knox 3.x COBO KPE Legacy STIG V1R5V1R5 changes

Samsung Android OS 9 Knox 3.x COBO KPE Legacy STIG V1R5 (2022-07-27) replaced V1R4 (2020-07-24): 40 checks added, 39 removed. It has 40 checks, against 39 in V1R4.

V1R5 checklistV1R4 checklist Compare V1R4 and V1R5 in STIG Compare

  • 40 added
  • 39 removed
  • 0 updated

Added in V1R5 (40)

  • V-217701CAT IISamsung Android must be configured to prevent users from adding personal email accounts to the work email app.
  • V-217702CAT IISamsung Android must be configured to enforce the system application disable list.
  • V-217703CAT IISamsung Android must be configured to enforce an application installation policy by specifying an application whitelist that restricts applications by the following characteristics: list of digital signatures, list of package names.
  • V-217704CAT IIThe Samsung Android whitelist must be configured to not include applications with the following characteristics: - back up mobile device data to non-DoD cloud servers (including user and application access to cloud backup services); - transmit mobile device diagnostic data to non-DoD servers; - voice assistant application if available when the mobile device is locked; - voice dialing application if available when the mobile device is locked; - allows synchronization of data or applications between devices associated with the user; and - allows unencrypted (or encrypted but not FIPS 140-2 validated) data sharing with other mobile devices or printers.
  • V-217705CAT IISamsung Android must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [DoD-approved commercial app repository, MDM server, mobile application store]: - disallow unknown app installation sources.
  • V-217706CAT IISamsung Android must be configured to enable the Knox audit log.
  • V-217707CAT IISamsung Android must be configured to not display the following notifications when the device is locked: all notifications.
  • V-217708CAT IISamsung Android device users must complete required training.
  • V-217709CAT IIAny accessory that provides wired networking capabilities to a Samsung Android device must not be connected to a DoD network (for example: DeX Station [LAN port], USB to Ethernet adapter, etc.).
  • V-217710CAT IIISamsung Android must be configured to enforce a minimum password length of six characters.
  • V-217711CAT IIISamsung Android must be configured to not allow passwords that include more than two repeating or sequential characters.
  • V-217712CAT IISamsung Android must be configured to lock the display after 15 minutes (or less) of inactivity.
  • V-217713CAT IIISamsung Android must be configured to not allow more than 10 consecutive failed authentication attempts.
  • V-217714CAT IISamsung Android must be configured to disable trust agents. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-217715CAT IISamsung Android must be configured to disable Face Recognition. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-217716CAT IISamsung Android must be configured to disable automatic completion of Samsung Internet browser text input.
  • V-217717CAT IISamsung Android must be configured to disable multi-user modes.
  • V-217718CAT IIISamsung Android must be configured to disable all Bluetooth profiles except HSP (Headset Profile), HFP (HandsFree Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile).
  • V-217719CAT IISamsung Android must be configured to disable USB mass storage mode.
  • V-217720CAT ISamsung Android must be configured to enable Knox Common Criteria (CC) Mode.
  • V-217721CAT IISamsung Android must be configured to disallow configuration of date and time.
  • V-217722CAT IISamsung Android must be configured to enforce a USB host mode exception list. Note: This configuration allows DeX mode (with input devices), which is DoD-approved for use.
  • V-217723CAT IISamsung Android must be configured to disable the Share Via List feature.
  • V-217724CAT IISamsung Android must be configured to disallow outgoing beam.
  • V-217725CAT IISamsung Android must be configured to enforce that Wi-Fi Sharing is disabled.
  • V-217726CAT IISamsung Android must be configured to not allow backup of [all applications, configuration data] to locally connected systems.
  • V-217727CAT IISamsung Android must be configured to not allow backup of [all applications, configuration data] to remote systems.
  • V-217728CAT IISamsung Android must be configured to disable developer modes.
  • V-217729CAT IISamsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
  • V-217730CAT ISamsung Android must be configured to enable encryption for data at rest on removable storage media or alternately, the use of removable storage media must be disabled.
  • V-217731CAT IISamsung Android must be configured to enable Certificate Revocation List (CRL) status checking.
  • V-217733CAT IIISamsung Android must be configured to display the DoD advisory warning message at startup or each time the user unlocks the device.
  • V-217734CAT ISamsung Android devices must have the latest available Samsung Android operating system installed.
  • V-217735CAT IISamsung Android must be configured to enable the Online Certificate Status Protocol (OCSP).
  • V-217736CAT IISamsung Android must be configured to not enable Microsoft Exchange ActiveSync (EAS) password recovery. This requirement is not applicable if not using Microsoft EAS.
  • V-217737CAT IISamsung Android must be configured to set the password history with a length of 0.
  • V-217738CAT IISamsung Android must be configured to enforce that Secure Startup is enabled. This requirement is Not Applicable (NA) to Galaxy S10 (or newer) devices.
  • V-217739CAT IISamsung Android must be configured to enable a screen-lock policy that will lock the display after a period of inactivity.
  • V-217740CAT IISamsung Android must be configured to enforce that Strong Protection is enabled. This requirement is Not Applicable (NA) for devices older than Galaxy S10.
  • V-252905CAT IAll Samsung Android 9 installations must be removed.

Removed since V1R4 (39)

  • V-92953CAT IISamsung Android must be configured to prevent users from adding personal email accounts to the work email app.
  • V-92955CAT IISamsung Android must be configured to enforce the system application disable list.
  • V-92957CAT IISamsung Android must be configured to enforce an application installation policy by specifying an application whitelist that restricts applications by the following characteristics: list of digital signatures, list of package names.
  • V-92959CAT IIThe Samsung Android whitelist must be configured to not include applications with the following characteristics: - back up mobile device data to non-DoD cloud servers (including user and application access to cloud backup services); - transmit mobile device diagnostic data to non-DoD servers; - voice assistant application if available when the mobile device is locked; - voice dialing application if available when the mobile device is locked; - allows synchronization of data or applications between devices associated with the user; and - allows unencrypted (or encrypted but not FIPS 140-2 validated) data sharing with other mobile devices or printers.
  • V-93569CAT IISamsung Android must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [DoD-approved commercial app repository, MDM server, mobile application store]: - disallow unknown app installation sources.
  • V-93573CAT IISamsung Android must be configured to enable the Knox audit log.
  • V-93575CAT IISamsung Android must be configured to not display the following notifications when the device is locked: all notifications.
  • V-93577CAT IISamsung Android device users must complete required training.
  • V-93579CAT IIAny accessory that provides wired networking capabilities to a Samsung Android device must not be connected to a DoD network (for example: DeX Station [LAN port], USB to Ethernet adapter, etc.).
  • V-93581CAT IIISamsung Android must be configured to enforce a minimum password length of six characters.
  • V-93583CAT IIISamsung Android must be configured to not allow passwords that include more than two repeating or sequential characters.
  • V-93585CAT IISamsung Android must be configured to lock the display after 15 minutes (or less) of inactivity.
  • V-93587CAT IIISamsung Android must be configured to not allow more than 10 consecutive failed authentication attempts.
  • V-93589CAT IISamsung Android must be configured to disable trust agents. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-93591CAT IISamsung Android must be configured to disable Face Recognition. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-93593CAT IISamsung Android must be configured to disable automatic completion of Samsung Internet browser text input.
  • V-93595CAT IISamsung Android must be configured to disable multi-user modes.
  • V-93597CAT IIISamsung Android must be configured to disable all Bluetooth profiles except HSP (Headset Profile), HFP (HandsFree Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile).
  • V-93599CAT IISamsung Android must be configured to disable USB mass storage mode.
  • V-93601CAT ISamsung Android must be configured to enable Knox Common Criteria (CC) Mode.
  • V-93603CAT IISamsung Android must be configured to disallow configuration of date and time.
  • V-93605CAT IISamsung Android must be configured to enforce a USB host mode exception list. Note: This configuration allows DeX mode (with input devices), which is DoD-approved for use.
  • V-93607CAT IISamsung Android must be configured to disable the Share Via List feature.
  • V-93609CAT IISamsung Android must be configured to disallow outgoing beam.
  • V-93611CAT IISamsung Android must be configured to enforce that Wi-Fi Sharing is disabled.
  • V-93613CAT IISamsung Android must be configured to not allow backup of [all applications, configuration data] to locally connected systems.
  • V-93615CAT IISamsung Android must be configured to not allow backup of [all applications, configuration data] to remote systems.
  • V-93617CAT IISamsung Android must be configured to disable developer modes.
  • V-93619CAT IISamsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
  • V-93621CAT ISamsung Android must be configured to enable encryption for data at rest on removable storage media or alternately, the use of removable storage media must be disabled.
  • V-93623CAT IISamsung Android must be configured to enable Certificate Revocation List (CRL) status checking.
  • V-93627CAT IIISamsung Android must be configured to display the DoD advisory warning message at startup or each time the user unlocks the device.
  • V-93629CAT ISamsung Android devices must have the latest available Samsung Android operating system installed.
  • V-93631CAT IISamsung Android must be configured to enable the Online Certificate Status Protocol (OCSP).
  • V-93633CAT IISamsung Android must be configured to not enable Microsoft Exchange ActiveSync (EAS) password recovery. This requirement is not applicable if not using Microsoft EAS.
  • V-93635CAT IISamsung Android must be configured to set the password history with a length of 0.
  • V-93637CAT IISamsung Android must be configured to enforce that Secure Startup is enabled. This requirement is Not Applicable (NA) to Galaxy S10 (or newer) devices.
  • V-93639CAT IISamsung Android must be configured to enable a screen-lock policy that will lock the display after a period of inactivity.
  • V-93641CAT IISamsung Android must be configured to enforce that Strong Protection is enabled. This requirement is Not Applicable (NA) for devices older than Galaxy S10.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R5 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.