What changed in Samsung Android OS 9 with Knox 3.x COPE Use Case KPE(Legacy) Deployment STIG V1R5V1R5 changes

Samsung Android OS 9 with Knox 3.x COPE Use Case KPE(Legacy) Deployment STIG V1R5 (2022-07-27) replaced V1R4 (2020-07-24): 52 checks added, 51 removed. It has 52 checks, against 51 in V1R4.

V1R5 checklistV1R4 checklist Compare V1R4 and V1R5 in STIG Compare

  • 52 added
  • 51 removed
  • 0 updated

Added in V1R5 (52)

  • V-217792CAT IIThe Samsung Android Workspace must be configured to prevent users from adding personal email accounts to the work email app.
  • V-217793CAT IISamsung Android must be configured to enforce the system application disable list.
  • V-217794CAT IISamsung Android Workspace must be configured to enforce the system application disable list.
  • V-217795CAT IISamsung Android Workspace must be configured to enforce an application installation policy by specifying an application whitelist that restricts applications by the following characteristics: list of digital signatures, list of package names.
  • V-217796CAT IIThe Samsung Android whitelist must be configured to not include applications with the following characteristic: - transmit MD diagnostic data to non-DoD servers.
  • V-217797CAT IIThe Samsung Android Workspace whitelist must be configured to not include applications with the following characteristics: - back up MD data to non-DoD cloud servers (including user and application access to cloud backup services); - transmit MD diagnostic data to non-DoD servers; - voice assistant application if available when MD is locked; - voice dialing application if available when MD is locked; - allows synchronization of data or applications between devices associated with user; and - allows unencrypted (or encrypted but not FIPS 140-2 validated) data sharing with other MDs or printers.
  • V-217798CAT IISamsung Android must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [DoD-approved commercial app repository, MDM server, mobile application store]: - disallow unknown app installation sources.
  • V-217799CAT IISamsung Android must be configured to enable the Knox audit log.
  • V-217800CAT IISamsung Android must be configured to disable exceptions to the access control policy that prevents [application processes, groups of application processes] from accessing [all, private] data stored by other [application processes, groups of application processes].
  • V-217801CAT IISamsung Android must be configured to create a Knox Workspace.
  • V-217802CAT IISamsung Android Workspace must be configured to not display the following notifications when the device is locked: - all notifications.
  • V-217803CAT IISamsung Android device users must complete required training.
  • V-217804CAT IIAny accessory that provides wired networking capabilities to a Samsung Android device must not be connected to a DoD network (for example: DeX Station [LAN port], USB to Ethernet adapter, etc.).
  • V-217805CAT IIISamsung Android must be configured to enforce a minimum password length of six characters.
  • V-217806CAT IIISamsung Android must be configured to not allow passwords that include more than two repeating or sequential characters.
  • V-217807CAT IISamsung Android must be configured to lock the display after 15 minutes (or less) of inactivity.
  • V-217808CAT IISamsung Android Workspace must be configured to lock after 15 minutes (or less) of inactivity.
  • V-217809CAT IIISamsung Android must be configured to not allow more than 10 consecutive failed authentication attempts.
  • V-217810CAT IIISamsung Android Workspace must be configured to not allow more than 10 consecutive failed authentication attempts.
  • V-217811CAT IISamsung Android must be configured to disable trust agents. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-217812CAT IISamsung Android must be configured to disable Face Recognition. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-217813CAT IISamsung Android Workspace must be configured to disable automatic completion of Samsung Internet browser text input.
  • V-217814CAT IISamsung Android must be configured to disable multi-user modes.
  • V-217815CAT IIISamsung Android must be configured to disable all Bluetooth profiles except HSP (Headset Profile), HFP (HandsFree Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile).
  • V-217816CAT IISamsung Android must be configured to disable USB mass storage mode.
  • V-217817CAT ISamsung Android must be configured to enable Knox Common Criteria (CC) Mode.
  • V-217818CAT IISamsung Android must be configured to disallow configuration of date and time.
  • V-217819CAT IISamsung Android must be configured to enforce a USB host mode exception list. Note: This configuration allows DeX mode (with input devices), which is DoD-approved for use.
  • V-217820CAT IISamsung Android Workspace must be configured to disallow the Share Via List feature.
  • V-217821CAT IISamsung Android must be configured to not allow backup of [all applications, configuration data] to locally connected systems.
  • V-217822CAT IISamsung Android Workspace must be configured to not allow backup of [all applications, configuration data] to remote systems.
  • V-217823CAT IISamsung Android must be configured to disable developer modes.
  • V-217824CAT IISamsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
  • V-217825CAT ISamsung Android must be configured to enable encryption for data at rest on removable storage media or alternately, the use of removable storage media must be disabled.
  • V-217826CAT IISamsung Android Workspace must be configured to enable Certificate Revocation List (CRL) status checking.
  • V-217827CAT IISamsung Android must be configured to enable Certificate Revocation List (CRL) status checking.
  • V-217828CAT IISamsung Android Workspace must have the DoD root and intermediate PKI certificates installed.
  • V-217830CAT IIISamsung Android must be configured to display the DoD advisory warning message at startup or each time the user unlocks the device.
  • V-217831CAT ISamsung Android devices must have the latest available Samsung Android operating system installed.
  • V-217832CAT IISamsung Android Workspace must be configured to enable the Online Certificate Status Protocol (OCSP).
  • V-217833CAT IISamsung Android must be configured to enable the Online Certificate Status Protocol (OCSP).
  • V-217834CAT IISamsung Android Workspace must be configured to not enable Microsoft Exchange ActiveSync (EAS) password recovery. This requirement is not applicable if not using Microsoft EAS.
  • V-217835CAT IISamsung Android must be configured to not enable Microsoft Exchange ActiveSync (EAS) password recovery. This requirement is not applicable if not using Microsoft EAS.
  • V-217836CAT IISamsung Android must be configured to set the password history with a length of 0.
  • V-217837CAT IISamsung Android Workspace must be configured to set the password history with a length of 0.
  • V-217838CAT IISamsung Android must be configured to enforce that Secure Startup is enabled. This requirement is Not Applicable (NA) to Galaxy S10 (or newer) devices.
  • V-217839CAT IISamsung Android must be configured to enable a screen-lock policy that will lock the display after a period of inactivity.
  • V-217840CAT IISamsung Android Workspace must be configured to enforce a minimum password length of four characters.
  • V-217841CAT IIISamsung Android Workspace must be configured to not allow passwords that include more than two repeating or sequential characters.
  • V-217842CAT IISamsung Android Workspace must be configured to enable a screen-lock policy that will lock the Workspace after a period of inactivity.
  • V-217843CAT IISamsung Android must be configured to enforce that Strong Protection is enabled. This requirement is Not Applicable (NA) for devices older than Galaxy S10.
  • V-252907CAT IAll Samsung Android 9 installations must be removed.

Removed since V1R4 (51)

  • V-93845CAT IIThe Samsung Android Workspace must be configured to prevent users from adding personal email accounts to the work email app.
  • V-93847CAT IISamsung Android must be configured to enforce the system application disable list.
  • V-93849CAT IISamsung Android Workspace must be configured to enforce the system application disable list.
  • V-93851CAT IISamsung Android Workspace must be configured to enforce an application installation policy by specifying an application whitelist that restricts applications by the following characteristics: list of digital signatures, list of package names.
  • V-93853CAT IIThe Samsung Android whitelist must be configured to not include applications with the following characteristic: - transmit MD diagnostic data to non-DoD servers.
  • V-93855CAT IIThe Samsung Android Workspace whitelist must be configured to not include applications with the following characteristics: - back up MD data to non-DoD cloud servers (including user and application access to cloud backup services); - transmit MD diagnostic data to non-DoD servers; - voice assistant application if available when MD is locked; - voice dialing application if available when MD is locked; - allows synchronization of data or applications between devices associated with user; and - allows unencrypted (or encrypted but not FIPS 140-2 validated) data sharing with other MDs or printers.
  • V-93857CAT IISamsung Android must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [DoD-approved commercial app repository, MDM server, mobile application store]: - disallow unknown app installation sources.
  • V-93859CAT IISamsung Android must be configured to enable the Knox audit log.
  • V-93861CAT IISamsung Android must be configured to disable exceptions to the access control policy that prevents [application processes, groups of application processes] from accessing [all, private] data stored by other [application processes, groups of application processes].
  • V-93863CAT IISamsung Android must be configured to create a Knox Workspace.
  • V-93865CAT IISamsung Android Workspace must be configured to not display the following notifications when the device is locked: - all notifications.
  • V-93867CAT IISamsung Android device users must complete required training.
  • V-93869CAT IIAny accessory that provides wired networking capabilities to a Samsung Android device must not be connected to a DoD network (for example: DeX Station [LAN port], USB to Ethernet adapter, etc.).
  • V-93871CAT IIISamsung Android must be configured to enforce a minimum password length of six characters.
  • V-93873CAT IIISamsung Android must be configured to not allow passwords that include more than two repeating or sequential characters.
  • V-93875CAT IISamsung Android must be configured to lock the display after 15 minutes (or less) of inactivity.
  • V-93877CAT IISamsung Android Workspace must be configured to lock after 15 minutes (or less) of inactivity.
  • V-93879CAT IIISamsung Android must be configured to not allow more than 10 consecutive failed authentication attempts.
  • V-93881CAT IIISamsung Android Workspace must be configured to not allow more than 10 consecutive failed authentication attempts.
  • V-93883CAT IISamsung Android must be configured to disable trust agents. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-93885CAT IISamsung Android must be configured to disable Face Recognition. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-93887CAT IISamsung Android Workspace must be configured to disable automatic completion of Samsung Internet browser text input.
  • V-93889CAT IISamsung Android must be configured to disable multi-user modes.
  • V-93891CAT IIISamsung Android must be configured to disable all Bluetooth profiles except HSP (Headset Profile), HFP (HandsFree Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile).
  • V-93893CAT IISamsung Android must be configured to disable USB mass storage mode.
  • V-93895CAT ISamsung Android must be configured to enable Knox Common Criteria (CC) Mode.
  • V-93897CAT IISamsung Android must be configured to disallow configuration of date and time.
  • V-93899CAT IISamsung Android must be configured to enforce a USB host mode exception list. Note: This configuration allows DeX mode (with input devices), which is DoD-approved for use.
  • V-93901CAT IISamsung Android Workspace must be configured to disallow the Share Via List feature.
  • V-93903CAT IISamsung Android must be configured to not allow backup of [all applications, configuration data] to locally connected systems.
  • V-93905CAT IISamsung Android Workspace must be configured to not allow backup of [all applications, configuration data] to remote systems.
  • V-93907CAT IISamsung Android must be configured to disable developer modes.
  • V-93909CAT IISamsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
  • V-93911CAT ISamsung Android must be configured to enable encryption for data at rest on removable storage media or alternately, the use of removable storage media must be disabled.
  • V-93913CAT IISamsung Android Workspace must be configured to enable Certificate Revocation List (CRL) status checking.
  • V-93915CAT IISamsung Android must be configured to enable Certificate Revocation List (CRL) status checking.
  • V-93917CAT IISamsung Android Workspace must have the DoD root and intermediate PKI certificates installed.
  • V-93921CAT IIISamsung Android must be configured to display the DoD advisory warning message at startup or each time the user unlocks the device.
  • V-93923CAT ISamsung Android devices must have the latest available Samsung Android operating system installed.
  • V-93925CAT IISamsung Android Workspace must be configured to enable the Online Certificate Status Protocol (OCSP).
  • V-93927CAT IISamsung Android must be configured to enable the Online Certificate Status Protocol (OCSP).
  • V-93929CAT IISamsung Android Workspace must be configured to not enable Microsoft Exchange ActiveSync (EAS) password recovery. This requirement is not applicable if not using Microsoft EAS.
  • V-93931CAT IISamsung Android must be configured to not enable Microsoft Exchange ActiveSync (EAS) password recovery. This requirement is not applicable if not using Microsoft EAS.
  • V-93933CAT IISamsung Android must be configured to set the password history with a length of 0.
  • V-93935CAT IISamsung Android Workspace must be configured to set the password history with a length of 0.
  • V-93937CAT IISamsung Android must be configured to enforce that Secure Startup is enabled. This requirement is Not Applicable (NA) to Galaxy S10 (or newer) devices.
  • V-93939CAT IISamsung Android must be configured to enable a screen-lock policy that will lock the display after a period of inactivity.
  • V-93941CAT IISamsung Android Workspace must be configured to enforce a minimum password length of four characters.
  • V-93943CAT IIISamsung Android Workspace must be configured to not allow passwords that include more than two repeating or sequential characters.
  • V-93945CAT IISamsung Android Workspace must be configured to enable a screen-lock policy that will lock the Workspace after a period of inactivity.
  • V-93947CAT IISamsung Android must be configured to enforce that Strong Protection is enabled. This requirement is Not Applicable (NA) for devices older than Galaxy S10.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R5 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.