What changed in Samsung OS 9 with Knox 3.x COBO Use Case KPE(AE) Deployment STIG V1R4V1R4 changes

Samsung OS 9 with Knox 3.x COBO Use Case KPE(AE) Deployment STIG V1R4 (2022-07-27) replaced V1R3 (2020-04-24): 41 checks added, 40 removed. It has 41 checks, against 40 in V1R3.

V1R4 checklistV1R3 checklist Compare V1R3 and V1R4 in STIG Compare

  • 41 added
  • 40 removed
  • 0 updated

Added in V1R4 (41)

  • V-217660CAT IISamsung Android must be configured to prevent users from adding personal email accounts to the work email app.
  • V-217661CAT IISamsung Android must be configured to enforce the system application disable list.
  • V-217662CAT IISamsung Android must be configured to enforce an application installation policy by specifying an application whitelist that restricts applications by the following characteristics: list of digital signatures, list of package names.
  • V-217663CAT IIThe Samsung Android whitelist must be configured to not include applications with the following characteristics: - back up mobile device data to non-DoD cloud servers (including user and application access to cloud backup services); - transmit mobile device diagnostic data to non-DoD servers; - voice assistant application if available when the mobile device is locked; - voice dialing application if available when the mobile device is locked; - allows synchronization of data or applications between devices associated with the user; and - allows unencrypted (or encrypted but not FIPS 140-2 validated) data sharing with other mobile devices or printers.
  • V-217664CAT IISamsung Android must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [DoD-approved commercial app repository, MDM server, mobile application store]: - disallow unknown app installation sources.
  • V-217665CAT IISamsung Android must be configured to enable the Knox audit log.
  • V-217666CAT IISamsung Android must be configured to not display the following notifications when the device is locked: all notifications.
  • V-217667CAT IISamsung Android device users must complete required training.
  • V-217668CAT IIAny accessory that provides wired networking capabilities to a Samsung Android device must not be connected to a DoD network (for example: DeX Station [LAN port], USB to Ethernet adapter, etc.).
  • V-217669CAT IIISamsung Android must be configured to enforce a minimum password length of six characters.
  • V-217670CAT IIISamsung Android must be configured to not allow passwords that include more than two repeating or sequential characters.
  • V-217671CAT IISamsung Android must be configured to lock the display after 15 minutes (or less) of inactivity.
  • V-217672CAT IIISamsung Android must be configured to not allow more than 10 consecutive failed authentication attempts.
  • V-217673CAT IISamsung Android must be configured to disable trust agents. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-217674CAT IISamsung Android must be configured to disable Face Recognition. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-217675CAT IISamsung Android must be configured to disable automatic completion of Samsung Internet browser text input.
  • V-217676CAT IISamsung Android must be configured to disable the autofill services.
  • V-217677CAT IIISamsung Android must be configured to disable all Bluetooth profiles except HSP (Headset Profile), HFP (HandsFree Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile).
  • V-217678CAT IISamsung Android must be configured to disable USB mass storage mode.
  • V-217679CAT ISamsung Android must be configured to enable Knox Common Criteria (CC) Mode.
  • V-217680CAT IISamsung Android must be configured to disallow configuration of date and time.
  • V-217681CAT IISamsung Android must be configured to enforce a USB host mode exception list. Note: This configuration allows DeX mode (with input devices), which is DoD-approved for use.
  • V-217682CAT IISamsung Android must be configured to disallow the Share Via List feature.
  • V-217683CAT IISamsung Android must be configured to disallow outgoing beam.
  • V-217684CAT IISamsung Android must be configured to enforce that Wi-Fi Sharing is disabled.
  • V-217685CAT IISamsung Android must be configured to not allow backup of [all applications, configuration data] to locally connected systems.
  • V-217686CAT IISamsung Android must be configured to not allow backup of [all applications, configuration data] to remote systems.
  • V-217687CAT IISamsung Android must be configured to disable developer modes.
  • V-217688CAT IISamsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
  • V-217689CAT ISamsung Android must be configured to enable encryption for data at rest on removable storage media or alternately, the use of removable storage media must be disabled.
  • V-217690CAT IISamsung Android must be configured to enable Certificate Revocation List (CRL) status checking.
  • V-217691CAT IISamsung Android must have the DoD root and intermediate PKI certificates installed.
  • V-217692CAT IIISamsung Android must be configured to display the DoD advisory warning message at startup or each time the user unlocks the device.
  • V-217693CAT ISamsung Android devices must have the latest available Samsung Android operating system installed.
  • V-217694CAT IISamsung Android must be configured to enable the Online Certificate Status Protocol (OCSP).
  • V-217695CAT IISamsung Android must be configured to not enable Microsoft Exchange ActiveSync (EAS) password recovery. This requirement is not applicable if not using Microsoft EAS.
  • V-217696CAT IISamsung Android must be configured to set the password history with a length of 0.
  • V-217697CAT IISamsung Android must be configured to enforce that Secure Startup is enabled. This requirement is Not Applicable (NA) to Galaxy S10 (or newer) devices.
  • V-217698CAT IISamsung Android must be configured to enable a screen-lock policy that will lock the display after a period of inactivity.
  • V-217699CAT IISamsung Android must be configured to enforce that Strong Protection is enabled. This requirement is Not Applicable (NA) for devices older than Galaxy S10.
  • V-252904CAT IAll Samsung Android 9 installations must be removed.

Removed since V1R3 (40)

  • V-92857CAT IISamsung Android must be configured to prevent users from adding personal email accounts to the work email app.
  • V-92859CAT IISamsung Android must be configured to enforce the system application disable list.
  • V-92861CAT IISamsung Android must be configured to enforce an application installation policy by specifying an application whitelist that restricts applications by the following characteristics: list of digital signatures, list of package names.
  • V-92863CAT IIThe Samsung Android whitelist must be configured to not include applications with the following characteristics: - back up mobile device data to non-DoD cloud servers (including user and application access to cloud backup services); - transmit mobile device diagnostic data to non-DoD servers; - voice assistant application if available when the mobile device is locked; - voice dialing application if available when the mobile device is locked; - allows synchronization of data or applications between devices associated with the user; and - allows unencrypted (or encrypted but not FIPS 140-2 validated) data sharing with other mobile devices or printers.
  • V-92865CAT IISamsung Android must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [DoD-approved commercial app repository, MDM server, mobile application store]: - disallow unknown app installation sources.
  • V-92867CAT IISamsung Android must be configured to enable the Knox audit log.
  • V-92869CAT IISamsung Android must be configured to not display the following notifications when the device is locked: all notifications.
  • V-92871CAT IISamsung Android device users must complete required training.
  • V-92873CAT IIAny accessory that provides wired networking capabilities to a Samsung Android device must not be connected to a DoD network (for example: DeX Station [LAN port], USB to Ethernet adapter, etc.).
  • V-92875CAT IIISamsung Android must be configured to enforce a minimum password length of six characters.
  • V-92877CAT IIISamsung Android must be configured to not allow passwords that include more than two repeating or sequential characters.
  • V-92879CAT IISamsung Android must be configured to lock the display after 15 minutes (or less) of inactivity.
  • V-92881CAT IIISamsung Android must be configured to not allow more than 10 consecutive failed authentication attempts.
  • V-92883CAT IISamsung Android must be configured to disable trust agents. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-92885CAT IISamsung Android must be configured to disable Face Recognition. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-92887CAT IISamsung Android must be configured to disable automatic completion of Samsung Internet browser text input.
  • V-92889CAT IISamsung Android must be configured to disable the autofill services.
  • V-92891CAT IIISamsung Android must be configured to disable all Bluetooth profiles except HSP (Headset Profile), HFP (HandsFree Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile).
  • V-92893CAT IISamsung Android must be configured to disable USB mass storage mode.
  • V-92895CAT ISamsung Android must be configured to enable Knox Common Criteria (CC) Mode.
  • V-92897CAT IISamsung Android must be configured to disallow configuration of date and time.
  • V-92899CAT IISamsung Android must be configured to enforce a USB host mode exception list. Note: This configuration allows DeX mode (with input devices), which is DoD-approved for use.
  • V-92901CAT IISamsung Android must be configured to disallow the Share Via List feature.
  • V-92903CAT IISamsung Android must be configured to disallow outgoing beam.
  • V-92905CAT IISamsung Android must be configured to enforce that Wi-Fi Sharing is disabled.
  • V-92907CAT IISamsung Android must be configured to not allow backup of [all applications, configuration data] to locally connected systems.
  • V-92909CAT IISamsung Android must be configured to not allow backup of [all applications, configuration data] to remote systems.
  • V-92911CAT IISamsung Android must be configured to disable developer modes.
  • V-92913CAT IISamsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
  • V-92915CAT ISamsung Android must be configured to enable encryption for data at rest on removable storage media or alternately, the use of removable storage media must be disabled.
  • V-92917CAT IISamsung Android must be configured to enable Certificate Revocation List (CRL) status checking.
  • V-92919CAT IISamsung Android must have the DoD root and intermediate PKI certificates installed.
  • V-92921CAT IIISamsung Android must be configured to display the DoD advisory warning message at startup or each time the user unlocks the device.
  • V-92923CAT ISamsung Android devices must have the latest available Samsung Android operating system installed.
  • V-92925CAT IISamsung Android must be configured to enable the Online Certificate Status Protocol (OCSP).
  • V-92927CAT IISamsung Android must be configured to not enable Microsoft Exchange ActiveSync (EAS) password recovery. This requirement is not applicable if not using Microsoft EAS.
  • V-92929CAT IISamsung Android must be configured to set the password history with a length of 0.
  • V-92931CAT IISamsung Android must be configured to enforce that Secure Startup is enabled. This requirement is Not Applicable (NA) to Galaxy S10 (or newer) devices.
  • V-92933CAT IISamsung Android must be configured to enable a screen-lock policy that will lock the display after a period of inactivity.
  • V-92935CAT IISamsung Android must be configured to enforce that Strong Protection is enabled. This requirement is Not Applicable (NA) for devices older than Galaxy S10.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R4 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.