Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
Samsung Android must be configured to enable Knox Common Criteria (CC) Mode.
Description
Discussion Text
The Knox Platform for Enterprise (KPE) CC Mode feature is a superset of other features and behavioral changes that are mandatory MDFPP requirements. If CC Mode is not implemented, the device will not be operating in the NIAP-certified compliant CC mode of operation.
CC Mode implements the following behavioral/functional changes:
- FOTA signature verification uses additional SHA-512 signature check.
- Download Mode is disabled and all updates will occur via FOTA only.
- IKEv1 operates in Main Mode only.
- HTTPS audit logging in enabled.
- Certificates without a Subject Alternative Name (SAN) field are rejected.
- Certificates that do not pass Strict Host Name verification are rejected.
- Certificates provided by servers must have the Extended Key Usage field set as Server Authentication.
- Allows only authenticated Bluetooth connections.
- Additional Key Zeroization is performed.
Following is the list of prerequisites the user/MDM has to set in addition to calling CC Mode API to be fully compliant with the MDFPP requirements and the Samsung device Common Criteria certification:
- Screen lock type: Alphanumeric or complex of type password, face disabled
- Password Attempts: 1 <= value <= 30 and wipe after exceeding
- No password recovery and history
- Certificate revocation check enabled, OCSP check enabled
- Secure start-up or strong protection enabled
- SD Card encryption enabled
For reference, the STIGIDs for the policies above are as follows:
For KPE(AE):
- KNOX-09-000710: Enable CC mode
- KNOX-09-001440: Minimum password quality
- KNOX-09-000500: Disable face
- KNOX-09-000430/(KNOX-09-000440): Max password failures for local wipe
- KNOX-09-001370/(KNOX-09-001360): Password recovery
- KNOX-09-001390/(KNOX-09-001400): Password history length
- KNOX-09-001050/(KNOX-09-001040): Revocation check
- KNOX-09-001340/(KNOX-09-001330): OCSP check
- KNOX-09-001420: Secure Startup
- KNOX-09-000980: Enable external storage encryption or disallow mount physical media
For KPE(Legacy): Add '5' to the end of the requirement number for above and in addition:
- KNOX-09-001475: Minimum password quality for workspace
Note: STIGIDs listed above not in parentheses are personal space requirements. STIGIDs in parentheses are workspace requirements.
SFR ID: FMT_SMF_EXT.1.1 #47
CC Mode implements the following behavioral/functional changes:
- FOTA signature verification uses additional SHA-512 signature check.
- Download Mode is disabled and all updates will occur via FOTA only.
- IKEv1 operates in Main Mode only.
- HTTPS audit logging in enabled.
- Certificates without a Subject Alternative Name (SAN) field are rejected.
- Certificates that do not pass Strict Host Name verification are rejected.
- Certificates provided by servers must have the Extended Key Usage field set as Server Authentication.
- Allows only authenticated Bluetooth connections.
- Additional Key Zeroization is performed.
Following is the list of prerequisites the user/MDM has to set in addition to calling CC Mode API to be fully compliant with the MDFPP requirements and the Samsung device Common Criteria certification:
- Screen lock type: Alphanumeric or complex of type password, face disabled
- Password Attempts: 1 <= value <= 30 and wipe after exceeding
- No password recovery and history
- Certificate revocation check enabled, OCSP check enabled
- Secure start-up or strong protection enabled
- SD Card encryption enabled
For reference, the STIGIDs for the policies above are as follows:
For KPE(AE):
- KNOX-09-000710: Enable CC mode
- KNOX-09-001440: Minimum password quality
- KNOX-09-000500: Disable face
- KNOX-09-000430/(KNOX-09-000440): Max password failures for local wipe
- KNOX-09-001370/(KNOX-09-001360): Password recovery
- KNOX-09-001390/(KNOX-09-001400): Password history length
- KNOX-09-001050/(KNOX-09-001040): Revocation check
- KNOX-09-001340/(KNOX-09-001330): OCSP check
- KNOX-09-001420: Secure Startup
- KNOX-09-000980: Enable external storage encryption or disallow mount physical media
For KPE(Legacy): Add '5' to the end of the requirement number for above and in addition:
- KNOX-09-001475: Minimum password quality for workspace
Note: STIGIDs listed above not in parentheses are personal space requirements. STIGIDs in parentheses are workspace requirements.
SFR ID: FMT_SMF_EXT.1.1 #47
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.