What changed in Samsung Android OS 9 with Knox 3.x COPE Use Case KPE(AE) Deployment STIG V1R4V1R4 changes

Samsung Android OS 9 with Knox 3.x COPE Use Case KPE(AE) Deployment STIG V1R4 (2022-07-27) replaced V1R3 (2020-04-24): 50 checks added, 49 removed. It has 50 checks, against 49 in V1R3.

V1R4 checklistV1R3 checklist Compare V1R3 and V1R4 in STIG Compare

  • 50 added
  • 49 removed
  • 0 updated

Added in V1R4 (50)

  • V-217742CAT IIThe Samsung Android Workspace must be configured to prevent users from adding personal email accounts to the work email app.
  • V-217743CAT IISamsung Android must be configured to enforce the system application disable list.
  • V-217744CAT IISamsung Android Workspace must be configured to enforce the system application disable list.
  • V-217745CAT IISamsung Android Workspace must be configured to enforce an application installation policy by specifying an application whitelist that restricts applications by the following characteristics: list of digital signatures, list of package names.
  • V-217746CAT IIThe Samsung Android whitelist must be configured to not include applications with the following characteristic: - transmit MD diagnostic data to non-DoD servers.
  • V-217747CAT IIThe Samsung Android Workspace whitelist must be configured to not include applications with the following characteristics: - back up MD data to non-DoD cloud servers (including user and application access to cloud backup services); - transmit MD diagnostic data to non-DoD servers; - voice assistant application if available when MD is locked; - voice dialing application if available when MD is locked; - allows synchronization of data or applications between devices associated with user; and - allows unencrypted (or encrypted but not FIPS 140-2 validated) data sharing with other MDs or printers.
  • V-217748CAT IISamsung Android must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [DoD-approved commercial app repository, MDM server, mobile application store]: - disallow unknown app installation sources.
  • V-217749CAT IISamsung Android must be configured to enable the Knox audit log.
  • V-217750CAT IISamsung Android must be configured to disable exceptions to the access control policy that prevents [application processes, groups of application processes] from accessing [all, private] data stored by other [application processes, groups of application processes].
  • V-217751CAT IISamsung Android must be configured to create a Knox Workspace.
  • V-217752CAT IISamsung Android Workspace must be configured to not display the following notifications when the device is locked: all notifications.
  • V-217753CAT IISamsung Android device users must complete required training.
  • V-217754CAT IIAny accessory that provides wired networking capabilities to a Samsung Android device must not be connected to a DoD network (for example: DeX Station [LAN port], USB to Ethernet adapter, etc.).
  • V-217755CAT IIISamsung Android must be configured to enforce a minimum password length of six characters.
  • V-217756CAT IIISamsung Android must be configured to not allow passwords that include more than two repeating or sequential characters.
  • V-217757CAT IISamsung Android must be configured to lock the display after 15 minutes (or less) of inactivity.
  • V-217758CAT IISamsung Android Workspace must be configured to lock after 15 minutes (or less) of inactivity.
  • V-217759CAT IIISamsung Android must be configured to not allow more than 10 consecutive failed authentication attempts.
  • V-217760CAT IIISamsung Android Workspace must be configured to not allow more than 10 consecutive failed authentication attempts.
  • V-217761CAT IISamsung Android must be configured to disable trust agents. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-217762CAT IISamsung Android must be configured to disable Face Recognition. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-217763CAT IISamsung Android Workspace must be configured to disable automatic completion of Samsung Internet browser text input.
  • V-217764CAT IISamsung Android Workspace must be configured to disable the autofill services.
  • V-217765CAT IIISamsung Android must be configured to disable all Bluetooth profiles except HSP (Headset Profile), HFP (HandsFree Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile).
  • V-217766CAT IISamsung Android must be configured to disable USB mass storage mode.
  • V-217767CAT ISamsung Android must be configured to enable Knox Common Criteria (CC) Mode.
  • V-217768CAT IISamsung Android must be configured to disallow configuration of date and time.
  • V-217769CAT IISamsung Android must be configured to enforce a USB host mode exception list. Note: This configuration allows DeX mode (with input devices), which is DoD-approved for use.
  • V-217770CAT IISamsung Android Workspace must be configured to disable the Share Via List feature.
  • V-217771CAT IISamsung Android must be configured to not allow backup of [all applications, configuration data] to locally connected systems.
  • V-217772CAT IISamsung Android Workspace must be configured to not allow backup of [all applications, configuration data] to remote systems.
  • V-217773CAT IISamsung Android must be configured to disable developer modes.
  • V-217774CAT IISamsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
  • V-217775CAT ISamsung Android must be configured to enable encryption for data at rest on removable storage media or alternately, the use of removable storage media must be disabled.
  • V-217776CAT IISamsung Android Workspace must be configured to enable Certificate Revocation List (CRL) status checking.
  • V-217777CAT IISamsung Android must be configured to enable Certificate Revocation List (CRL) status checking.
  • V-217778CAT IISamsung Android Workspace must have the DoD root and intermediate PKI certificates installed.
  • V-217779CAT IISamsung Android must have the DoD root and intermediate PKI certificates installed.
  • V-217780CAT IIISamsung Android must be configured to display the DoD advisory warning message at startup or each time the user unlocks the device.
  • V-217781CAT ISamsung Android devices must have the latest available Samsung Android operating system installed.
  • V-217782CAT IISamsung Android Workspace must be configured to enable the Online Certificate Status Protocol (OCSP).
  • V-217783CAT IISamsung Android must be configured to enable the Online Certificate Status Protocol (OCSP).
  • V-217784CAT IISamsung Android Workspace must be configured to not enable Microsoft Exchange ActiveSync (EAS) password recovery. This requirement is not applicable if not using Microsoft EAS.
  • V-217785CAT IISamsung Android must be configured to not enable Microsoft Exchange ActiveSync (EAS) password recovery. This requirement is not applicable if not using Microsoft EAS.
  • V-217786CAT IISamsung Android must be configured to set the password history with a length of 0.
  • V-217787CAT IISamsung Android Workspace must be configured to set the password history with a length of 0.
  • V-217788CAT IISamsung Android must be configured to enforce that Secure Startup is enabled. This requirement is Not Applicable (NA) to Galaxy S10 (or newer) devices.
  • V-217789CAT IISamsung Android must be configured to enable a screen-lock policy that will lock the display after a period of inactivity.
  • V-217790CAT IISamsung Android must be configured to enforce that Strong Protection is enabled. This requirement is Not Applicable (NA) for devices older than Galaxy S10.
  • V-252906CAT IAll Samsung Android 9 installations must be removed.

Removed since V1R3 (49)

  • V-93747CAT IIThe Samsung Android Workspace must be configured to prevent users from adding personal email accounts to the work email app.
  • V-93749CAT IISamsung Android must be configured to enforce the system application disable list.
  • V-93751CAT IISamsung Android Workspace must be configured to enforce the system application disable list.
  • V-93753CAT IISamsung Android Workspace must be configured to enforce an application installation policy by specifying an application whitelist that restricts applications by the following characteristics: list of digital signatures, list of package names.
  • V-93755CAT IIThe Samsung Android whitelist must be configured to not include applications with the following characteristic: - transmit MD diagnostic data to non-DoD servers.
  • V-93757CAT IIThe Samsung Android Workspace whitelist must be configured to not include applications with the following characteristics: - back up MD data to non-DoD cloud servers (including user and application access to cloud backup services); - transmit MD diagnostic data to non-DoD servers; - voice assistant application if available when MD is locked; - voice dialing application if available when MD is locked; - allows synchronization of data or applications between devices associated with user; and - allows unencrypted (or encrypted but not FIPS 140-2 validated) data sharing with other MDs or printers.
  • V-93759CAT IISamsung Android must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including [DoD-approved commercial app repository, MDM server, mobile application store]: - disallow unknown app installation sources.
  • V-93761CAT IISamsung Android must be configured to enable the Knox audit log.
  • V-93763CAT IISamsung Android must be configured to disable exceptions to the access control policy that prevents [application processes, groups of application processes] from accessing [all, private] data stored by other [application processes, groups of application processes].
  • V-93765CAT IISamsung Android must be configured to create a Knox Workspace.
  • V-93767CAT IISamsung Android Workspace must be configured to not display the following notifications when the device is locked: all notifications.
  • V-93769CAT IISamsung Android device users must complete required training.
  • V-93771CAT IIAny accessory that provides wired networking capabilities to a Samsung Android device must not be connected to a DoD network (for example: DeX Station [LAN port], USB to Ethernet adapter, etc.).
  • V-93773CAT IIISamsung Android must be configured to enforce a minimum password length of six characters.
  • V-93775CAT IIISamsung Android must be configured to not allow passwords that include more than two repeating or sequential characters.
  • V-93777CAT IISamsung Android must be configured to lock the display after 15 minutes (or less) of inactivity.
  • V-93779CAT IISamsung Android Workspace must be configured to lock after 15 minutes (or less) of inactivity.
  • V-93781CAT IIISamsung Android must be configured to not allow more than 10 consecutive failed authentication attempts.
  • V-93783CAT IIISamsung Android Workspace must be configured to not allow more than 10 consecutive failed authentication attempts.
  • V-93785CAT IISamsung Android must be configured to disable trust agents. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-93787CAT IISamsung Android must be configured to disable Face Recognition. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.
  • V-93789CAT IISamsung Android Workspace must be configured to disable automatic completion of Samsung Internet browser text input.
  • V-93791CAT IISamsung Android Workspace must be configured to disable the autofill services.
  • V-93793CAT IIISamsung Android must be configured to disable all Bluetooth profiles except HSP (Headset Profile), HFP (HandsFree Profile), SPP (Serial Port Profile), A2DP (Advanced Audio Distribution Profile), AVRCP (Audio/Video Remote Control Profile), and PBAP (Phone Book Access Profile).
  • V-93795CAT IISamsung Android must be configured to disable USB mass storage mode.
  • V-93797CAT ISamsung Android must be configured to enable Knox Common Criteria (CC) Mode.
  • V-93799CAT IISamsung Android must be configured to disallow configuration of date and time.
  • V-93801CAT IISamsung Android must be configured to enforce a USB host mode exception list. Note: This configuration allows DeX mode (with input devices), which is DoD-approved for use.
  • V-93803CAT IISamsung Android Workspace must be configured to disable the Share Via List feature.
  • V-93805CAT IISamsung Android must be configured to not allow backup of [all applications, configuration data] to locally connected systems.
  • V-93807CAT IISamsung Android Workspace must be configured to not allow backup of [all applications, configuration data] to remote systems.
  • V-93809CAT IISamsung Android must be configured to disable developer modes.
  • V-93811CAT IISamsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
  • V-93813CAT ISamsung Android must be configured to enable encryption for data at rest on removable storage media or alternately, the use of removable storage media must be disabled.
  • V-93815CAT IISamsung Android Workspace must be configured to enable Certificate Revocation List (CRL) status checking.
  • V-93817CAT IISamsung Android must be configured to enable Certificate Revocation List (CRL) status checking.
  • V-93819CAT IISamsung Android Workspace must have the DoD root and intermediate PKI certificates installed.
  • V-93821CAT IISamsung Android must have the DoD root and intermediate PKI certificates installed.
  • V-93823CAT IIISamsung Android must be configured to display the DoD advisory warning message at startup or each time the user unlocks the device.
  • V-93825CAT ISamsung Android devices must have the latest available Samsung Android operating system installed.
  • V-93827CAT IISamsung Android Workspace must be configured to enable the Online Certificate Status Protocol (OCSP).
  • V-93829CAT IISamsung Android must be configured to enable the Online Certificate Status Protocol (OCSP).
  • V-93831CAT IISamsung Android Workspace must be configured to not enable Microsoft Exchange ActiveSync (EAS) password recovery. This requirement is not applicable if not using Microsoft EAS.
  • V-93833CAT IISamsung Android must be configured to not enable Microsoft Exchange ActiveSync (EAS) password recovery. This requirement is not applicable if not using Microsoft EAS.
  • V-93835CAT IISamsung Android must be configured to set the password history with a length of 0.
  • V-93837CAT IISamsung Android Workspace must be configured to set the password history with a length of 0.
  • V-93839CAT IISamsung Android must be configured to enforce that Secure Startup is enabled. This requirement is Not Applicable (NA) to Galaxy S10 (or newer) devices.
  • V-93841CAT IISamsung Android must be configured to enable a screen-lock policy that will lock the display after a period of inactivity.
  • V-93843CAT IISamsung Android must be configured to enforce that Strong Protection is enabled. This requirement is Not Applicable (NA) for devices older than Galaxy S10.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R4 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.