What changed in Samsung SDS EMM STIG V1R4V1R4 changes

Title

The Samsung SDS EMM must be configured to display the required DoDDoW warning banner upon administrator logon. Note: This requirement is not applicable if the TOE platform is selected in FTA_TAB.1.1 in the Security Target (ST).

Check text

Review Samsung SDS EMM server documentation and configuration settings to determine if the warning banner is using the appropriate designated wording. On the MDM console, do the following: 1. Log in to the Samsung SDS EMM Server Admin Console using a web browser. 2. Go to Settings >> Admin Console >> Logo Setting. 3. Verify the text in the "Logo/Notification" window that appears. Confirm the text in the Login Notification box is the required DoDDoW banner text. Alternately, verify the banner is correct during logon to the console. If the warning banner is not set up on the Samsung SDS EMM or wording does not exactly match the requirement text, this is a finding.

Fix text

Configure the Samsung SDS EMM to display the appropriate warning banner text. Install Samsung SDS EMM patch 2.2.5.1 Build 200707. On the EMM console, do the following: 1. Log in to the Samsung SDS EMM Server Admin Console using a web browser. 2. Go to Settings >> Admin Console >> Logo Setting and click in the text box and type or paste the DoDDoW banner. 3. Click "Save".

Discussion

Note: The advisory notice and consent warning message is not required if the general purpose OS or network device displays an advisory notice and consent warning message when the administrator logs on to the general purpose OS or network device prior to accessing the Samsung SDS EMM or Samsung SDS EMM platform. Before granting access to the system, the Samsung SDS EMM/server platform is required to display the DoDDoW-approved system use notification message or banner that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. This ensures the legal requirements for auditing and monitoring are met. The approved DoDDoW text must be used as specified in the KS referenced in DoDI 8500.01. The non-bracketed text below must be used without any changes as the warning banner. [A. Use this banner for desktops, laptops, and other devices accommodating banners of 1300 characters. The banner shall be implemented as a click-through banner at logon (to the extent permitted by the operating system), meaning it prevents further activity on the information system unless and until the user executes a positive action to manifest agreement by clicking on a box indicating "OK."] You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details. SFR ID: FMT_SMF.1.1(2) c.2

V-225644 in V1R4

Title

The Samsung SDS EMM must be configured to audit DoDW or site-defined auditable events. Note: See VulDiscussion for a list of DoDW required auditable events.

Discussion

Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. Audit records can be generated from various components within the application (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. DoDDoW has defined the list of events for which the application will provide an audit record generation capability as the following: (i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); (ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities or other system level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and (iii) All account creation, modification, disabling, and termination actions. DoDDoW Required auditable events (from the MDM Protection Profile): - Change in enrollment status - Failure to apply policies to a mobile device - Startup and shutdown of the MDM System - All administrative actions - Commands issued to the MDM Agent, none] - Specifically defined auditable events listed in Table 2 of the MDM Protection Profile SFR ID: FAU_GEN.1.1(1), FMT_SMF.1.1(2)c.8

V-225647 in V1R4

Title

The [selection: Samsung SDS EMM, MDM platform] must have the capability to display the DoDW warning banner prior to establishing a user session.

Check text

Review Samsung SDS EMM server documentation and configuration settings to determine if the warning banner is using the appropriate designated wording. On the MDM console, do the following: 1. Log in to the Admin Console using a web browser. 2. Go to Setting >> Server >> Configuration and click "EULA" at the top of the window. 3. Check the required DoDDoW text in the EULA "Content" box. If the warning banner is not set up on the MDM server or wording does not exactly match the VulDiscussion text, this is a finding.

Fix text

Configure the MDM server to display the appropriate warning banner text. On the MDM console, do the following: 1. Log in to the Admin Console using a web browser. 2. Go to Setting >> Server >> Configuration and click "EULA" on the top of the window. 3. Enter required DoDDoW text in the EULA "Content" box. 4. Click "Save".

Discussion

Display of the DoDDoW-approved use notification before granting access to the application ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for applications that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't." SFR ID: FTA_TAB.1.1, FMT_SMF.1.1(2) c.2

V-225648 in V1R4

Check text

Verify the EMM server has not been configured to use one-time password (OTP) for administrator logon to the server. On the MDM console, do the following: 1. Log into the SDS EMM console. 2. Go to Setting >> Server >> Configuration >> Two-Factor Authentication. 3. Verify Two-Factor Authentication is set to "No". If the EMM server has not been configured to disable one-time-password (OTP) for administrator logon to the server, this is a finding.

Fix text

Use the following procedure for configuring the use of OTP authentication on the EMM server: On the MDM console, do the following: 1. Log into the SDS EMM console. 2. Go to Setting >> Server >> Configuration >> Two-Factor Authentication. 3. Set Two-Factor Authentication to "No". 4. Save setting.

Discussion

Two-factor authentication ensures strong authentication and access controls are in place for privileged accounts. But One-Time Passwords (OTP) do not meet DoDDoW requirements that system administrators access privileged accounts via CAC authentication through a directory service (Active Directory). SFR ID: FIA

V-225649 in V1R4

Title

The Samsung SDS EMM platform must be protected by a DoDW-approved firewall.

Check text

Review the Samsung SDS EMM platform configuration to determine whether a DoDDoW-approved firewall is installed or if the platform operating system provides a firewall service that can restrict both inbound and outbound traffic by TCP/UDP port and IP address. If there is not a host-based firewall present on the Samsung SDS EMM platform, this is a finding.

Fix text

Install a DoDW-approved firewall.

Discussion

Most information systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Unneeded services and processes provide additional threat vectors and avenues of attack to the information system. The Samsung SDS EMM is a critical component of the mobility architecture and must be configured to enable only those ports, protocols, and services (PPS) necessary to support functionality. All others must be expressly disabled or removed. A DoDDoW-approved firewall implements the required network restrictions. A host-based firewall is appropriate where the Samsung SDS EMM runs on a standalone platform. Network firewalls or other architectures may be preferred where the Samsung SDS EMM runs in a cloud or virtualized solution. SFR ID: FMT_SMF.1.1(2) b / CM-7 b Satisfies: SRG-APP-000142, PP-MDM-431004

V-225651 in V1R4

Title

The firewall protecting the Samsung SDS EMM platform must be configured so that only DoDDoW-approved ports, protocols, and services are enabled. See the DoDDOD Ports, Protocols, Services Management [(PPSM]) Category Assurance Levels [(CAL]) list for DoDDoW-approved ports, protocols, and services.

Check text

Ask the MDM administrator for a list of ports, protocols, and services that have been configured on the host-based firewall of the Samsung SDS EMM or generate the list by inspecting the firewall. Verify all allowed ports, protocols, and services are included on the DoDDOD PPSM CAL list. If any allowed ports, protocols, and services on the MDM host-based firewall are not included on the DoDDOD PPSM CAL list, this is a finding.

Fix text

Turn off any ports, protocols, and services on the MDM host-based firewall that are not on the DoOD PPSM CAL list.

Discussion

All ports, protocols, and services used on DoDDoW networks must be approved and registered via the DoDDOD PPSM process. This is to ensure that a risk assessment has been completed before a new port, protocol, or service is configured on a DoDDoW network and has been approved by proper DoDDoW authorities. Otherwise, the new port, protocol, or service could cause a vulnerability to the DoDDoW network, which could be exploited by an adversary. SFR ID: FMT_SMF.1.1(2) b / CM-7 b Satisfies: SRG-APP-000142, PP-MDM-431006

V-225653 in V1R4

Discussion

To ensure accountability and prevent unauthenticated access, privileged users must use multifactor authentication to prevent potential misuse and compromise of the system. Multifactor authentication is defined as using two or more factors to achieve authentication. Factors include: (i) Something a user knows (e.g., password/PIN); (ii) Something a user has (e.g., cryptographic identification device, token); or (iii) Something a user is (e.g., biometric). A privileged account is defined as an information system account with authorizations of a privileged user. Local access is defined as access to an organizational information system by a user (or process acting on behalf of a user) communicating through a direct connection without the use of a network. Applications integrating with the DoDDoW Active Directory and using the DoDDoW CAC are examples of compliant multifactor authentication solutions. SFR ID: FMT_SMF.1(2)b. / IA-2(3) Satisfies: SRG-APP-000151, PP-MDM-991000

V-225657 in V1R4

Title

The Samsung SDS EMM local accounts must be configured with password maximum lifetime of 6180 Days.

Fix text

Configure Samsung SDS EMM local accounts with password maximum lifetime of 60180 Days. On the MDM console, do the following: 1. Log in to the SDS EMM console. 2. Go to Setting >> Server >> Configuration >> Manage Validity Period (Days). 3. Set the Manage Validity Period (Days) to 60180. 4. Save setting.

Discussion

Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed at specific intervals. One method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the system and/or application passwords could be compromised. This requirement does not include emergency administration accounts which are meant for access to the application in case of failure. These accounts are not required to have maximum password lifetime restrictions. SFR ID: FMT_SMF.1(2)b. / IA-5 (1) (d)

V-245528 in V1R4