Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Objective ID
Severity
Discussion
medium
Alerts providing notification of a change in enrollment state facilitate verification of the correct operation of security functions. When an UEM server receives such an alert from an UEM Agent, it indicates the security policy may no longer be enforced on the mobile device. This enables the UEM administrator to take an appropriate remedial action.
Satisfies: FAU_ALT_EXT.2.1
Reference: PP-MDMA-200100, PP-MDMA-200200, PP-MDMA-200300
Satisfies: FAU_ALT_EXT.2.1
Reference: PP-MDMA-200100, PP-MDMA-200200, PP-MDMA-200300
medium
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one.
Audit records can be generated from various components within the application (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records.
DoW has defined the list of events for which the application will provide an audit record generation capability as the following:
(i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels);
(ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities or other system level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and
(iii) All account creation, modification, disabling, and termination actions.
DoW Required auditable events include:
- Change in enrollment status
- Failure to apply policies to a mobile device
- Start up and shut down of the MDM System
- All administrative actions
- Commands issued to the MDM Agent.
Satisfies: FAU_GEN.1.1/AGENT
Audit records can be generated from various components within the application (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records.
DoW has defined the list of events for which the application will provide an audit record generation capability as the following:
(i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels);
(ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities or other system level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and
(iii) All account creation, modification, disabling, and termination actions.
DoW Required auditable events include:
- Change in enrollment status
- Failure to apply policies to a mobile device
- Start up and shut down of the MDM System
- All administrative actions
- Commands issued to the MDM Agent.
Satisfies: FAU_GEN.1.1/AGENT
medium
Audit logs and alerts enable monitoring of security-relevant events and subsequent forensics when breaches occur. They help identify when the security posture of the device is not as expected. This enables the UEM administrator to take an appropriate remedial action.
Satisfies: FMT_SMF_EXT.4.1
Reference: PP-MDMA-200700
Satisfies: FMT_SMF_EXT.4.1
Reference: PP-MDMA-200700
medium
Audit logs enable monitoring of security-relevant events and subsequent forensics when breaches occur. For audit logs to be useful, administrators must have the ability to view them.
Satisfies: FAU_GEN.1.2/AGENT
Satisfies: FAU_GEN.1.2/AGENT
medium
It is critical that the UEM agent only use validated certificates for policy updates. Otherwise, there is no assurance that a malicious actor has not inserted itself in the process of packaging the code or policy.
Satisfies: FMT_POL_EXT.2.2
Satisfies: FMT_POL_EXT.2.2
medium
If validated secure storage locations are not used for keys, they could be compromised.
Satisfies: FCS_STG_EXT.4.1
Satisfies: FCS_STG_EXT.4.1
medium
Alerts providing notification of a change in enrollment state facilitate verification of the correct operation of security functions. When an UEM server receives such an alert from an UEM Agent, it indicates the security policy may no longer be enforced on the mobile device. This enables the UEM administrator to take an appropriate remedial action.
Satisfies: FAU_ALT_EXT.2.2
Satisfies: FAU_ALT_EXT.2.2
medium
Audit logs and alerts enable monitoring of security-relevant events and subsequent forensics when breaches occur. They help identify when the security posture of the device is not as expected. This enables the UEM administrator to take an appropriate remedial action. MD audit logs must be transferred to an audit management service so they can be analyzed and acted on.
Satisfies: FMT_SMF_EXT.4.1
Reference: PP-MDMA-200800
Satisfies: FMT_SMF_EXT.4.1
Reference: PP-MDMA-200800
medium
It is critical that the UEM agent only use validated certificates for policy updates. Otherwise, there is no assurance that a malicious actor has not inserted itself in the process of packaging the code or policy.
Satisfies: FMT_POL_EXT.2.1
Satisfies: FMT_POL_EXT.2.1
medium
It is critical that the UEM agent only use validated certificates for policy updates. Otherwise, there is no assurance that a malicious actor has not inserted itself in the process of packaging the code or policy.
Satisfies: FMT_SMF_EXT.4.1
Satisfies: FMT_SMF_EXT.4.1
medium
Audit logs enable monitoring of security-relevant events and subsequent forensics when breaches occur. For audit logs to be useful, administrators must have the ability to view them.
Satisfies: FIA_ENR_EXT.2.1
Satisfies: FIA_ENR_EXT.2.1
medium
Access control of mobile devices to DoW sensitive information or access to DoW networks must be controlled so that DoW data will not be compromised. The primary method of access control of mobile devices is via enrollment of authorized mobile devices on the UEM server. Therefore, the UEM server must have the capability to enforce a policy for this control.
Satisfies: FMT_SMF_EXT.4.2
Satisfies: FMT_SMF_EXT.4.2
medium
Access control of mobile devices to DoW sensitive information or access to DoW networks must be controlled so that DoW data will not be compromised. The primary method of access control of mobile devices is via enrollment of authorized mobile devices on the UEM server. Therefore, the UEM server must have the capability to enforce a policy for this control.
Satisfies: FMT_UNR_EXT.1.1
Satisfies: FMT_UNR_EXT.1.1
high
Unapproved cryptographic algorithms cannot be relied on to provide confidentiality or integrity, and DoW data could be compromised as a result. The most common vulnerabilities with cryptographic modules are those associated with poor implementation. FIPS 140-3 validation provides assurance that the relevant cryptography has been implemented correctly. FIPS 140-3 validation is also a strict requirement for use of cryptography in the federal government for protecting unclassified data.
This requirement also applies to Zero Trust initiatives.
Satisfies: FCS
Reference: PP-MDMA-200600
This requirement also applies to Zero Trust initiatives.
Satisfies: FCS
Reference: PP-MDMA-200600