What changed in Unified Endpoint Management Agent Security Requirements Guide V2R2V2R2 changes

Discussion

Alerts providing notification of a change in enrollment state facilitate verification of the correct operation of security functions. When an UEM server receives such an alert from an UEM Agent, it indicates the security policy may no longer be enforced on the mobile device. This enables the UEM administrator to take an appropriate remedial action. Satisfies: FAU_ALT_EXT.2.1 Reference: PP-UEMMDMA-402001200100, PP-UEMMDMA-402002200200, PP-MDMMDMA-402003200300

V-234235 in V2R2

Discussion

Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. Audit records can be generated from various components within the application (e.g., process, module). Certain specific application functionalities may be audited as well. The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. DoDDoW has defined the list of events for which the application will provide an audit record generation capability as the following: (i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); (ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities or other system level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the information system; and (iii) All account creation, modification, disabling, and termination actions. DoDDoW Required auditable events include: - Change in enrollment status - Failure to apply policies to a mobile device - Start up and shut down of the MDM System - All administrative actions - Commands issued to the MDM Agent. Satisfies: FAU_GEN.1.1(2) Refinement/AGENT

V-234236 in V2R2

Discussion

Audit logs and alerts enable monitoring of security-relevant events and subsequent forensics when breaches occur. They help identify when the security posture of the device is not as expected. This enables the UEM administrator to take an appropriate remedial action. Satisfies: FMT_SMF_EXT.4.1 Reference: PP-UEMMDMA-401005200700

V-234237 in V2R2

Discussion

Audit logs enable monitoring of security-relevant events and subsequent forensics when breaches occur. For audit logs to be useful, administrators must have the ability to view them. Satisfies: FAU_GEN.1.2(2) Refinement/AGENT

V-234238 in V2R2

Discussion

If validated secure storage locations are not used for keys, they could be compromised. Satisfies: FCS_STG_EXT.4.1(2)

V-234240 in V2R2

Discussion

Audit logs and alerts enable monitoring of security-relevant events and subsequent forensics when breaches occur. They help identify when the security posture of the device is not as expected. This enables the UEM administrator to take an appropriate remedial action. MD audit logs must be transferred to an audit management service so they can be analyzed and acted on. Satisfies: FMT_SMF_EXT.4.1 Reference: PP-UEMMDMA-401006200800

V-234242 in V2R2

Discussion

Access control of mobile devices to DoDDoW sensitive information or access to DoDDoW networks must be controlled so that DoDDoW data will not be compromised. The primary method of access control of mobile devices is via enrollment of authorized mobile devices on the UEM server. Therefore, the UEM server must have the capability to enforce a policy for this control. Satisfies: FMT_SMF_EXT.4.2

V-234246 in V2R2

Discussion

Access control of mobile devices to DoDDoW sensitive information or access to DoDDoW networks must be controlled so that DoDDoW data will not be compromised. The primary method of access control of mobile devices is via enrollment of authorized mobile devices on the UEM server. Therefore, the UEM server must have the capability to enforce a policy for this control. Satisfies: FMT_UNR_EXT.1.1

V-234247 in V2R2

Title

All UEM Agent cryptography supporting DODoW functionality must be FIPS 140-2/140-3 validated.

Check text

Verify all UEM Agent cryptography supporting DODDoW functionality is FIPS 140-2/140-3 validated. If all UEM Agent cryptography supporting DODDoW functionality is not FIPS 140-2/140-3 validated, this is a finding.

Fix text

Configure the UEM Agent cryptography supporting DODoW functionality for FIPS 140-2/140-3 mode.

Discussion

Unapproved cryptographic algorithms cannot be relied on to provide confidentiality or integrity, and DODDoW data could be compromised as a result. The most common vulnerabilities with cryptographic modules are those associated with poor implementation. FIPS 140-2/140-3 validation provides assurance that the relevant cryptography has been implemented correctly. FIPS 140-2/140-3 validation is also a strict requirement for use of cryptography in the federal government for protecting unclassified data. This requirement also applies to Zero Trust initiatives. Satisfies: FCS Reference: PP-UEMMDMA-404200 200600

V-234248 in V2R2