What changed in Samsung Android 16 COPE STIG V1R4V1R4 changes

Discussion

Some Bluetooth profiles provide the capability for remote transfer of sensitive DODDoW data without encryption or otherwise do not meet DODDoW IT security policies and therefore, must be disabled. SFR ID: FMT_SMF_EXT.1.1/BLUETOOTH BT-8

V-276642 in V1R4

Title

Samsung Android's Work profile must allow only the Administrator (management tool) to perform the following management function: Install/remove DODDoW root and intermediate PKI certificates.

Check text

COPE: Review the configuration to determine if the Samsung Android devices' Work profile is preventing users from removing DODDoW root and intermediate PKI certificates. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the Work profile restrictions, verify "Configure credentials" is set to "Disallow". On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> View security certificates. 2. In the System tab, verify no listed certificate in the Work profile can be untrusted. 3. In the User tab, verify no listed certificate in the Work profile can be removed. If on the management tool the device "Configure credentials" is not set to "Disallow", or on the Samsung Android device a certificate can be untrusted or removed, this is a finding. COBO: Review the configuration to determine if the Samsung Android devices are preventing users from removing DODDoW root and intermediate PKI certificates. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions, verify "Configure credentials" is set to "Disallow". On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> View security certificates. 2. In the System tab, verify no listed certificate in the device can be untrusted. 3. In the User tab, verify no listed certificate in the device can be removed. If on the management tool in the device restrictions "Configure credentials" is not set to "Disallow", or on the Samsung Android device a certificate can be untrusted or removed, this is a finding.

Fix text

COPE: Configure the Samsung Android devices' Work profile to prevent users from removing DODDoW root and intermediate PKI certificates. On the management tool, in the Work profile restrictions, set "Configure credentials" to "Disallow". COBO: Configure the Samsung Android devices to prevent users from removing DODDoW root and intermediate PKI certificates. On the management tool, in the device restrictions, set "Configure credentials" to "Disallow". API: addUserRestriction, DISALLOW_CONFIG_CREDENTIALS

Discussion

DODDoW root and intermediate PKI certificates are used to verify the authenticity of PKI certificates of users and web services. If the user is allowed to remove root and intermediate certificates, the user could allow an adversary to falsely sign a certificate in such a way that it could not be detected. Restricting the ability to remove DODDoW root and intermediate PKI certificates to the Administrator mitigates this risk. SFR ID: FMT_MOF_EXT.1.2 #47

V-276643 in V1R4

Discussion

Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events. Periodically synchronizing internal clocks with an authoritative time source is necessary to correctly correlate the timing of events that occur across the enterprise. The three authoritative time sources for Samsung Android are an authoritative time server that is synchronized with redundant United States Naval Observatory (USNO) time servers as designated for the appropriate DODDoW network (NIPRNet or SIPRNet), the Global Positioning System (GPS), or the wireless carrier. Time stamps generated by the audit system in Samsung Android must include both date and time. The time may be expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC. SFR ID: FMT_MOF_EXT.1.2 #47

V-276644 in V1R4

Check text

This is a "User-Based Enforcement (UBE)" control. Check a sample of Samsung phones at the site and verify the Wi-Fi hotspot preshared key (password) is set to "WPA2/WPA3-Personal" or "WPA3-Personal". -1. Go to Settings >> Connections >> Mobile Hotspot and Tethering >> Mobile Hotspot. -2. Select Network name >> Password >> Band. -3. Click the "Security" link, and verify either "WPA2/WPA3-Personal" orhas "WPA3-Personal" have been selected. If the Wi-Fi hotspot security is not set to "WPA2/WPA3-Personal" or "WPA3-Personal", this is a finding.

Fix text

This is a "User-Based Enforcement (UBE)" control. Train users to not change the default Wi-Fi hotspot security setting: 15-character complex Wi-Fi hotspot preshared key (password) ("WPA2/WPA3-Personal" or WPA3-Personal"). (KNOX-16-009400). If the required preshared key is not set up, train users to use the following procedure to set up the required setting: -1. Go to Settings >> Network & Internet >> Hotspot & tethering. -2. Enable "Wi-Fi hotspot". -3. Tap on "Wi-Fi Hotspot" to the left of the slide to bring up the configuration options. -4. Click the "Security" link and select "WPA2/WPA3-Personal" or "WPA3-Personal". API: addUserRestriction, DISALLOW_CONFIG_TETHERING

V-276645 in V1R4

Discussion

App data sharing gives apps the ability to access the data of other apps for enhanced user functionality. However, sharing also poses a significant risk that unauthorized users or apps will obtain access to DODDoW sensitive information. To mitigate this risk, there are data sharing restrictions, primarily from sharing data from personal (unmanaged) apps and work (managed) apps. If a user is allowed to make exceptions to the data sharing restriction policy, the user could enable unauthorized sharing of data, leaving it vulnerable to breach. Limiting the granting of exceptions to either the Administrator or common application developer mitigates this risk. Copy/paste of data between applications in different application processes or groups of application processes is considered an exception to the access control policy and therefore, the Administrator must be able to enable/disable the feature. Other exceptions include allowing any data or application sharing between process groups. SFR ID: FMT_SMF.1.1 #42, FDP_ACF_EXT.1.2

V-276646 in V1R4

Discussion

Developer modes expose features of the MOS that are not available during standard operation. An adversary may leverage a vulnerability inherent in a developer mode to compromise the confidentiality, integrity, and availability of DODDoW sensitive information. Disabling developer modes mitigates this risk. SFR ID: FMT_SMF.1.1 #26

V-276647 in V1R4

Discussion

This feature must be disabled in order to comply with DODDoW electronic records retention requirements for mobile devices. Otherwise, mobile device users could wipe the device, which would violate DODDoW policy. SFR ID: FMT_MOF_EXT.1.2 #47

V-276648 in V1R4

Title

Samsung Android must be configured to enforce an application installation policy by specifying one or more authorized application repositories, including DODDoW-approved commercial app repository, management tool server, or mobile application store.

Discussion

Forcing all applications to be installed from authorized application repositories can prevent unauthorized and malicious applications from being installed and executed on mobile devices. Allowing such installations and executions could cause a compromise of DODDoW data accessible by these unauthorized/malicious applications. SFR ID: FMT_SMF.1.1 #8

V-276649 in V1R4

Discussion

Backups to remote systems (including cloud backup) can leave data vulnerable to breach on the external systems, which often offer less protection than the MOS. Where the remote backup involves a cloud-based solution, the backup capability is often used to synchronize data across multiple devices. In this case, DODDoW devices may synchronize DODDoW sensitive information to a user's personal device or other unauthorized computers that are vulnerable to breach. The Data Sync Framework allows apps to synchronize data between the mobile device and other web-based services. This uses accounts for services the user has added to the mobile device. Preventing the user from adding accounts to the device mitigates this risk. For COBO/COPE (work profile) data cannot be backed up remotely via Backup Services. Work (profile) data could be backed up thru adding an account to an app that supports the data sync framework; however, this is mitigated by preventing adding any accounts to the Work profile. SFR ID: FMT_SMF_EXT.1.1 #40 SFR ID: FMT_SMF.1.1 #40

V-276650 in V1R4

Discussion

If the user is able to add a personal email account (POP3, IMAP, EAS) to the work email app, it could be used to forward sensitive DODDoW data to unauthorized recipients. Restricting email account addition to the Administrator or to allow-listed accounts mitigates this vulnerability. SFR ID: FMT_MOF_EXT.1.2 #47

V-276651 in V1R4

Discussion

Wireless printing allows the printing of sensitive DODDoW documents to non-DODDoW controlled printers, which may lead to the exposure of sensitive DODDoW information. SFR ID: FMT_MOF_EXT.1.2 #47

V-276653 in V1R4

Discussion

Ad hoc wireless client-to-client connections allow mobile devices to communicate with each other directly, circumventing network security policies and making the traffic invisible. This could allow the exposure of sensitive DODDoW data and increase the risk of downloading and installing malware of the DODDoW mobile device. SFR ID: FMT_SMF_EXT.1.1/WLAN

V-276656 in V1R4

Title

Samsung Android's Work profile must have the DODoW root and intermediate PKI certificates installed.

Check text

COPE: Review the configuration to determine if the Samsung Android's Work profile has the DODDoW root and intermediate PKI certificates installed. This validation procedure is performed on both the management tool and the Samsung Android device. The current DODDoW root and intermediate PKI certificates may be obtained in self-extracting zip files at https://cyber.mil/pki-pke (for NIPRNet). On the management tool, in the Work profile policy management, verify the DODDoW root and intermediate PKI certificates are installed. On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> View security certificates. 2. In the User tab, verify the DODDoW root and intermediate PKI certificates are listed in the Work profile. If on the management tool the DODDoW root and intermediate PKI certificates are not listed in the Work profile, or on the Samsung Android device the DODDoW root and intermediate PKI certificates are not listed in the Work profile, this is a finding. COBO: Review the configuration to determine if the Samsung Android devices have the DODDoW root and intermediate PKI certificates installed. This validation procedure is performed on both the management tool and the Samsung Android device. The current DODDoW root and intermediate PKI certificates may be obtained in self-extracting zip files at https://cyber.mil/pki-pke (for NIPRNet). On the management tool, in the device policy management, verify the DODDoW root and intermediate PKI certificates are installed. On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> View security certificates. 2. In the User tab, verify the DODDoW root and intermediate PKI certificates are listed in the device. If on the management tool the DODDoW root and intermediate PKI certificates are not listed in the device, or on the Samsung Android device the DODDoW root and intermediate PKI certificates are not listed in the device, this is a finding.

Fix text

Install the DODDoW root and intermediate PKI certificates into the Samsung Android devices (install in Work profile for COPE). The current DODDoW root and intermediate PKI certificates may be obtained in self-extracting zip files at https://cyber.mil/pki-pke (for NIPRNet). On the management tool, in the device policy management (Work profile for COPE), install the DODDoW root and intermediate PKI certificates. API: installCaCert

Discussion

DODDoW root and intermediate PKI certificates are used to verify the authenticity of PKI certificates of users and web services. If the root and intermediate certificates are not available, an adversary could falsely sign a certificate in such a way that it could not be detected. Providing access to the DODDoW root and intermediate PKI certificates greatly diminishes the risk of this attack. SFR ID: FMT_MOF_EXT.1.2 #47

V-276658 in V1R4

Discussion

The system application disable list controls user access to/execution of all core and preinstalled applications. Core application: Any application integrated into Samsung Android 16 by Samsung. Preinstalled application: Additional noncore applications included in the Samsung Android 16 build by Samsung or the wireless carrier. Some system applications can compromise DODDoW data or upload users' information to non-DODDoW-approved servers. A user must be blocked from using such applications that exhibit behavior that can result in compromise of DODDoW data or DODDoW user information. The site administrator must analyze all preinstalled applications on the device and disable all applications not approved for DODDoW use by configuring the system application disable list. SFR ID: FMT_SMF.1.1 #47

V-276659 in V1R4

Discussion

Certificate-based security controls depend on the ability of the system to verify the validity of a certificate. If the MOS were to accept an invalid certificate, it could take unauthorized actions, resulting in unanticipated outcomes. At the same time, if the MOS were to disable functionality when it could not determine the validity of the certificate, this could result in a denial of service. Therefore, the ability to provide exceptions is appropriate to balance the tradeoff between security and functionality. Always accepting certificates when they cannot be determined to be valid is the most extreme exception policy and is not appropriate in the DODDoW context. Involving an Administrator or user in the exception decision mitigates this risk to some degree. SFR ID: FIA_X509_EXT_2.2

V-276661 in V1R4

Title

Samsung Android must be configured to display the DODoW advisory warning message at startup or each time the user unlocks the device.

Check text

Confirm if Method #1 or #2 is used at the Samsung device site and follow the appropriate procedure. This validation procedure is performed on both the management tool and the Samsung Android device. Validation procedure for Method #1: Place the DODDoW warning banner in the user agreement signed by each Samsung Android device user (preferred method). Review the signed user agreements for several Samsung Android device users and verify the agreement includes the required DODDoW warning banner text. Validation procedure for Method #2 (preferred method): Configure the warning banner text in the Lock screen message on each managed mobile device. On the management tool, in the device restrictions section, verify "Lock Screen Message" is set to the DODDoW-mandated warning banner text. On the Samsung Android device, verify the required DODDoW warning banner text is displayed on the Lock screen. If the warning text has not been placed in the signed user agreement, or if on the management tool "Lock Screen Message" is not set to the DODDoW-mandated warning banner text, or on the Samsung Android device the required DODDoW warning banner text is not displayed on the Lock screen, this is a finding.

Fix text

Configure the DODDoW warning banner by either of the following methods (required text is found in the Vulnerability Description): Method #1: Place the DODDoW warning banner in the user agreement signed by each Samsung Android device user (preferred method). Method #2 (preferred method): Configure the warning banner text in the Lock screen message on each managed mobile device. On the management tool, in the device restrictions section, set "Lock Screen Message" to the DODDoW-mandated warning banner text. API: setDeviceOwnerLockScreenInfo

Discussion

Before granting access to the system, the mobile operating system is required to display the DODDoW-approved system use notification message or banner that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. Required banners help ensure that DODDoW can audit and monitor the activities of mobile device users without legal restriction. System use notification messages can be displayed when individuals first access or unlock the mobile device. The banner must be implemented as a "click-through" banner at device unlock (to the extent permitted by the operating system). A "click-through" banner prevents further activity on the information system unless and until the user executes a positive action to manifest agreement by clicking on a box indicating "OK." The approved DODDoW text must be used exactly as required in the Knowledge Service referenced in DODI 8500.01. For devices accommodating banners of 1300 characters, the banner text is: You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE, or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. Refer to User Agreement for details. For devices with severe character limitations, the banner text is: I've read & consent to terms in IS user agreem't. The Administrator must configure the banner text exactly as written without any changes. SFR ID: FMT_SMF.1.1 #36

V-276663 in V1R4

Discussion

Note: This requirement is Not Applicable for specific biometric authentication factors included in the product's Common Criteria evaluation. The biometric factor can be used to authenticate the user to unlock the mobile device. Unapproved/evaluated biometric mechanisms could allow unauthorized users to have access to DODDoW sensitive data if compromised. By not permitting the use of unapproved/evaluated biometric authentication mechanisms, this risk is mitigated. SFR ID: FMT_SMF.1.1 #22, FIA_UAU.5.1

V-276664 in V1R4

Check text

Review the management tool to confirm Phone Hub has been disabled. On the management tool: 1. Open "Nearby notification streaming policy". 2. Verify "Nearby notification streaming policy" is set to "Disabled". 3. Open "Nearby app streaming policy". 4. Verify "Nearby app streaming policy" is set to "Disabled". If on the management tool the "Nearby Streaming Policy" is not set to "Disabled", this is a finding. Note: From a Chromebook, if a device is connected to the Phone Hub, try to set up the Notifications. It will fail to connect to the device to complete the setup if Phone Hub has been disabled on the DODDoW Android device.

Discussion

It may be possible to transfer work profile data on a DODDoW Android device to an unauthorized Chromebook if the user has the same Google Account set up on the Chromebook. This may result in the exposure of sensitive DODDoW data. SFR ID: FMT_MOF_EXT.1.2 #47

V-276669 in V1R4

Discussion

The feature screen capture could lead to the exposure of sensitive DODoW information. SFR ID: FMT_MOF_EXT.1.2 #47

V-276673 in V1R4

Discussion

If a user is able to configure the security setting, the user could inadvertently or maliciously set it to a value that poses unacceptable risk to DODDoW information systems. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DODDoW sensitive information. SFR ID: FMT_MOF_EXT.1.2 #24

V-276675 in V1R4

Discussion

Sensitive DODoW data could be exposed when an AI app processes device data in the cloud. SFR ID: FMT_SMF.1.1 #8

V-276677 in V1R4

Discussion

The application allowlist, in addition to controlling the installation of applications on the MD, must control user access/execution of all core and preinstalled applications, or the MD must provide an alternate method of restricting user access/execution to core and preinstalled applications. Core application: Any application integrated into the OS by the OS or MD vendors. Preinstalled application: Additional noncore applications included in the OS build by the OS vendor, MD vendor, or wireless carrier. Requiring all authorized applications to be in an application allowlist prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the allowlist. Failure to configure an application allowlist properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DODDoW data accessible by these applications. The application allowlist, in addition to controlling the installation of applications on the MD, must control user access/execution of all core applications (included in the OS by the OS vendor) and preinstalled applications (provided by the MD vendor and wireless carrier), or the MD must provide an alternate method of restricting user access/execution to core and preinstalled applications. SFR ID: FMT_SMF.1.1 #8

V-276722 in V1R4

Title

Samsung Android's Work profile must be configured to not allow installation of applications with the following characteristics: - Back up MD data to non-DODDoW cloud servers (including user and application access to cloud backup services); - Transmit MD diagnostic data to non-DODDoW servers; - Voice assistant application if available when MD is locked; - Voice dialing application if available when MD is locked; - Allows synchronization of data or applications between devices associated with user; and - Allows unencrypted (or encrypted but not FIPS 140-2/140-3-validated) data sharing with other MDs or printers. - Apps that backup their own data to a remote system. - Apps that render TV shows and movies.

Fix text

The authorizing official (AO) must not approve applications with the following characteristics for installation by users in the Work profile: - Back up MD data to non-DODDoW cloud servers (including user and application access to cloud backup services); - Transmit MD diagnostic data to non-DODDoW servers; - Voice assistant application if available when MD is locked; - Voice dialing application if available when MD is locked; - Allows synchronization of data or applications between devices associated with user; - Payment processing; and - Allows unencrypted (or encrypted but not FIPS 140-2/140-3-validated) data sharing with other MDs, display screens (screen mirroring), or printers. - Apps that backup their own data to a remote system. - Apps that render TV shows and movies. Implement managed Google Play (refer to requirement KNOX-16-005500).

Discussion

Requiring all authorized applications to be in an application allowlist prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the allowlist. Failure to configure an application allowlist properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DODDoW data accessible by these applications. Applications with the listed characteristics have features that can cause the compromise of sensitive DODDoW data or have features with no known application in the DODDoW environment. Application note: The application allowlist, in addition to controlling the installation of applications on the MD, must control user access/execution of all core and preinstalled applications, or the MD must provide an alternate method of restricting user access/execution to core and preinstalled applications. Core application: Any application integrated into the OS by the OS or MD vendors. Preinstalled application: Additional noncore applications included in the OS build by the OS vendor, MD vendor, or wireless carrier. SFR ID: FMT_SMF.1.1 #8

V-276723 in V1R4

Check text

Review the configuration to determine if the Samsung Android devices are enrolled in a DODDoW-approved use case. This validation procedure is performed on both the management tool Administration Console and the Samsung Android device. On the management tool, verify the default enrollment is set to "Work profile for company-owned devices". On the Samsung Android device: 1. Open Settings >> Security and privacy >> More security settings >> Device admin apps. 2. Verify the management tool Agent is listed. 3. Go to the app drawer. 4. Verify a "Personal" and "Work" tab are present. If on the management tool the default enrollment is not set as "Work profile for company-owned devices", or on the Samsung Android device the "Personal" and "Work" tabs are not present or the management tool Agent is not listed, this is a finding.

Fix text

Enroll the Samsung Android devices in a DODDoW-approved use case. On the management tool, configure the default enrollment as "Work profile for company-owned devices". Refer to the management tool documentation to determine how to configure the device enrollment.

V-276739 in V1R4

Fix text

Have all Samsung device users complete training on the following topics. Users should acknowledge they have reviewed training via a signed User Agreement or similar written record. Training topics: - Operational security concerns introduced by unmanaged applications/unmanaged personal space including applications using Global Positioning System (GPS) tracking. - Need to ensure no DODDoW data is saved to the personal space or transmitted from a personal app (for example, from personal email). - If the Purebred key management app is used, users are responsible for maintaining positive control of their credentialed device at all times. The DODDoW PKI certificate policy requires subscribers to maintain positive control of the devices that contain private keys and report any loss of control so the credentials can be revoked. Upon device retirement, turn-in, or reassignment, ensure a factory data reset is performed prior to device hand-off. Follow Mobility service provider decommissioning procedures as applicable. How to configure the following UBE controls (users must configure the control) on the Samsung device: 1. Secure use of Calendar Alarm. 2. Local screen mirroring and MirrorLink procedures (authorized/not authorized for use). 3. Do not connect Samsung devices (via either DeX Station or dongle) to any DODDoW network via Ethernet connection. 4. Do not upload DODDoW contacts via smart call and caller ID services. 5. Do not configure a DODDoW network (work) VPN profile on any third-party VPN client installed in the personal space. 6. If Bluetooth connections are approved for mobile device, types of allowed connections (for example car hands-free, but not Bluetooth wireless keyboard). 7. How to perform a full device wipe. 8. Use default Wi-Fi hotspot password: 15-character complex Wi-Fi hotspot preshared password enabled ("WPA2/WPA3-personal"). AO guidance on acceptable use and restrictions, if any, on downloading and installing personal apps and data (music, photos, etc.) in the Samsung device personal space.

Discussion

The security posture of Samsung devices requires the device user to configure several required policy rules on their device. User-Based Enforcement (UBE) is required for these controls. In addition, if the authorizing official (AO) has approved the use of an unmanaged personal space, the user must receive training on risks. If a user is not aware of their responsibilities and does not comply with UBE requirements, the security posture of the Samsung mobile device may become compromised, and DODDoW sensitive data may become compromised. SFR ID: FMT_MOF_EXT.1.2 #47

V-276740 in V1R4

Discussion

DODDoW mobile devices are in constant risk of cyber threats. MTD apps mitigate these risks by providing real-time threat detection, malware prevention, and vulnerability analysis. SFR ID: FMT_MOF_EXT.1.2 #47

V-276743 in V1R4

Discussion

Authorizing official (AO) approval is required before the mobile device camera can be enabled for a specific user or group of users, based on a risk assessment of the operational environment. Camera use may lead to the exposure of sensitive DODDoW information in some operational environment. SFR ID: FMT_MOF_EXT.1.2 #47

V-276744 in V1R4

Discussion

Wi-Fi Aware allows direct connections between nearby devices for fast data transfer, video streaming, and multiplayer gaming. It allows full peer-to-peer device discovery and communication where two or more devices are publishing and/or subscribing to the same known service name. There is risk that sensitive DODDoW information could be transferred from a DODDoW mobile device to a non-DODDoW device or from Work Profile apps on a DODDoW device to Personal Profile apps on a Non-DODDoW device.

V-279247 in V1R4