STIGQter: STIG Summary: Samsung OS 9 with Knox 3.x COBO Use Case KPE(AE) Deployment Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Apr 2020:

Samsung Android must be configured to disable trust agents. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.

DISA Rule

SV-102971r1_rule

Vulnerability Number

V-92883

Group Title

PP-MDF-301150

Rule Version

KNOX-09-000470

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.
• CCI-000370 - The organization employs automated mechanisms to centrally manage configuration settings for organization-defined information system components.
• CCI-000381 - The organization configures the information system to provide only essential capabilities.

Weight

10

Fix Recommendation

Configure Samsung Android to disable trust agents.

On the MDM console, for the device, in the "Android lock screen restriction" group, select "disable trust agents".

Check Contents

Review device configuration settings to confirm that trust agents are disabled.

This procedure is performed on both the MDM Administration console and the Samsung Android device.

On the MDM console, for the device, in the "Android lock screen restrictions" group, verify that "disable trust agents" is selected.

On the Samsung Android device, do the following:
1. Open Settings.
2. Tap "Biometrics and security".
3. Tap "Other security settings".
4. Tap "Trust agents".
5. Verify that all listed trust agents are disabled and cannot be enabled.

If on the MDM console "disable trust agents" is not selected, or on the Samsung Android device a trust agent can be enabled, this is a finding.

Vulnerability Number

V-92883

Documentable

False

Rule Version

KNOX-09-000470

Severity Override Guidance

Review device configuration settings to confirm that trust agents are disabled.

This procedure is performed on both the MDM Administration console and the Samsung Android device.

On the MDM console, for the device, in the "Android lock screen restrictions" group, verify that "disable trust agents" is selected.

On the Samsung Android device, do the following:
1. Open Settings.
2. Tap "Biometrics and security".
3. Tap "Other security settings".
4. Tap "Trust agents".
5. Verify that all listed trust agents are disabled and cannot be enabled.

If on the MDM console "disable trust agents" is not selected, or on the Samsung Android device a trust agent can be enabled, this is a finding.

Check Content Reference

M

Target Key

3495

Comments