STIGQter: STIG Summary: Samsung OS 9 with Knox 3.x COBO Use Case KPE(AE) Deployment Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Apr 2020:

Samsung Android must be configured to disable Face Recognition. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.

DISA Rule

SV-102973r1_rule

Vulnerability Number

V-92885

Group Title

PP-MDF-301150

Rule Version

KNOX-09-000500

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.
• CCI-000370 - The organization employs automated mechanisms to centrally manage configuration settings for organization-defined information system components.
• CCI-000381 - The organization configures the information system to provide only essential capabilities.

Weight

10

Fix Recommendation

Configure Samsung Android to disable Face Recognition.

On the MDM console, for the device, in the "Android lock screen restriction" group, select "disable face".

Check Contents

Review device configuration settings to confirm that Face Recognition is disabled.

This procedure is performed on both the MDM Administration console and the Samsung Android device.

On the MDM console, for the device, in the "Android lock restrictions" group, verify that "disable face" is selected.

On the Samsung Android device, do the following:
1. Open Settings.
2. Tap "Lock screen".
3. Tap "Screen lock type".
4. Enter current password.
5. Verify that "Face" is disabled and cannot be enabled.

If on the MDM console "disable face" is not selected, or on the Samsung Android device "Face" can be enabled, this is a finding.

Vulnerability Number

V-92885

Documentable

False

Rule Version

KNOX-09-000500

Severity Override Guidance

Review device configuration settings to confirm that Face Recognition is disabled.

This procedure is performed on both the MDM Administration console and the Samsung Android device.

On the MDM console, for the device, in the "Android lock restrictions" group, verify that "disable face" is selected.

On the Samsung Android device, do the following:
1. Open Settings.
2. Tap "Lock screen".
3. Tap "Screen lock type".
4. Enter current password.
5. Verify that "Face" is disabled and cannot be enabled.

If on the MDM console "disable face" is not selected, or on the Samsung Android device "Face" can be enabled, this is a finding.

Check Content Reference

M

Target Key

3495

Comments