STIGQter STIGQter: STIG Summary: Samsung Android OS 9 with Knox 3.x COPE Use Case KPE(AE) Deployment Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Apr 2020:

Samsung Android Workspace must be configured to lock after 15 minutes (or less) of inactivity.

DISA Rule

SV-103865r1_rule

Vulnerability Number

V-93779

Group Title

PP-MDF-991000

Rule Version

KNOX-09-000410

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure Samsung Android Workspace to lock after 15 minutes (or less) of inactivity.

On the MDM console, for the Workspace, in the "Android lock screen restriction" group, set the "max time to screen lock" to "15" minutes.

Check Contents

Review the Samsung Android Workspace configuration settings to confirm that the Workspace is locked after 15 minutes (or less) of inactivity.

This validation procedure is performed on both the MDM Administration console and the Samsung Android device.

On the MDM console, for the Workspace, in the "Android lock screen restrictions" group, verify that the "max time to screen lock" is set to "15" minutes.

On the Samsung Android device, do the following:
1. Tap any app on the "Workspace" App screen.
2. Refrain from using the device for 15 minutes.
3. If "One Lock" is disabled, verify that the device requires the user to enter the Workspace password to access any app on the "Workspace" App screen.
4. If "One Lock" is enabled, verify that the device requires the user to enter the device unlock password to access the device.

If on the MDM console "maximum time to lock" is not set to "15" minutes or less, or the Samsung Android Workspace does not lock after 15 minutes, this is a finding.

Note: If "When screen turns off" is selected in the Samsung Android Workspace setting Workspace >> Auto lock Workspace, the Workspace will not lock until the screen turns off, regardless of the maximum lock timeout.

Vulnerability Number

V-93779

Documentable

False

Rule Version

KNOX-09-000410

Severity Override Guidance

Review the Samsung Android Workspace configuration settings to confirm that the Workspace is locked after 15 minutes (or less) of inactivity.

This validation procedure is performed on both the MDM Administration console and the Samsung Android device.

On the MDM console, for the Workspace, in the "Android lock screen restrictions" group, verify that the "max time to screen lock" is set to "15" minutes.

On the Samsung Android device, do the following:
1. Tap any app on the "Workspace" App screen.
2. Refrain from using the device for 15 minutes.
3. If "One Lock" is disabled, verify that the device requires the user to enter the Workspace password to access any app on the "Workspace" App screen.
4. If "One Lock" is enabled, verify that the device requires the user to enter the device unlock password to access the device.

If on the MDM console "maximum time to lock" is not set to "15" minutes or less, or the Samsung Android Workspace does not lock after 15 minutes, this is a finding.

Note: If "When screen turns off" is selected in the Samsung Android Workspace setting Workspace >> Auto lock Workspace, the Workspace will not lock until the screen turns off, regardless of the maximum lock timeout.

Check Content Reference

M

Target Key

3507

Comments