STIGQter: STIG Summary: Samsung Android OS 9 with Knox 3.x COPE Use Case KPE(Legacy) Deployment Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 24 Jul 2020:

Samsung Android must be configured to disable Face Recognition. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the products Common Criteria evaluation.

DISA Rule

SV-103971r1_rule

Vulnerability Number

V-93885

Group Title

PP-MDF-301150

Rule Version

KNOX-09-000505

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.
• CCI-000370 - The organization employs automated mechanisms to centrally manage configuration settings for organization-defined information system components.
• CCI-000381 - The organization configures the information system to provide only essential capabilities.

Weight

10

Fix Recommendation

Configure Samsung Android to disable Face Recognition.

On the MDM console, for the device, in the "Knox password constraints" group, select "disable face".

Check Contents

Review device configuration settings to confirm that Face Recognition is disabled.

This procedure is performed on both the MDM Administration console and the Samsung Android device.

On the MDM console, for the device, in the "Knox password constraints" group, verify that "disable face" is selected.

On the Samsung Android device, do the following:
1. Open Settings.
2. Tap "Lock screen".
3. Tap "Screen lock type".
4. Enter current password.
5. Verify that "Face" is disabled and cannot be enabled.

If on the MDM console "disable face" is not selected, or on the Samsung Android device "Face" can be enabled, this is a finding.

Vulnerability Number

V-93885

Documentable

False

Rule Version

KNOX-09-000505

Severity Override Guidance

Review device configuration settings to confirm that Face Recognition is disabled.

This procedure is performed on both the MDM Administration console and the Samsung Android device.

On the MDM console, for the device, in the "Knox password constraints" group, verify that "disable face" is selected.

On the Samsung Android device, do the following:
1. Open Settings.
2. Tap "Lock screen".
3. Tap "Screen lock type".
4. Enter current password.
5. Verify that "Face" is disabled and cannot be enabled.

If on the MDM console "disable face" is not selected, or on the Samsung Android device "Face" can be enabled, this is a finding.

Check Content Reference

M

Target Key

3509

Comments