STIGQter: STIG Summary: Jamf Pro v10.x EMM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 03 Feb 2020:

When the Jamf Pro EMM server cannot establish a connection to determine the validity of a certificate, the server must not have the option to accept the certificate.

DISA Rule

SV-108671r1_rule

Vulnerability Number

V-99567

Group Title

PP-MDM-412003

Rule Version

JAMF-10-000040

Severity

CAT II

CCI(s)

• CCI-000185 - The information system, for PKI-based authentication, validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-000366 - The organization implements the security configuration settings.
• CCI-001310 - The information system checks the validity of organization-defined inputs.
• CCI-002450 - The information system implements organization-defined cryptographic uses and type of cryptography required for each use in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

Weight

10

Fix Recommendation

Configure the Jamf Pro EMM server to not accept a certificate if the certificate cannot be validated.

1. Open the Jamf Pro EMM console.
2. Open "Settings".
3. Select "User-Initiated Enrollment".
4. Under the General tab, select "Use a third-party signing certificate".
5. Drag and drop the DoD p12 certificate.
6. Click "Save".

Check Contents

Validate the Jamf Pro EMM server has been configured to not accept a certificate if the certificate cannot be validated.

1. Open the Jamf Pro EMM console.
2. Open "Settings".
3. Select "User-Initiated Enrollment".
4. Under the General tab, verify "Use a third-party signing certificate" is selected.
5. Verify the name and certificate extension of the DoD p12 certificate is listed.

If the Jamf Pro EMM server has been not been configured to not accept a certificate if the certificate cannot be validated, this is a finding.

Vulnerability Number

V-99567

Documentable

False

Rule Version

JAMF-10-000040

Severity Override Guidance

Validate the Jamf Pro EMM server has been configured to not accept a certificate if the certificate cannot be validated.

1. Open the Jamf Pro EMM console.
2. Open "Settings".
3. Select "User-Initiated Enrollment".
4. Under the General tab, verify "Use a third-party signing certificate" is selected.
5. Verify the name and certificate extension of the DoD p12 certificate is listed.

If the Jamf Pro EMM server has been not been configured to not accept a certificate if the certificate cannot be validated, this is a finding.

Check Content Reference

M

Target Key

3593

Comments