STIGQter: STIG Summary: Samsung SDS EMM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2020:

The Samsung SDS EMM must implement functionality to generate an audit record of the following auditable events: c. [selection: Commands issued to the MDM Agent].

DISA Rule

SV-225640r547707_rule

Vulnerability Number

V-225640

Group Title

PP-MDM-412000

Rule Version

SSDS-00-000010

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Use the following instructions to configure logging of all commands issued to the MDM Agent on the SDS EMM server:

On the MDM console, do the following:
1. Log in to the Admin Console using a web browser.
2. Go to Service Overview >> Log and Event >> Audit Event.
3. Select Type as "Server" and Event Category as "Device Command".
4. Check the audit target and click the "Save" button at the top of the page.

Check Contents

Use the following procedure to verify logging of all commands issued to the MDM Agent has been configured on the SDS EMM server:

On the MDM console, do the following:
1. Log in to the Admin Console using a web browser.
2. Go to Service Overview >> Log and Event >> Audit Event.
3. Verify all audit events with Type as "Server" and Event Category as "Device Command" have been selected.

If logging of all commands issued to the MDM Agent has not been configured on the SDS EMM server, this is a finding.

Vulnerability Number

V-225640

Documentable

False

Rule Version

SSDS-00-000010

Severity Override Guidance

Use the following procedure to verify logging of all commands issued to the MDM Agent has been configured on the SDS EMM server:

On the MDM console, do the following:
1. Log in to the Admin Console using a web browser.
2. Go to Service Overview >> Log and Event >> Audit Event.
3. Verify all audit events with Type as "Server" and Event Category as "Device Command" have been selected.

If logging of all commands issued to the MDM Agent has not been configured on the SDS EMM server, this is a finding.

Check Content Reference

M

Target Key

4216

Comments