STIGQter: STIG Summary: BlackBerry Enterprise Mobility Server 2.x Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jul 2020:

If the BlackBerry Connect service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to enable SSL support for BlackBerry Proxy and use only DoD approved certificates.

DISA Rule

SV-93745r1_rule

Vulnerability Number

V-79039

Group Title

SRG-APP-000516-AS-000237

Rule Version

BEMS-00-014300

Severity

CAT II

CCI(s)

• CCI-001453 - The information system implements cryptographic mechanisms to protect the integrity of remote access sessions.

Weight

10

Fix Recommendation

Configure BlackBerry Connect to enable SSL with a DoD certificate.

1. Submit a CSR request to the DoD CA.
2. Import the DoD certificate to the computer that hosts BEMS.
3. Bind the SSL certificate to the Connect SSL port.
4. Add the new certificate information to the BEMS configuration file.
5. Configure BlackBerry Connect to send requests over SSL.
6. Configure Connect to use SSL with BlackBerry Proxy.

Check Contents

This requirement is not applicable if the BlackBerry Connect service is not enabled on BEMS.

Verify SSL is enabled for the BlackBerry Connect service and a DoD certificate is used as follows:

1. Browse to FQDN of the BEMS Connect server(s) on port 8082.
2. Click on the SSL certificate to verify it has been issued by the DoD CA.
3. Repeat steps 1 and 2 for each BEMS server that has the Connect service added to it.

If SSL is not enabled for BlackBerry Connect and if the SSL certificate is not a DoD CA issued certificate, this is a finding.

Vulnerability Number

V-79039

Documentable

False

Rule Version

BEMS-00-014300

Severity Override Guidance

This requirement is not applicable if the BlackBerry Connect service is not enabled on BEMS.

Verify SSL is enabled for the BlackBerry Connect service and a DoD certificate is used as follows:

1. Browse to FQDN of the BEMS Connect server(s) on port 8082.
2. Click on the SSL certificate to verify it has been issued by the DoD CA.
3. Repeat steps 1 and 2 for each BEMS server that has the Connect service added to it.

If SSL is not enabled for BlackBerry Connect and if the SSL certificate is not a DoD CA issued certificate, this is a finding.

Check Content Reference

M

Target Key

3259

Comments