| V-47201 | High | BlackBerry 10 OS must grant a downloaded application only the permissions the AO has authorized for that application. | Mobile operating system applications that are able to perform unintended functions may be able to obtain sensitive information or otherwise compromise system security. The permissions that an... |
| V-47203 | High | The BlackBerry 10 OS Work Space must only install and use DoD PKI-issued or DoD-approved software authentication certificates. | If unauthorized software authentication certificates are installed on the device, then the operating system would not block malware signed by the entity that published these certificates. Such... |
| V-47185 | High | BlackBerry 10 OS must prevent a user from installing unapproved applications in the Work Space. | The operating system must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what... |
| V-47221 | Medium | BlackBerry 10 OS must employ mobile device management services to centrally manage Wi-Fi profiles. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| V-47197 | Medium | BlackBerry 10 OS must have access to DoD root and intermediate PKI certificates when performing DoD PKI-related transactions. | DoD root and intermediate PKI certificates are used to verify the authenticity of PKI certificates of users and web services. If the root and intermediate certificates are not available, an... |
| V-47223 | Medium | BlackBerry 10 OS must employ mobile device management services to centrally manage VPN profiles. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| V-47177 | Medium | BlackBerry 10 OS must prevent applications from extending the Work Space password lock time. | The Work Space lock function prevents further access to the Work Space by initiating a session lock after a period of inactivity on the device or upon receiving a request from a user. The lock is... |
| V-47191 | Medium | BlackBerry 10 OSs Wi-Fi module must use EAP-TLS authentication when authenticating to DoD WLAN authentication servers. | Without strong mutual authentication a mobile device may connect to an unauthorized network. In many cases, the user may falsely believe that the device is connected to an authorized network and... |
| V-47175 | Medium | BlackBerry 10 OS must lock the Work Space after no more than 15 minutes of inactivity. | The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until... |
| V-47173 | Medium | BlackBerry 10 OS must retain the device lock until the user reestablishes access using established identification and authentication procedures. | The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until... |
| V-47171 | Medium | BlackBerry 10 OS must retain the lock on the Work Space until the user reestablishes access using established identification and authentication procedures. | The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until... |
| V-47231 | Medium | BlackBerry 10 OS device lock, when activated on a device, must place a publicly viewable pattern onto the associated display, hiding what was previously visible on the screen. | The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until... |
| V-47207 | Medium | BlackBerry 10 OS must be updated to the latest approved version of the operating system. | Operating system updates contain new security related features and security patches that address known vulnerabilities. Running the latest DoD-approved software version improves the security... |
| V-47169 | Medium | BlackBerry 10 OS must display the DoD warning banner exactly as specified at start-up device unlock. | The operating system is required to display the DoD-approved system use notification message or banner before granting access to the system that provides privacy and security notices consistent... |
| V-47219 | Medium | BlackBerry 10 OS must employ mobile device management services to centrally manage email settings. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| V-47193 | Medium | BlackBerry 10 OS VPN client must employ DoD PKI-approved mechanisms for authentication when connecting to DoD networks. | VPNs are vulnerable to attack if they are not supported by strong authentication. An adversary may be able to gain access to network resources and sensitive information if they can compromise the... |
| V-47215 | Medium | BlackBerry 10 OS maximum number of consecutive unsuccessful unlock attempts must be less than 10. | The recommended setting for the maximum number of consecutive unsuccessful unlock attempts is 10. In some environments, a lower number may be needed to provide greater protection of sensitive... |
| V-48597 | Medium | BlackBerry 10 OSs VPN client must use either IPsec or SSL/TLS when connecting to DoD networks. | Use of non-standard communications protocols can affect both the availability and confidentiality of communications. IPsec and SSL/TLS are both well-known and tested protocols that provide strong... |
| V-47199 | Medium | BlackBerry 10 OS must block both the inbound and outbound traffic between instant messaging clients that are independently configured by end users and external service providers or other unapproved DoD systems. | Many instant messaging systems have known vulnerabilities, some of which allow an adversary to install malware on the device. This malware can then be used to obtain sensitive information or... |
| V-47205 | Medium | The BlackBerry 10 OS Work Space must only install and use DoD PKI-issued or DoD-approved server authentication certificates. | If unauthorized device authentication certificates are installed on the device, there is the potential that the device may connect to a rogue device or network. Rogue devices can mimic the... |
| V-47183 | Medium | BlackBerry 10 OS must prevent a user from installing unapproved applications. | The operating system must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what... |
| V-47181 | Medium | BlackBerry 10 OS must enforce a minimum length for the Work Space unlock password. | Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute force attacks. The ability to crack a password is a function of how many times an... |
| V-47187 | Medium | BlackBerry 10 OS must prevent a user from installing unapproved applications from other sources. | The operating system must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what... |
| V-47217 | Medium | BlackBerry 10 OS must employ mobile device management services to centrally manage IT Policies. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| V-47189 | Medium | BlackBerry 10 OS must only permit downloading of software from a DoD-approved source (e.g., DoD-operated mobile device application store or MDM server). | DoD can perform due diligence on sources of software to mitigate the risk that malicious software is introduced to those sources. Therefore, if software is downloaded from a DoD-approved source,... |
| V-47229 | Low | BlackBerry 10 OS must enable a system administrator to (i) select which data fields will be available to applications outside of the contact database application and (ii) limit the number of contact database fields accessible outside of a work persona in the case of dual persona phones. | The contact database often contains a significant amount of information beyond each person's name and phone number. The records may contain addresses and other identifying or sensitive information... |
| V-47179 | Low | BlackBerry 10 OS must synchronize the internal clock on an organizationally-defined periodic basis with an authoritative time server or the Global Positioning System. | Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events.
Periodically synchronizing... |
| V-47233 | Low | BlackBerry 10 OS, for PKI-based authentication must validate certificates by querying the certification authority for revocation status of the certificate. | Status information for certification paths includes certificate revocation lists or online certificate status protocol responses. Failure to verify a certificate's revocation status can result in... |
