The mobile application must not use mobile code technology that is not yet categorized in accordance with the DoD Mobile Code Policy.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35265	SRG-APP-000074-MAPP-00023	SV-46552r1_rule		High

Description
Mobile code does not require any traditional software acceptance testing or security validation. Mobile code needs to follow sound policy to maintain a reasonable level of trust. Mobile code that does not fall into existing policy cannot be trusted. In applying this policy, the user is assured greater security from using tested and signed code.

STIG	Date
Mobile Application Security Requirements Guide	2013-01-04

Details

Check Text ( C-43634r2_chk )

If the application does not download or interpret mobile code, this requirement is not applicable. Review the documents at http://iase.disa.mil/mcp/index.html which detail all mobile codes, categorized per DoD policy. Definitions for mobile code categories can be found at this site. Conduct a review of the application documentation and assess which mobile codes are present. Compare the two documents to assess if the application uses mobile code technologies or interpreters are present for such technologies not permitted by DoD policy. If the documentation review is inconclusive or cannot be carried out, perform a static code analysis and assess which mobile code technologies and/or interpreters are present in the application code. If the documentation and/or code review reveal that technologies and/or interpreters are present for code not permitted by DoD policy, this is a finding.

Fix Text (F-39811r1_fix)
Remove uncategorized mobile code and interpreters for uncategorized mobile code.