V-24986 | High | All non-core applications on the mobile OS device must be approved by the DAA or Command IT Configuration Control Board. | Non-approved applications can contain malware. Approved applications should be reviewed and tested by the approving authority to ensure they do not contain malware, spyware, or have unexpected... |
V-29894 | High | A security risk analysis must be performed on a mobile operating (OS) system application by the DAA or DAA authorized approval authority prior to the application being approved for use. | Non-approved applications can contain malware. Approved applications should be reviewed and tested by the approving authority to ensure they do not contain malware, spyware, or have unexpected... |
V-25007 | High | Smartphones must be configured to require a password/passcode for device unlock. | Sensitive DoD data could be compromised if a device unlock password/passcode is not set up on a DoD smartphones. |
V-53957 | High | Android 2.2 Dell mobile operating systems that are no longer supported by the vendor for security updates must not be installed on a system. | Android 2.2 Dell mobile operating systems that are no longer supported by the vendor for security updates are not evaluated or updated for vulnerabilities, leaving them open to potential attack. ... |
V-25003 | Medium | A compliance rule must be set up in the server defining required mobile OS software versions. | Unapproved OS versions do not support required security features. The security baseline of the Android system could be compromised if required security features are not available. |
V-18856 | Medium | Removable memory cards (e.g., MicroSD) must have data stored on the card encrypted with a FIPS 140-2 validated cryptographic module. | Memory card used to transfer files between PCs and PDAs is a migration path for the spread of malware on DoD computers and handheld devices. These risks are mitigated by the requirements listed... |
V-27635 | Medium | Remote full device wipe must be enabled. | Sensitive DoD data could be compromised if mobile OS device data could not be wiped when directed by the system administrator. |
V-27632 | Medium | Enable remote SD card wipe must be configured. | Sensitive DoD data could be compromised if mobile OS device data could not be wiped when directed by the system administrator. |
V-27633 | Medium | Allow SD card encryption must be configured. | Sensitive DoD data could be compromised if a mobile OS device data is not encrypted. |
V-27630 | Medium | Enable Full Device Lock must be set. | Sensitive DoD data could be exposed if this configuration is not set as required. |
V-28295 | Medium | The smartphone removable memory card (e.g., MicroSD) must be bound to the PDA or smartphone so it may not be read by any other PED or computer. | Memory cards used to transfer files between PCs and PDAs is a migration path for the spread of malware on DoD computers and handheld devices. These risks are mitigated by the requirements listed... |
V-28297 | Medium | The smartphone password/passcode complexity (alphanumeric) must be set. | Sensitive DoD data could be compromised if a strong device unlock password/passcode is not set up on a DoD smartphone. The complexity of the password is a key factor in the strength of the... |
V-25019 | Medium | The smartphone Bluetooth radio must be disabled if not authorized for use. | The Bluetooth radio can be used by a hacker to connect to the smartphone without the knowledge of the user. Sensitive DoD data could be exposed and the hacker could use the device to attack the enclave. |
V-30193 | Medium | The Bluetooth configuration application must be installed on the Android device. | The Bluetooth monitor application ensures the Bluetooth configuration of the Android device is in compliance with the DoD Bluetooth security standard. If not installed, it may be possible for a... |
V-24983 | Medium | S/MIME must be installed on smartphones so users can sign/encrypt email. | S/MIME provides the capability for users to send and receive S/MIME email messages from wireless email devices. S/MIME and digital signatures provide assurance the message is authentic and is... |
V-25016 | Medium | Device minimum password/passcode length must be set. | Sensitive DoD data could be compromised if a device unlock password/passcode is not set to required length on a DoD smartphones. |
V-25017 | Medium | The smartphone Auto-Lock must be set. | Sensitive DoD data could be compromised if the smartphone does not automatically lock after a set period of inactivity. |
V-25010 | Medium | The smartphone inactivity timeout must be set. | Sensitive DoD data could be compromised if the smartphone does not automatically lock after 15 minutes of inactivity. |
V-25011 | Medium | Password/passcode maximum failed attempts must be set to required value. | A hacker with unlimited attempts can determine the password of a smartphone within a few minutes using password hacking tools, which could lead to unauthorized access to the smartphone and... |
V-25012 | Medium | Access to public application stores must be disabled. | Strong configuration management of all applications installed on DoD device is required to ensure the security baseline of the system is maintained. Otherwise, sensitive DoD data could be compromised. |
V-25013 | Medium | Users must not be allowed to download applications on smartphones without SA control. | Strong configuration management of all applications installed on DoD device is required to ensure the security baseline of the system is maintained. Otherwise, sensitive DoD data could be compromised. |
V-29949 | Medium | A compliance rule must be set up in the server defining required mobile OS software build version. | Unapproved OS build versions do not support required security features. The security baseline of the Android system could be compromised if required security features are not available. |
V-25842 | Medium | The site must set up local operating procedures for initial provisioning and subsequent software and application updates using the procedures published in the STIG Overview document. | Strong configuration management of applications on a smartphone is a key malware control. Most smartphones must have individual commercial web portal (e.g., iTunes, Android Market, etc.) accounts... |
V-19899 | Medium | All wireless PDA and smartphone client VPNs must have split tunneling disabled.
| DoD data could be compromised if transmitted data is not secured with a compliant VPN. |
V-19898 | Medium | All wireless PDA clients used for remote access to DoD networks must have a VPN supporting CAC authentication. | DoD data could be compromised if transmitted data is not secured with a compliant VPN. |
V-30566 | Medium | Mobile OS devices (smartphones / tablets) must have a device integrity validation tool baseline scan on file. | The purpose of this scan is to determine if there has been an unexplained change in the mobile OS file system indicating the device has been compromised by malware or by rooting the device. A... |
V-30567 | Medium | Mobile OS devices (smartphones/tablets) device integrity validation scan interval must be 6 hours or less. | The purpose of this scan is to determine if there has been an unexplained change in the mobile OS file system that may indicate the device has been compromised by malware or by rooting the device. |
V-30250 | Medium | Mitigation actions identified by Mobile OS device integrity tool scans on site managed Mobile OS devices must be implemented. | If mitigation actions identified by the Mobile OS device integrity tool are not implemented, DoD data and the enclave could be at risk of being compromised. |
V-30568 | Medium | Mobile OS device integrity tool scans must be reviewed daily by the system administrator or IAO (or continuously by a server). | If mitigation actions identified by the Mobile OS device integrity tool are not implemented, DoD data and the enclave could be at risk of being compromised. |
V-19897 | Medium | All wireless PDA clients used for remote access to DoD networks must enable AES encryption for the VPN.
| DoD data could be compromised if transmitted data is not secured with a compliant VPN. |
V-27629 | Medium | Full Device Administration must be implemented on the smartphone. | If this configuration is not set as required, the security policy from the server will not be implemented on the smartphone. Sensitive DoD data could be compromised. |
V-25022 | Medium | All smartphones must display the required banner during device unlock/ logon. | DoD CIO memo requires all PDAs, BlackBerrys, and smartphones to have a consent banner displayed during logon/device unlock to ensure users understand their responsibilities to safeguard DoD data. |
V-24981 | Medium | Smartphone devices must have required operating system software versions installed. | Required security features are not available in earlier OS versions. In addition, there are known vulnerabilities in earlier versions. |
V-27634 | Medium | VPN must be configured as required. | Sensitive DoD data could be compromised if the Android VPN client is used. The VPN client is not currently FIPS 140-2 validated and does not support CAC authentication. |
V-30249 | Medium | The results and mitigation actions from Mobile OS device integrity validation tool scans on site managed Mobile OS devices must be maintained by the site for at least 6 months (1 year recommended). | Scan results must be maintained so that auditors can verify mitigation actions have been completed, so that a scan can be compared to a previous scan, and to determine if there is any security... |
V-30248 | Medium | Mobile OS devices (smartphones/tablets) must have a system integrity validation application installed or have validation scanning, using a PC based tool, completed on the required schedule. | The purpose of this scan is to determine if there has been an unexplained change in the mobile OS file system that may indicate the device has been compromised by malware or by rooting the device. |
V-29529 | Medium | The smartphone USB port must be configured as required. | A smartphone can be jailbroken or rooted when connected to a PC with a jailbreak or rooting application installed on it. When a smartphone is jailbroken/rooted, the user or malware has root... |
V-29524 | Medium | All mobile operating system (OS) device Bluetooth radio profiles must be disabled except for the serial port, handset and headset profiles. | The Bluetooth radio can be used by a hacker to connect to the smartphone without the knowledge of the user. Sensitive DoD data could be exposed and the hacker could use the device to attack the... |
V-29525 | Medium | The pairing of Bluetooth devices to DoD mobile OS devices must be controlled so only approved devices can pair to the smartphone. | The Bluetooth radio can be used by a hacker to connect to the smartphone without the knowledge of the user. Sensitive DoD data could be exposed and the hacker could use the device to attack the enclave.
|
V-18627 | Medium | The VPN client on wireless clients (PDAs, smartphones) used for remote access to DoD networks will be FIPS 140-2 validated. This check is not applicable if the installed VPN client is not used for remote access to DoD networks. | DoD data could be compromised if transmitted data is not secured with a compliant VPN. FIPS validation provides a level of assurance that the encryption of the device has been securely implemented. |
V-25051 | Low | Location services must be turned off on the smartphone during device provisioning. | Smartphone location services allow applications to gather information about the location of the handheld device and possibly forward it to servers located on the Internet. This is an operational... |
V-27631 | Low | Enable remote device password reset must be set. | Without this capability a user could be locked out of their smartphone for significant time periods, affecting the mission of the organization. |
V-24982 | Low | Smart Card Readers (SCRs) used with smartphone must have required software version installed. | Required security features are not available in earlier software versions. In addition, there may be known vulnerabilities in earlier versions. |
V-25018 | Low | The smartphone passcode history setting must be set. | The password/passcode would be more susceptible to compromise if the user can select frequently used passwords/passcodes. |
V-26559 | Low | The Personal Hotspot feature of the mobile OS must be disabled if it does not meet DoD WLAN or Bluetooth security requirements and is not approved by the IAO. | The Wi-Fi radio and Bluetooth radio can be used by a hacker to connect to the smartphone without the knowledge of the user. Sensitive DoD data could be exposed and the hacker could use the device... |
V-25009 | Low | Maximum password/passcode age must be set. | Sensitive DoD data could be compromised if a strong device unlock passcode is not set up on a DoD smartphone and the passcode is not changed periodically. |
V-24985 | Low | All Internet browsing on a DoD mobile operating system (OS) device will go through a DoD Internet proxy. | A DoD Internet proxy provides additional security over the carrier's browser. When using the DoD Internet proxy for a mobile device Internet connections, enclave Internet security controls will... |
V-24984 | Low | If smartphone email auto signatures are used, the signature message must not disclose the email originated from a smartphone (e.g., “Sent From My Wireless Handheld”). | The disclaimer message may give information which may key an attacker in on the device. |
V-25014 | Low | Use of the smartphone camera must be approved and documented in site physical security policy. | This is an operational security issue. Sensitive DoD data could be compromised if cameras are allowed in areas not authorized by the site physical security plan. |
V-25020 | Low | The smartphone device Wi-Fi radio must be disabled as the default setting and is enabled only when Wi-Fi connectivity is required.
| The Wi-Fi radio can be used by a hacker to connect to the smartphone without the knowledge of the user. Sensitive DoD data could be exposed and the hacker could use the device to attack the enclave. |