The BES12 server must initiate a session lock after a 15-minute period of inactivity.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-68693	BS12-3X-100100	SV-83183r2_rule		Medium

Description
A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their application session prior to vacating the vicinity, applications need to be able to identify when a user's application session has idled and take action to initiate the session lock. The session lock is implemented at the point where session activity can be determined and/or controlled. This is typically at the operating system level and results in a system lock but may be at the application level where the application interface window is secured instead. SFR ID: FMT_SMF.1.1(1) Refinement

Description

A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their application session prior to vacating the vicinity, applications need to be able to identify when a user's application session has idled and take action to initiate the session lock. The session lock is implemented at the point where session activity can be determined and/or controlled. This is typically at the operating system level and results in a system lock but may be at the application level where the application interface window is secured instead. SFR ID: FMT_SMF.1.1(1) Refinement

STIG	Date
BlackBerry BES 12.5.x MDM Security Technical Implementation Guide	2017-06-05

Details

Check Text ( C-69197r1_chk )
Review the BES12 server configuration to determine whether the system is locked after 15 minutes. Clock the time on a server to validate that it is correctly enforcing the time period. On the BES12, do the following: 1. Log on to the BES12 console. 2. Note the time and leave the console inactive. Note: During this time, ensure there are no user inputs made to the console, such as mouse movements or keyboard entries. 3. Verify that the console locks after 15 minutes or less of inactivity. If the console does not lock after 15 minutes or less of inactivity, this is a finding.

Check Text ( C-69197r1_chk )

Review the BES12 server configuration to determine whether the system is locked after 15 minutes. Clock the time on a server to validate that it is correctly enforcing the time period.

On the BES12, do the following:
1. Log on to the BES12 console.
2. Note the time and leave the console inactive.
Note: During this time, ensure there are no user inputs made to the console, such as mouse movements or keyboard entries.
3. Verify that the console locks after 15 minutes or less of inactivity.

If the console does not lock after 15 minutes or less of inactivity, this is a finding.

Fix Text (F-74815r1_fix)
On the BES12, do the following: 1. Log on to the BES12 host server and navigate to "C:\BlackBerry\BlackBerry Configuration Tool 1.4.0\BES12ConfigTool.exe" to launch the BES12 Configuration Tool. Note: If the BES12 Configuration Tool was not installed in the default directory, you will need to locate the directory with the executable file to launch the application. 2. Select the "BES12 console timeout interval" radio button. 3. Click "Next". 4. Click "Validate" to verify the Database information. 5. In the "Session timeout (seconds)" field, enter "900". 6. Select the checkbox next to "Automatically Restart Services". 7. Click "Update". 8. Verify that the message "BES12 services successfully restarted" is displayed when the process is completed. Note: If the services do not restart automatically, you will have to restart the services manually. 9. Click "Quit" to exit the application. Note: If the BES12 Configuration Tool is not installed on the host system, you will need to download and install the tool on the host server. To download and install the BES12 Configuration Tool, on the BES12, do the following: 1. Log on to the BES12 host server and download and install the BES12 Configuration Tool from: http://swdownloads.blackberry.com/Downloads/entry.do 2. Navigate to "C:\BlackBerry\BlackBerry Configuration Tool 1.4.0\BES12ConfigTool.exe" and launch the BES12 Configuration Tool. Note: If the BES12 Configuration Tool was not installed in the default directory, you will need to locate the directory with the executable file to launch the application. 3. Click "Next". 4. Select the country of use from the drop-down menu. 5. Select the radio button next to "I accept the terms of the license agreement". 6. Click "Next". 7. Select the "BES12 console timeout interval" radio button. 8. Verify the Database Information. 9. Click "Validate". 10. Click "Quit" to exit the application.

Fix Text (F-74815r1_fix)

On the BES12, do the following:
1. Log on to the BES12 host server and navigate to "C:\BlackBerry\BlackBerry Configuration Tool 1.4.0\BES12ConfigTool.exe" to launch the BES12 Configuration Tool.
Note: If the BES12 Configuration Tool was not installed in the default directory, you will need to locate the directory with the executable file to launch the application.
2. Select the "BES12 console timeout interval" radio button.
3. Click "Next".
4. Click "Validate" to verify the Database information.
5. In the "Session timeout (seconds)" field, enter "900".
6. Select the checkbox next to "Automatically Restart Services".
7. Click "Update".
8. Verify that the message "BES12 services successfully restarted" is displayed when the process is completed.
Note: If the services do not restart automatically, you will have to restart the services manually.
9. Click "Quit" to exit the application.

Note: If the BES12 Configuration Tool is not installed on the host system, you will need to download and install the tool on the host server.

To download and install the BES12 Configuration Tool, on the BES12, do the following:
1. Log on to the BES12 host server and download and install the BES12 Configuration Tool from: http://swdownloads.blackberry.com/Downloads/entry.do
2. Navigate to "C:\BlackBerry\BlackBerry Configuration Tool 1.4.0\BES12ConfigTool.exe" and launch the BES12 Configuration Tool.
Note: If the BES12 Configuration Tool was not installed in the default directory, you will need to locate the directory with the executable file to launch the application.
3. Click "Next".
4. Select the country of use from the drop-down menu.
5. Select the radio button next to "I accept the terms of the license agreement".
6. Click "Next".
7. Select the "BES12 console timeout interval" radio button.
8. Verify the Database Information.
9. Click "Validate".
10. Click "Quit" to exit the application.