The BES12 server must be configured to disable a users capability to perform self-service tasks.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-68703	BS12-3X-100800	SV-83193r2_rule		Medium

Description
The security posture of a BlackBerry device or the DoD BlackBerry service could be compromised if users are able to perform self-service tasks, including activating unauthorized devices. In the DoD environment, strict configuration management of the security posture is required to protect sensitive DoD data and network security. SFR ID: FMT

STIG	Date
BlackBerry BES 12.5.x MDM Security Technical Implementation Guide	2017-06-05

Details

Check Text ( C-69209r1_chk )
Review the BES12 server configuration to determine if it is configured to disable a user's capability to perform self-service tasks. On the BES12, do the following: 1. Log on to the BES12 console and select the "Settings" tab at the top of the screen. 2. Expand the "General" settings tab on the left pane. 3. Select "Self-Service" from the menu in the left pane. 4. Verify the check box next to "Allow users to access the self-service console" is not checked. If the checkbox next to "Allow users to access the self-service console" is checked, this is a finding.

Check Text ( C-69209r1_chk )

Review the BES12 server configuration to determine if it is configured to disable a user's capability to perform self-service tasks.

On the BES12, do the following:
1. Log on to the BES12 console and select the "Settings" tab at the top of the screen.
2. Expand the "General" settings tab on the left pane.
3. Select "Self-Service" from the menu in the left pane.
4. Verify the check box next to "Allow users to access the self-service console" is not checked.

If the checkbox next to "Allow users to access the self-service console" is checked, this is a finding.

Fix Text (F-74825r1_fix)
On the BES12, do the following: 1. Log on to the BES12 console and select the "Settings” tab at the top of the screen. 2. Expand the General settings tab on the left pane. 3. Select Self-Service from the menu in the left pane. 4. Unselect the checkbox next to "Allow users to access the self-service console". 5. Click "Save".