A compliance rule must be setup in the server implementing jailbreak detection on smartphones. Devices will be wiped if they have been jailbroken.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-25004	WIR-GMMS-iOS-010-03	SV-34938r1_rule	ECWN-1	Medium

Description
DoD-required security policies can be bypassed on jailbroken smartphone . Jailbroken devices can expose sensitive DoD data to unauthorized people and could lead to a network attack.

STIG	Date
Good Mobility Suite Server (Apple iOS 4) Interim Security Configuration Guide (ISCG)	2011-11-07

Details

Check Text ( C-31159r1_chk )
This is a Good security policy set check. Recommend all checks related to Good security policy set rules be reviewed using the following procedure. 1. Make a list of all Good security policy sets assigned to smartphone user accounts on the Good server using the following procedure: -Have the SA identify any non STIG/ISCG-compliant policy sets and STIG/ISCG-compliant policy sets on the server. --Log into the Good Mobile Control console. --Click on the Policies tab. --View all policy sets on the server. -Note: STIG-compliant policy sets should be identified as such in the policy title. Examples are as follows: ISCG_iOS_Policy_Set, STIG_WM6-5_Policy_Set, or STIG_Android_Policy_Set. It is recommended that all non-STIG/ISCG policy sets be deleted. 2. Select each policy set users are assigned to, and in turn, verify the required settings are in the policy set. -Note: If there is a finding, note the name of the non STIG/ISCG-compliant policy set in the Findings Details section in VMS/Component Provided Tracking Database. -Launch the Good Mobile Control Web console and click on the Policies tab. -Select a policy set to review and click on the policy. -On the left tab, select Compliance Manager. -Verify the "iOS Jailbreak Detection" rule is listed. (Note that the rule title does not have to be exact.) -Open the rule by checking the box next to the rule, then click on Edit. -Verify the following are set as indicated: Platform: iPhone Check to Run: Jailbreak/Rooted Detection -Verify "Failure Action" is set to "Wipe Enterprise Data". -Verify "Check Every" is set to "1 hour". Mark as a finding if the “Android Jailbreak Detection” rule has not been set up or is not configured as required.

Check Text ( C-31159r1_chk )

This is a Good security policy set check. Recommend all checks related to Good security policy set rules be reviewed using the following procedure.

1. Make a list of all Good security policy sets assigned to smartphone user accounts on the Good server using the following procedure:

-Have the SA identify any non STIG/ISCG-compliant policy sets and STIG/ISCG-compliant policy sets on the server.
--Log into the Good Mobile Control console.
--Click on the Policies tab.
--View all policy sets on the server.

-Note: STIG-compliant policy sets should be identified as such in the policy title. Examples are as follows: ISCG_iOS_Policy_Set, STIG_WM6-5_Policy_Set, or STIG_Android_Policy_Set. It is recommended that all non-STIG/ISCG policy sets be deleted.

2. Select each policy set users are assigned to, and in turn, verify the required settings are in the policy set.

-Note: If there is a finding, note the name of the non STIG/ISCG-compliant policy set in the Findings Details section in VMS/Component Provided Tracking Database.

-Launch the Good Mobile Control Web console and click on the Policies tab.

-Select a policy set to review and click on the policy.
-On the left tab, select Compliance Manager.
-Verify the "iOS Jailbreak Detection" rule is listed. (Note that the rule title does not have to be exact.)
-Open the rule by checking the box next to the rule, then click on Edit.

-Verify the following are set as indicated:

Platform: iPhone
Check to Run: Jailbreak/Rooted Detection

-Verify "Failure Action" is set to "Wipe Enterprise Data".

-Verify "Check Every" is set to "1 hour".

Mark as a finding if the “Android Jailbreak Detection” rule has not been set up or is not configured as required.

Fix Text (F-27653r1_fix)
Set up compliance rules in the server implementing jailbreak detection. Devices will be wiped if they have been jail broken.