OpenControls Logo

STIG Viewer

STIGViewer Support

If the BlackBerry Connect service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to enable SSL support for BlackBerry Proxy and use only DoD approved certificates.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-79039BEMS-00-014300SV-93745r1_ruleCCI-001453medium
Description
Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS) or SSL. Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoD-approved CA, trust of this CA has not been established.
STIGDate
BlackBerry Enterprise Mobility Server 2.x Security Technical Implementation Guide2020-05-15

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-14.2Protection of Confidentiality / Integrity Using Encryption
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (31) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-3Access Enforcement
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
IA-2(8)Access to Accounts — Replay Resistant
1.00
IA-2(9)Network Access to Non-privileged Accounts — Replay Resistant
1.00
IA-3Device Identification and Authentication
1.00
IA-3(1)Cryptographic Bidirectional Authentication
1.00
IA-5(1)Password-based Authentication
1.00

+21 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.13
1.00
CCI1 mapping
CCI-001453
1.00

Details

Check Text (C-93745r1_chk)

This requirement is not applicable if the BlackBerry Connect service is not enabled on BEMS. Verify SSL is enabled for the BlackBerry Connect service and a DoD certificate is used as follows: 1. Browse to FQDN of the BEMS Connect server(s) on port 8082. 2. Click on the SSL certificate to verify it has been issued by the DoD CA. 3. Repeat steps 1 and 2 for each BEMS server that has the Connect service added to it. If SSL is not enabled for BlackBerry Connect and if the SSL certificate is not a DoD CA issued certificate, this is a finding.

Fix Text (F-85789r1_fix)

Configure BlackBerry Connect to enable SSL with a DoD certificate. 1. Submit a CSR request to the DoD CA. 2. Import the DoD certificate to the computer that hosts BEMS. 3. Bind the SSL certificate to the Connect SSL port. 4. Add the new certificate information to the BEMS configuration file. 5. Configure BlackBerry Connect to send requests over SSL. 6. Configure Connect to use SSL with BlackBerry Proxy.