OpenControls Logo

STIG Viewer

STIGViewer Support

Samsung Android must not accept the certificate when it cannot establish a connection to determine the validity of a certificate.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-276661KNOX-16-000700SV-276661r1139505_ruleCCI-000185low
Description
Certificate-based security controls depend on the ability of the system to verify the validity of a certificate. If the MOS were to accept an invalid certificate, it could take unauthorized actions, resulting in unanticipated outcomes. At the same time, if the MOS were to disable functionality when it could not determine the validity of the certificate, this could result in a denial of service. Therefore, the ability to provide exceptions is appropriate to balance the tradeoff between security and functionality. Always accepting certificates when they cannot be determined to be valid is the most extreme exception policy and is not appropriate in the DOD context. Involving an Administrator or user in the exception decision mitigates this risk to some degree. SFR ID: FIA_X509_EXT_2.2
STIGDate
Samsung Android 16 COPE Security Technical Implementation Guide2026-05-27

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-10.2PKI-Based Authentication
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (53) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-12Session Termination
1.00
AC-17(10)Authenticate Remote Commands
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-4(17)Domain Authentication
1.00

+43 more (top 10 by confidence shown)

CCI1 mapping
CCI-000185
1.00

Details

Check Text (C-276661r1139505_chk)

Verify requirement KNOX-16-009300 (Common Criteria mode) has been implemented. If "Common Criteria mode" has not been implemented, this is a finding.

Fix Text (F-80721r1139504_fix)

Implement "Common Criteria mode" (refer to requirement KNOX-16-009300). API: setCommonCriteriaModeEnabled