OpenControls Logo

STIG Viewer

STIGViewer Support

Samsung Android must be configured to enable authentication of personal hotspot connections to the device using a pre-shared key.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-258677KNOX-14-210160SV-258677r958678_ruleCCI-001443medium
Description
If no authentication is required to establish personal hotspot connections (Wi-Fi and Bluetooth), an adversary may be able to use that device to perform attacks on other devices or networks without detection. A sophisticated adversary may also be able to exploit unknown system vulnerabilities to access information and computing resources on the device. Requiring authentication to establish personal hotspot connections mitigates this risk. Application note: If hotspot functionality is permitted, it must be authenticated via a preshared key. There is no requirement to enable hotspot functionality, and it is recommended this functionality be disabled by default. SFR ID: FMT_SMF_EXT.1.1 #41
STIGDate
Samsung Android OS 14 with Knox 3.x COPE Security Technical Implementation Guide2024-12-06

Related Frameworks

2 mappings across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-14.1Automated Monitoring & Control
1.00
NET-15.1Authentication & Encryption
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (22) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-17(9)Disconnect or Disable Access
1.00
AC-18(1)Authentication and Encryption
1.00
AC-2(1)Automated System Account Management
1.00
AC-3Access Enforcement
1.00
AU-12Audit Record Generation
1.00
AU-3Content of Audit Records
1.00
CA-3(5)Restrictions on External System Connections
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00

+12 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.12
1.00
3.1.17
1.00
CCI2 mappings
CCI-001443
1.00
CCI-002314
1.00

Details

Check Text (C-258677r958678_chk)

Review the configuration to determine if the Samsung Android devices are enabling authentication of personal hotspot connections to the device using a preshared key. This validation procedure is performed on both the management tool and the Samsung Android device. On the management tool, in the device restrictions, verify "Configure tethering" is set to "Disallow". On the Samsung Android device: 1. Open Settings >> Connections. 2. Verify "Mobile Hotspot and Tethering" is grayed out. If on the management tool "Configure tethering" is not set to "Disallow", or on the Samsung Android device "Mobile Hotspot and Tethering" is not grayed out, this is a finding.

Fix Text (F-62326r931230_fix)

Configure the Samsung Android devices to enable authentication of personal hotspot connections to the device using a preshared key. On the management tool in the device restrictions, set "Configure tethering" to "Disallow". If the deployment requires the use of Mobile Hotspot and Tethering, Knox Platform for Enterprise (KPE) policy can be used to allow them in a STIG-approved configuration. In this case, do not configure this policy and instead replace with KPE policy (innately by the management tool or via Knox Service Plugin [KSP]) "Allow open Wi-Fi connection" with value "Disable" and add Training Topic "Don't use Wi-Fi Sharing" (refer to Supplemental document for additional information).