A compliance rule must be set up in the server defining required mobile OS software build version.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-29949	WIR-MOS-AND-030-02	SV-39515r1_rule	ECWN-1	Medium

Description
Unapproved OS build versions do not support required security features. The security baseline of the Android system could be compromised if required security features are not available.

STIG	Date
Android 2.2 (Dell) Security Technical Implementation Guide	2011-11-28

Details

Check Text ( C-38486r1_chk )
This is a Good security policy set check. Recommend all checks related to Good security policy set rules be reviewed using the following procedure. 1. Make a list of all Good security policy sets assigned to smartphone user accounts on the Good server using the following procedure: -Have the SA identify any non STIG-compliant policy sets and STIG-compliant policy sets on the server. --Log into the Good Mobile Control console. --Click on the Policies tab. --View all policy sets on the server. -Note: STIG-compliant policy sets should be identified as such in the policy title. Examples are as follows: STIG_iOS_Policy_Set, STIG_WM6-5_Policy_Set, or STIG_Android_Policy_Set. It is recommended that all non-STIG policy sets be deleted. 2. Select each policy set users are assigned to, and in turn, verify the required settings are in the policy set. Note: If there is a finding, note the name of the non STIG-compliant policy set in the Findings Details section in VMS/Component Provided Tracking Database. --------------------------- Step 1: -Launch the Good Mobile Control Web console and click on the Policies tab. -Select the policy set for the Android devices and click on Android Configuration on the left side. -On the left tab, select Compliance Manager. -Verify a "Custom" or "Dell Android Build Number" rule is listed. (Note the rule title does not have to be exact.) -Open the rule by checking the box next to the rule, and then click on Edit. -Verify "Failure Action" is set to "Quit Good for Enterprise". -Verify "Check Every" is set to "1 hour". -Verify Rule File = build_number_check.xml Step 2: Verify the latest release of the Dell Android build is specified in the build_number_check.xml file. -Have the system administrator (SA) provide the build number of the latest Dell Android release. The release is expected to be available on the Dell DoD web site. -Have the system administrator open the build_number_check.xml file in a browser or in Word. The build number will be listed between and in the script. Mark as a finding if the required rule has not been set up and includes the latest Dell Android release build number.

Check Text ( C-38486r1_chk )

This is a Good security policy set check. Recommend all checks related to Good security policy set rules be reviewed using the following procedure.

1. Make a list of all Good security policy sets assigned to smartphone user accounts on the Good server using the following procedure:

-Have the SA identify any non STIG-compliant policy sets and STIG-compliant policy sets on the server.
--Log into the Good Mobile Control console.
--Click on the Policies tab.
--View all policy sets on the server.

-Note: STIG-compliant policy sets should be identified as such in the policy title. Examples are as follows: STIG_iOS_Policy_Set, STIG_WM6-5_Policy_Set, or STIG_Android_Policy_Set. It is recommended that all non-STIG policy sets be deleted.

2. Select each policy set users are assigned to, and in turn, verify the required settings are in the policy set.

Note: If there is a finding, note the name of the non STIG-compliant policy set in the Findings Details section in VMS/Component Provided Tracking Database.
---------------------------
Step 1:
-Launch the Good Mobile Control Web console and click on the Policies tab.
-Select the policy set for the Android devices and click on Android Configuration on the left side.

-On the left tab, select Compliance Manager.
-Verify a "Custom" or "Dell Android Build Number" rule is listed. (Note the rule title does not have to be exact.)
-Open the rule by checking the box next to the rule, and then click on Edit.

-Verify "Failure Action" is set to "Quit Good for Enterprise".

-Verify "Check Every" is set to "1 hour".

-Verify Rule File = build_number_check.xml

Step 2:
Verify the latest release of the Dell Android build is specified in the build_number_check.xml file.

-Have the system administrator (SA) provide the build number of the latest Dell Android release. The release is expected to be available on the Dell DoD web site.

-Have the system administrator open the build_number_check.xml file in a browser or in Word. The build number will be listed between and in the script.

Mark as a finding if the required rule has not been set up and includes the latest Dell Android release build number.

Fix Text (F-33736r1_fix)
Install an approved mobile OS build.