acceptedBlackBerry 10 OS Security Technical Implementation GuideDeveloped by BlackBerry Ltd. in coordination with DISA for use in the DoD. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.letterkenny.FSO.mbx.stig-customer-support-mailbox@mail.mil.DISA, Field Security OperationsSTIG.DOD.MILRelease: 3 Benchmark Date: 24 Oct 20141I - Mission Critical Classified<ProfileDescription></ProfileDescription>I - Mission Critical Public<ProfileDescription></ProfileDescription>I - Mission Critical Sensitive<ProfileDescription></ProfileDescription>II - Mission Support Classified<ProfileDescription></ProfileDescription>II - Mission Support Public<ProfileDescription></ProfileDescription>II - Mission Support Sensitive<ProfileDescription></ProfileDescription>III - Administrative Classified<ProfileDescription></ProfileDescription>III - Administrative Public<ProfileDescription></ProfileDescription>III - Administrative Sensitive<ProfileDescription></ProfileDescription>SRG-OS-000023-MOS-000004<GroupDescription></GroupDescription>BB10-00-000100BlackBerry 10 OS must display the DoD warning banner exactly as specified at startup device unlock.<VulnDiscussion>The operating system is required to display the DoD approved system use notification message or banner before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. This ensures the legal requirements for auditing and monitoring are met.
System use notification messages can be displayed when individuals log in to the information system. The approved DoD text must be used as specified in the DoD CIO memorandum dated 9 May 2008 (see the check text for required wording).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000048On BlackBerry Device Service:
1. To open the command window for the BlackBerry Enterprise Service 10 User Administration Tool, on the computer that hosts the tool, on the taskbar, click Start >> All Programs >> BlackBerry Resource Kit for BlackBerry Enterprise Service 10 >> BlackBerry Enterprise Service 10 User Administration Tool.
2. Type besuseradminclient <credentials> -set_owner_info -u <user_name>.
3. Perform any of the following actions:
• To specify the owner name to display, type -name "<name>".
• To specify a single line of text, type -info "I've read & consent to terms in IS user agreem't.".
• To specify multiple lines of text using an input file, type -infofile <filename>.
NOTE: This fix procedure affects both Personal and Work Spaces.From either the Work Space or Personal Space, while holding the Power button, select "Lock" to lock the device. Ensure "I've read & consent to terms in IS user agreem't." is displayed on the lock screen. Otherwise, this is a finding.SRG-OS-000028-MOS-000008<GroupDescription></GroupDescription>BB10-00-000110BlackBerry 10 OS must retain the work space lock until the user reestablishes access using established identification and authentication procedures.<VulnDiscussion>The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identification and authentication procedures.
A device lock is a temporary action taken when a user stops work, but does not want to log out because of the temporary nature of the hiatus. During the device lock, a publicly viewable pattern is visible on the associated display, hiding what was previously visible on the screen. Once invoked, the device lock shall remain in place until the user reauthenticates. No other system activity aside from reauthentication can unlock the system.
The operating system must enforce a device lock function. This prevents others from gaining access to the device when not in the user's possession, and from accessing sensitive DoD information. The identification and authentication procedure configuration must be set by a Mobile Device Management (MDM) service and be sufficiently complex to protect sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000056On BlackBerry Device Service, set "Password Required for Work Space" IT Policy rule to "Yes".From either the Work Space or Personal Space, navigate to "Settings -> BlackBerry Balance" and ensure "Work Password" is set to "On" and grayed out. Otherwise, this is a finding.SRG-OS-000028-MOS-000008<GroupDescription></GroupDescription>BB10-00-000120BlackBerry 10 OS must retain the device lock until the user reestablishes access using established identification and authentication procedures.<VulnDiscussion>The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identification and authentication procedures.
A device lock is a temporary action taken when a user stops work, but does not want to log out because of the temporary nature of the hiatus. During the device lock, a publicly viewable pattern is visible on the associated display, hiding what was previously visible on the screen. Once invoked, the device lock shall remain in place until the user reauthenticates. No other system activity aside from reauthentication can unlock the system.
The operating system must enforce a device lock function. This prevents others from gaining access to the device when not in the user's possession, and from accessing sensitive DoD information. The identification and authentication procedure configuration must be set by a Mobile Device Management (MDM) service and be sufficiently complex to protect sensitive data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000056From either the Work Space or Personal Space, navigate to "Settings -> Security and Privacy -> Device Password" and set "Enable Device Password" to "On". Create a 4-digit password for device lock.
NOTE: This fix procedure affects the Personal Space.From either the Work Space or Personal Space, navigate to "Settings -> Security and Privacy -> Device Password" and ensure "Device Password" is set to "On". Otherwise, this is a finding.SRG-OS-000029-MOS-000009<GroupDescription></GroupDescription>BB10-00-000130BlackBerry 10 OS must lock the Work Space after no more than 15 minutes of inactivity.<VulnDiscussion>The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identification and authentication procedures.
A device lock is a temporary action taken when a user stops work, but does not want to shut down because of the temporary nature of the hiatus. During the device lock, a publicly viewable pattern is visible on the associated display, hiding what was previously visible on the screen. Once invoked, the device lock shall remain in place until the user reauthenticates. No other system activity aside from reauthentication can unlock the system.
The operating system must lock the device after the organization defined time period. This prevents others from gaining access to the device when not in the user's possession, and from accessing sensitive DoD information. A device lock mitigates the risk that an adversary can access data on an unattended mobile device, but only after the maximum of a 15-minute period of inactivity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000057On BlackBerry Device Service, set "Lock Device After" IT Policy rule to "15 minutes".From either the Work Space or Personal Space, navigate to "Settings -> BlackBerry Balance", ensure "Lock Work Space After" is set to "15 Minutes", with higher values hidden. Otherwise, this is a finding.SRG-OS-000029-MOS-000009<GroupDescription></GroupDescription>BB10-00-000140BlackBerry 10 OS must prevent applications from extending the Work Space password lock time.<VulnDiscussion>The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identification and authentication procedures.
A device lock is a temporary action taken when a user stops work, but does not want to shut down because of the temporary nature of the hiatus. During the device lock, a publicly viewable pattern is visible on the associated display, hiding what was previously visible on the screen. Once invoked, the device lock shall remain in place until the user reauthenticates. No other system activity aside from reauthentication can unlock the system.
The operating system must lock the device after the organization defined time period. This prevents others from gaining access to the device when not in the user's possession, and from accessing sensitive DoD information. A device lock mitigates the risk that an adversary can access data on an unattended mobile device, but only after the maximum of a 15-minute period of inactivity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000057On BlackBerry Device Service, set "Application Security Timer Reset" IT Policy rule to "Disallow".On BlackBerry Device Service, verify "Application Security Timer Reset" IT Policy rule is set to "Disallow". Otherwise, this is a finding.SRG-OS-000056-MOS-000026<GroupDescription></GroupDescription>BB10-00-000150BlackBerry 10 OS must synchronize the internal clock at least once every 24 hours with an authoritative time server or the Global Positioning System.<VulnDiscussion>Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events.
Periodically synchronizing internal clocks with an authoritative time source is needed in order to correctly correlate the timing of events that occur across the enterprise. The two authoritative time sources for mobile operating systems are an authoritative time server which is synchronized with redundant United States Naval Observatory (USNO) time servers as designated for the appropriate DoD network (NIPRNet or SIPRNet) or the Global Positioning System (GPS).
Timestamps generated by the audit system in mobile operating systems shall include both date and time. The time may be expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000160From either the Work Space or Personal Space, navigate to "Settings -> Date and Time" and set "Set Date and Time Automatically" to "On".
NOTE: This fix procedure affects both Personal and Work Spaces.From either the Work Space or Personal Space, navigate to "Settings -> Date and Time" and ensure "Set Date and Time Automatically" is set to "On". Otherwise, this is a finding.SRG-OS-000069-MOS-000044<GroupDescription></GroupDescription>BB10-00-000160BlackBerry 10 OS must disallow the Work Space unlock password from containing fewer than a specified minimum number of upper case alphabetic characters.<VulnDiscussion>Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Setting minimum numbers of certain types of characters increases password complexity, and therefore makes it more difficult for an adversary to discover the password. In the DoD, the expectation is that the setting will range from a minimum of 1 to 2 upper case alphabetic characters in the device unlock password. The parameter should be selected based on a risk assessment that weighs factors, such as the environments the device will be located and operational requirements for users to access data in a timely manner.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000192On BlackBerry Device Service, set "Minimum Password Complexity" IT Policy rules to "At least one uppercase letter, one lowercase letter, one number, and one special character".From either the Work Space or Personal Space, navigate to "Settings -> BlackBerry Balance" and select "Change Password". Authenticate using the current password. Select "Password Rules" and under "Your password must contain all of the following:", "an uppercase letter" is listed. Otherwise, this is a finding.SRG-OS-000070-MOS-000045<GroupDescription></GroupDescription>BB10-00-000170BlackBerry 10 OS must disallow the Work Space unlock password from containing fewer than a specified minimum number of lower case alphabetic characters.<VulnDiscussion>Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Setting minimum numbers of certain types of characters increases password complexity, and therefore makes it more difficult for an adversary to discover the password. In the DoD, the expectation is that the setting will range from a minimum of 1 to 2 lower case characters in the device unlock password. The parameter should be selected based on a risk assessment that weighs factors, such as the environments the device will be located and operational requirements for users to access data in a timely manner.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000193On BlackBerry Device Service, set "Minimum Password Complexity" IT Policy rules to "At least one uppercase letter, one lowercase letter, one number, and one special character".From either the Work Space or Personal Space, navigate to "Settings -> BlackBerry Balance" and select "Change Password". Authenticate using the current password. Select "Password Rules" and under "Your password must contain all of the following:", "a lowercase letter" is listed. Otherwise, this is a finding.SRG-OS-000071-MOS-000046<GroupDescription></GroupDescription>BB10-00-000180BlackBerry 10 OS must disallow the Work Space unlock password from containing fewer than a specified minimum number of numeric characters.<VulnDiscussion>Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Setting minimum numbers of certain types of characters increases password complexity, and therefore makes it more difficult for an adversary to discover the password. In the DoD, the expectation is that the setting will range from a minimum of 1 to 2 numeric characters in the device unlock password. The parameter should be selected based on a risk assessment that weighs factors, such as the environments the device will be located and operational requirements for users to access data in a timely manner.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000194On BlackBerry Device Service, set "Minimum Password Complexity" IT Policy rules to "At least one uppercase letter, one lowercase letter, one number, and one special character".From either the Work Space or Personal Space, navigate to "Settings -> BlackBerry Balance" and select "Change Password". Authenticate using the current password. Select "Password Rules" and under "Your password must contain all of the following:", ensure "a number" is listed. Otherwise, this is a finding.SRG-OS-000078-MOS-000052<GroupDescription></GroupDescription>BB10-00-000210BlackBerry 10 OS must enforce a minimum length for the Work Space unlock password.<VulnDiscussion>Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute force attacks. The ability to crack a password is a function of how many attempts are made to crack the password, how quickly the adversary can make each attempt, and the size of the password space. The longer the minimum length of the password is, the larger the password space.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000205On BlackBerry Device Service, set "Minimum Password Length" IT Policy rule to 8.From either the Work Space or Personal Space, navigate to "Settings -> BlackBerry Balance" and select "Change Password". Authenticate using the current password. Select "Password Rules" and ensure "Your password must be at least 8 characters." Otherwise, this is a finding.SRG-OS-000103-MOS-000065<GroupDescription></GroupDescription>BB10-00-000220BlackBerry 10 OS must prevent a user from installing unapproved applications.<VulnDiscussion>The operating system must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what types of installations are prohibited (e.g., software whose pedigree with regard to being potentially malicious is unknown or suspect) by the organization. The installation and execution of unauthorized software on an operating system may allow the application to obtain sensitive information or further compromise the system. Preventing a user from installing unapproved applications mitigates this risk.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000663On BlackBerry Device Service, set "Restrict Development Mode" IT Policy rule to "Yes".
NOTE: This fix procedure affects the Personal Space.From either the Work Space or Personal Space, navigate to "Settings ->Security and Privacy -> Development Mode" and ensure "Use Development Mode" is set to "OFF" and grayed out. Otherwise, this is a finding.SRG-OS-000103-MOS-000066<GroupDescription></GroupDescription>BB10-00-000230BlackBerry 10 OS must only permit download of software from a DoD approved source (e.g., DoD operated mobile device application store or MDM server).<VulnDiscussion>DoD can perform due diligence on sources of software to mitigate the risk that malicious software is introduced to those sources. Therefore, if software is downloaded from a DoD approved source, then it is less likely to be malicious than if it is downloaded from an unapproved source. To prevent access to unapproved sources, the operating system, in most cases, can be configured to disable user access to public application stores. However, in some cases, DoD may approve downloads directly from the OS vendor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000663On BlackBerry Device Service:
1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand "Software -> Applications".
2. Click "Manage applications".
3. Delete all applications under "BlackBerry World Applications".
Open "BlackBerry World - Work" and select "Public Apps". If there are any apps listed under "Public Apps", this is a finding.SRG-OS-000116-MOS-000070<GroupDescription></GroupDescription>BB10-00-000240BlackBerry 10 OSs Wi-Fi module must use EAP-TLS authentication when authenticating to DoD WLAN authentication servers.<VulnDiscussion>Without strong mutual authentication, a mobile device may connect to an unauthorized network. In many cases, the user may falsely believe that the device is connected to an authorized network and then provide authentication credentials and other sensitive information. EAP-TLS is strong mutual authentication, leveraging a public key infrastructure. Its use greatly mitigates risk associated with authentication transactions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000780On BlackBerry Device Service,
select the affected Wi-Fi Profile, and set "Security Type" to "WPA Enterprise" or "WPA2 Enterprise", and "Security Sub Type" to "EAP-TLS".From either the Work Space or Personal Space, navigate to "Settings -> Network Connections -> Wi-Fi -> Saved" and select a saved DoD Wi-Fi profile to check. Ensure "Security Type" is set to "WPA Enterprise" or "WPA2 Enterprise" and "Security Sub Type" is set to "EAP-TLS". These options should be grayed out. Otherwise, this is a finding.
NOTE: Wi-Fi profiles, other than those connecting to DoD Wi-Fi networks, are not a finding. If no DoD Wi-Fi networks are saved,this requirement is NA.SRG-OS-000116-MOS-000073<GroupDescription></GroupDescription>BB10-00-000250BlackBerry 10 OS VPN client must employ DoD approved PKI mechanisms for authentication when connecting to DoD networks.<VulnDiscussion>VPNs are vulnerable to attack if they are not supported by strong authentication. An adversary may be able to gain access to network resources and sensitive information if they can compromise the authentication process. Common Access Card (CAC) authentication is a strong cryptographic two-factor authentication that greatly mitigates the risk of VPN authentication breaches. Other DoD approved PKI mechanisms provide similar levels of assurance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000780On BlackBerry Device Service, select the applicable VPN Profile and set "Authentication Type" to "PKI" or "XAUTH-PKI".From either the Work Space or Personal Space, navigate to "Settings -> Network Connections -> VPN ". Select and hold a VPN profile to check, and select "Edit Profile" to edit the VPN Profile.
For each VPN Profile connecting to DoD networks:
- Select the VPN Profile to edit.
- Ensure "Authentication Type" is set to "PKI" or "XAUTH-PKI" and grayed out. Otherwise, this is a finding.
NOTE: If the VPN Profile listed under "Settings -> Network Connections -> VPN" has a brief case logo on the right side, it is created on BlackBerry Device Service published to the device. "Authentication Type" for this VPN Profile will be grayed out and enforced. If no VPN profiles are saved, this requirement is NA.SRG-OS-000160-MOS-000080<GroupDescription></GroupDescription>BB10-00-000270BlackBerry 10 OSs VPN client must use either IPSec or SSL/TLS when connecting to DoD networks.<VulnDiscussion>Use of non-standard communications protocols can affect both the availability and confidentiality of communications. IPSec and SSL/TLS are both well-known and tested protocols that provide strong assurance with respect to both IA and interoperability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-001130On BlackBerry Device Service, select the affected VPN Profile for edit, and set "Gateway Type" to a type which supports and utilizes IPSec and SSL/TLS.
From either the Work Space or Personal Space, navigate to "Settings -> Network Connections -> VPN". Select "Edit" to edit a VPN Profile. For each VPN Profile connecting to DoD networks:
- Select the VPN Profile to edit.
- Ensure "Gateway Type" is set to a type which supports and utilizes IPSec and SSL/TLS. Otherwise, this is a finding.
NOTE: If no VPN profiles are saved, this requirement is NA.SRG-OS-000176-MOS-000098<GroupDescription></GroupDescription>BB10-00-000290BlackBerry 10 OS must prohibit the use of non-DoD authorized instant messaging (IM) systems.<VulnDiscussion>Many instant messaging systems have known vulnerabilities, some of which allow an adversary to install malware on the device. This malware can then be used to obtain sensitive information or further compromise DoD information systems. Restricting IM traffic to DoD authorized IM systems mitigates the risk of using IM technology.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-001154On BlackBerry Device Service:
1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand "Software -> Applications".
2. Click "Manage applications".
3.Delete the unauthorized IM system application.On BlackBerry Device Service:
1. In the BlackBerry Administration Service, on the BlackBerry solution management menu, expand "Software -> Applications".
2. Click "Manage applications".
3. If there are any unauthorized instant messaging systems listed, this is a finding.SRG-OS-000179-MOS-000101<GroupDescription></GroupDescription>BB10-00-000310Only DoD PKI issued or DoD approved software authentication certificates may be installed on the Work Space of the BlackBerry 10 OS.<VulnDiscussion>If unauthorized software authentication certificates are installed on the device, then the operating system would not block malware signed by the entity that published these certificates. Such malware could be used to obtain sensitive DoD information or to further breach system security. Eliminating unapproved software authentication certificates greatly mitigates the risk of malware passing authentication controls.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-001159On BlackBerry Device Service, remove the corresponding .pem file from <drive>:\<shared_network_folder>\Shared\Certificates\<ENTERPRISE/VPN/WIFI/www> folder.From the Work Space, navigate to "Settings -> Security and Privacy -> Certificates", and throughout different enterprise certificate stores ("Enterprise Root Certificates", "Enterprise Intermediate Certificates", and "Enterprise Client Certificates"), ensure the certificates listed originated from the BDS server. Certificates not originating from a DoD BDS server are a finding.
NOTE: Certificates in stores other than enterprise certificate stores do not apply.SRG-OS-000179-MOS-000102<GroupDescription></GroupDescription>BB10-00-000320Only DoD PKI issued or DoD approved server authentication certificates may be installed on the Work Space of the BlackBerry 10 OS.<VulnDiscussion>If unauthorized device authentication certificates are installed on the device, there is the potential that the device may connect to a rogue device or network. Rogue devices can mimic the behavior of authorized equipment to trick the user into providing authentication credentials, which could then in turn be used to compromise DoD information and networks. Restricting device authentication certificates to an authorized list mitigates the risk of attaching to rogue devices and networks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-001159On BlackBerry Device Service, remove the corresponding .pem file from <drive>:\<shared_network_folder>\Shared\Certificates\<ENTERPRISE/VPN/WIFI/www> folder.From the Work Space, navigate to "Settings -> Security and Privacy -> Certificates", and throughout different enterprise certificate stores ("Enterprise Root Certificates", "Enterprise Intermediate Certificates", and "Enterprise Client Certificates"), ensure the certificates listed originated from the BDS server. Certificates not originating from a DoD BDS server are a finding.
NOTE: Certificates in stores other than enterprise certificate stores do not apply.SRG-OS-000197-MOS-000107<GroupDescription></GroupDescription>BB10-00-000330BlackBerry 10 OS must prevent a user from using a browser that does not direct its Wi-Fi traffic to a DoD proxy server.<VulnDiscussion>Proxy servers can inspect traffic for malware and other signs of a security attack. Allowing a mobile device to access the public Internet without proxy server inspection forgoes the protection that the proxy server would otherwise provide. Malware downloaded onto the device could have a wide variety of malicious consequences, including loss of sensitive DoD information. Forcing traffic to flow through a proxy server greatly mitigates the risk of access to public Internet resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-001265On BlackBerry Device Service,
open the affected Wi-Fi Profile for edit, and set "Associated Proxy Profile" to the preconfigured Proxy Profile for DoD use.From either the Work Space or Personal Space, navigate to "Settings -> Network Connections -> Wi-Fi -> Saved Networks". For each saved network, ensure "Use HTTP Proxy" is set to "On" and grayed out with appropriate proxy information filled out (such as: "Proxy Server", "Proxy Port", "Username", "Password"). If "Use HTTP Proxy" is set to "Off", this is a finding.
NOTE: Proxy server information can be configured on the Wi-Fi profile. When configured, all traffic, including browser traffic, will flow through the configured proxy server.SRG-OS-000197-MOS-000107<GroupDescription></GroupDescription>BB10-00-000340BlackBerry 10 OS must prevent a user from using a browser that does not direct its VPN traffic to a DoD proxy server.<VulnDiscussion>Proxy servers can inspect traffic for malware and other signs of a security attack. Allowing a mobile device to access the public Internet without proxy server inspection forgoes the protection that the proxy server would otherwise provide. Malware downloaded onto the device could have a wide variety of malicious consequences, including loss of sensitive DoD information. Forcing traffic to flow through a proxy server greatly mitigates the risk of access to public Internet resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-001265On BlackBerry Device Service,
open the affected VPN Profile for edit, and set "Associated Proxy Profile" to the preconfigured Proxy Profile for DoD use.From either the Work Space or Personal Space, navigate to "Settings -> Network Connections -> VPN -> Edit". For each VPN profile, expand the configuration to "Advanced" and ensure the "Use Proxy" checkbox is checked and grayed out, with appropriate proxy information filled out (such as: "Proxy Server", "Proxy Port", "Username", "Password"). If the "Use Proxy" checkbox is unchecked, this is a finding.
NOTE: Proxy server information can be configured on the VPN profile. When configured, all traffic, including browser traffic, will flow through the configured proxy server.SRG-OS-000229-MOS-000117<GroupDescription></GroupDescription>BB10-00-000360BlackBerry 10 OS must employ mobile device management services to centrally manage IT Policies.<VulnDiscussion>Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000370On BlackBerry Device Service:
1. Navigate to "BlackBerry solution management -> User -> Manage users -> <affected user's device PIN>".
2. Select "Resend IT Policy to a device".From either the Work Space or Personal Space, navigate to "Settings -> About -> Work Space". Under "IT Policy", verify "Policy Name" value is identical to the name of the IT Policy assigned from BDS. Otherwise, this is a finding.SRG-OS-000229-MOS-000117<GroupDescription></GroupDescription>BB10-00-000370BlackBerry 10 OS must employ mobile device management services to centrally manage email settings.<VulnDiscussion>Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000370On BlackBerry Device Service:
1. Navigate to "BlackBerry solution management -> Profiles -> Manage email profiles".
2. Ensure all required profiles are listed. If not, create necessary profiles by navigating to "BlackBerry solution management -> Profiles -> Create email profiles".
3. Assign all required email profiles to affected user, or a group the user is a part of.From the Work Space, navigate to "Settings -> Accounts". Verify all required work accounts (with a briefcase icon) are present. Otherwise, this is a finding.SRG-OS-000229-MOS-000117<GroupDescription></GroupDescription>BB10-00-000380BlackBerry 10 OS must employ mobile device management services to centrally manage Wi-Fi profiles.<VulnDiscussion>Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000370On BlackBerry Device Service:
1. Navigate to "BlackBerry solution management -> Profiles -> Manage Wi-Fi Profiles".
2. Ensure all required profiles are listed. If not, create necessary profiles by navigating to "BlackBerry solution management -> Profiles -> Create Wi-Fi Profiles".
3. Assign all required Wi-Fi profiles to affected user, or a group the user is a part of.From either the Work Space or Personal Space, navigate to "Settings -> Network Connections -> Wi-Fi -> Saved". Verify all required work Wi-Fi profiles (with a briefcase icon) are present. Otherwise, this is a finding.
NOTE: Additional profiles without the breifcase icon are permitted and are not a finding.SRG-OS-000229-MOS-000117<GroupDescription></GroupDescription>BB10-00-000390BlackBerry 10 OS must employ mobile device management services to centrally manage VPN profiles.<VulnDiscussion>Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000370On BlackBerry Device Service:
1. Navigate to "BlackBerry solution management -> Profiles -> Manage VPN Profiles".
2. Ensure all required profiles are listed. If not, create necessary profiles by navigating to "BlackBerry solution management -> Profiles -> Create VPN Profiles".
3. Assign all required VPN profiles to affected user, or a group the user is a part of.From either the Work Space or Personal Space, navigate to "Settings -> Network Connections -> VPN". Verify all required work VPN profiles (with a briefcase icon) are present. Otherwise, this is a finding.SRG-OS-000231-MOS-000121<GroupDescription></GroupDescription>BB10-00-000410BlackBerry 10 OS must prohibit wireless remote access connections for storage.<VulnDiscussion>The device acts as a personal hotspot when it accepts remote connections on a local area network interface for the purposes of routing traffic to a wide area network interface. The most common implementation is to accept local area Wi-Fi connections to reach ISP service provided by a cellular data carrier. The objective is to ensure the remote devices are not able to access any applications, data, or other operating system functionality on the device. A core assumption of the MOS SRG is that mobile devices do not serve applications to remote devices. If remote access to applications and data were feasible, this would open up a wide variety of vulnerabilities in which an adversary with a remote wireless capability could breach system security. Precluding this possibility greatly mitigates the risk of such an attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000066From either the Work Space or Personal Space, navigate to "Settings -> Storage and Access" and set "Access using Wi-Fi" to "Off".
NOTE: This fix procedure affects the Personal Space.From either the Work Space or Personal Space, navigate to "Settings -> Storage and Access" and ensure "Access using Wi-Fi" is set to "Off". Otherwise, this is a finding.SRG-OS-000231-MOS-000121<GroupDescription></GroupDescription>BB10-00-000420BlackBerry 10 OS must prohibit wireless remote access connections for media sharing<VulnDiscussion>The device acts as a personal hotspot when it accepts remote connections on a local area network interface for the purposes of routing traffic to a wide area network interface. The most common implementation is to accept local area Wi-Fi connections to reach ISP service provided by a cellular data carrier. The objective is to ensure the remote devices are not able to access any applications, data, or other operating system functionality on the device. A core assumption of the MOS SRG is that mobile devices do not serve applications to remote devices. If remote access to applications and data were feasible, this would open up a wide variety of vulnerabilities in which an adversary with a remote wireless capability could breach system security. Precluding this possibility greatly mitigates the risk of such an attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000066From the Work Space, navigate to "Settings -> Media Sharing" and set all of "Share Music", "Share Pictures" and "Share Videos" to "Off".
NOTE: This fix procedure affects the Personal Space.From either the Work Space or Personal Space, navigate to "Settings -> Media Sharing" and ensure all of "Share Music", "Share Pictures", and "Share Videos" are set to "Off". Otherwise, this is a finding.SRG-OS-999999-MOS-000139<GroupDescription></GroupDescription>BB10-00-000430BlackBerry 10 OS must enable a system administrator to select which data fields will be available to applications outside of the contact database application.<VulnDiscussion>The contact database often contains a significant amount of information beyond each person's name and phone number. The records may contain addresses and other identifying or sensitive information that should not be revealed. There may be cases in which an organization has determined that it is an acceptable risk to distribute parts of a person's contact record but not others. Enabling the system administrator to select which fields are available outside the contact database application assists with management of the risk.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000366On BlackBerry Device Service, set "Personal Apps Access to Work Contacts" IT Policy rule to "Only RIM Apps".
NOTE: This fix procedure affects both Personal and Work Spaces.On BlackBerry Device Service:
Ensure "Personal Apps Access to Work Contacts" IT Policy rule is set to "Only RIM Apps". Otherwise, this is a finding.SRG-OS-000192-MOS-000104<GroupDescription></GroupDescription>BB10-00-000325BlackBerry 10 OS must be updated to the latest approved version of the operating system.<VulnDiscussion>Operating system updates contain new security related features and security patches that address known vulnerabilities. Running the latest DoD approved software version improves the security posture of the mobile device.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-001237From either the Work Space or Personal Space, navigate to “Settings -> Software Updates” and select “Check for Updates”.
NOTE: This fix procedure affects both Personal and Work Spaces.From either the Work Space or Personal Space, navigate to “Settings -> About” and ensure “Software Release” indicates version 10.1.X.X. Otherwise, this is a finding.SRG-OS-000138-MOS-000076<GroupDescription></GroupDescription>BB10-00-003360BlackBerry 10 OS must prevent DoD applications from accessing non-DoD data when the device supports multiple user environments (e.g., work and personal) if such access has not been approved.<VulnDiscussion>When a device is used for more than one purpose (e.g., work and personal) there is the potential for information from one environment to migrate inappropriately over into the other environment. Therefore, it is critical for DoD applications and information be restricted from non-DoD applications and information. In many cases, the presence of non-DoD data on DoD information systems violates either local or department guidelines.
In the context of this IA control, a DoD application is an application that processes DoD data. The characteristics of being distributed through a DoD application store, or digitally signed or repacked by a DoD entity, do not by themselves make the application a DoD application. For example, a weather or map application signed and distributed from a DoD application store would not be a DoD application unless the weather, map, or other data was considered DoD data.
The mobile operating system must prevent this occurrence using appropriate technical controls to mitigate the risk of data leakage. The objective is to provide appropriate separation between each environment on the device.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-001090On BlackBerry Device Service, set "Work App Access to Shared Files in the Personal Space" IT Policy rule to "Disallow".On BlackBerry Device Service, verify
"Work App Access to Shared Files in the Personal Space" IT Policy rule is set to "Disallow". Otherwise, this is a finding.SRG-OS-000067-MOS-000042<GroupDescription></GroupDescription>BB10-00-003320BlackBerry 10 OS must enforce complexity requirements for the authentication to access private keys saved in the key certificate stores.<VulnDiscussion>The cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, this will lead to the compromise of the authentication and non-repudiation gained through PKI because the attacker can use the private key to digitally sign documents and can pretend to be the authorized user.
Allowing unauthenticated access to private keys can enable an adversary in possession of the device to decrypt messages encrypted with the public key and to digitally sign data, thereby potentially enabling an adversary to impersonate the user in any application that uses that private key for user authentication. Requiring complexity requirements for the authentication to access keys saved in the certificate store protects sensitive information. A weak password may enable an adversary to crack it, and give it the ability to use the private key to decrypt sensitive information or improperly impersonate the user of the device.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000186On BlackBerry Device Service, set "Password Required for Work Space" IT Policy rule to "Yes".From either the Work Space or Personal Space, navigate to "Settings -> BlackBerry Balance" and ensure "Work Password" is set to "On" and grayed out. Otherwise, this is a finding.SRG-OS-000167-MOS-000088<GroupDescription></GroupDescription>BB10-00-003400BlackBerry 10 OS must support both software-based and hardware-based asymmetric key technology (e.g., CAC/PIV).<VulnDiscussion>Software-based certificates are required to authenticate many web sites. Hardware-based tokens are embedded in the DoD Common Access Card (CAC). Without both software and hardware-based asymmetric key technology, there is the potential that critical authentication transactions cannot occur. This will either hinder performance of the mission or degrade the IA posture of one or more applications. If the operating system can support both software and hardware-based asymmetric key technology, this provides assurance that all required certificate-based transactions are supported.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>VMS Target BlackBerry OS 10.xDISA FSOVMS TargetBlackBerry OS 10.x2457CCI-000366CCI-001142From either the Work Space or Personal Space, navigate to "Settings -> Security and Privacy" and verify "Smart Card" option is present. Otherwise, this is a finding.From either the Work Space or Personal Space, navigate to "Settings -> Security and Privacy" and verify "Smart Card" option is present. Otherwise, this is a finding.SRG-OS-000167-MOS-000086<GroupDescription></GroupDescription>BB10-00-000280BlackBerry 10 OS must have access to DoD root and intermediate PKI certificates when performing DoD PKI related transactions.<VulnDiscussion>DoD root and intermediate PKI certificates are used to verify the authenticity of PKI certificates of users and web services. If the root and intermediate certificates are not available, an adversary could falsely sign a certificate in such a way that it could not be detected. Providing access to the DoD root and intermediate PKI certificates greatly diminishes the risk of this attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000366CCI-001142On BlackBerry Device Service, verify the "SCEP Profile" is configured properly for DoD SCEP server. Ensure DoD certificates are available through SCEP.From the Work Space, navigate to "Settings -> Security and Privacy -> Certificates", and inspect "Enterprise Root Certificates" and "Enterprise Intermediate Certificates" stores. If DoD root and intermediate PKI certificates are not in the stores, this is a finding.SRG-OS-000177-MOS-000099<GroupDescription></GroupDescription>BB10-00-000300BlackBerry 10 OS must grant a downloaded application only the permissions that DoD has authorized for that application.<VulnDiscussion>Mobile operating system applications that are able to perform unintended functions may be able to obtain sensitive information or otherwise compromise system security. The permissions that an application requires to perform its function may be delineated in a permissions manifest or in entitlements that are either bound to the application or embedded in its code. Enforcing these permissions limitations is necessary to ensure the application is not permitted to perform unintended functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000366CCI-001157From the Work Space, navigate to "Settings -> Security and Privacy -> Application Permissions" and select "All" in "Permissions" dropdown box. For each application, set requested permission (e.g. Location, Contacts, Shared Files, etc.) to "On" or "Off" as authorized by DoD.
NOTE: This fix procedure affects both Personal and Work Spaces.From the Work Space, navigate to "Settings -> Security and Privacy -> Application Permissions" and select "All" in the "Permissions" dropdown box. For each application, ensure the requested permissions (e.g., Location, Contacts, Shared Files, etc.) are set to "On" only for DoD authorized permissions. Otherwise, this is a finding.
NOTE: If no applications are installed, this requirement is NA.SRG-OS-000227-MOS-000116<GroupDescription></GroupDescription>BB10-00-000350BlackBerry 10 OS maximum number of consecutive unsuccessful unlock attempts must be configurable within a range from 5 to 10.<VulnDiscussion>The recommended setting for the maximum number of consecutive unsuccessful unlock attempts is 10. In some environments, a lower number may be needed to provide greater protection of sensitive information. Allowing for configuration enables the local command to enforce greater protection when it is deemed necessary. If the limit is not configurable, then it is permissible for a site to procure and deploy devices that enforce the limit specified by the organization, so long as that limit does not exceed 10.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000366CCI-001383On BlackBerry Device Service, set "Maximum Password Attempts" IT Policy rule to 10 (or the organization defined value).From either the Work Space or Personal Space, navigate to "Settings -> BlackBerry Balance. Under "Work Password", ensure the maximum value in the "Password attempt limit" drop down box is not greater than 10 (or organization defined number). Otherwise, this is a finding.SRG-OS-000197-MOS-000107<GroupDescription></GroupDescription>BB10-00-000335BlackBerry 10 OS must use a DoD proxy server.<VulnDiscussion>Proxy servers can inspect traffic for malware and other signs of a security attack. Allowing a mobile device to access the public Internet without proxy server inspection forgoes the protection that the proxy server would otherwise provide. Malware downloaded onto the device could have a wide variety of malicious consequences, including loss of sensitive DoD information. Forcing traffic to flow through a proxy server greatly mitigates the risk of access to public Internet resources.
Proxy profiles specify how users use a proxy server to access web services on the Internet or on the DoD network. A proxy profile can be associated with a Wi-Fi profile or VPN profile. For users to use a proxy server when they connect to the Internet or the DoD network using the BlackBerry Infrastructure, associate a proxy profile with a BlackBerry Device Service instance. To add a proxy profile to a BlackBerry Device Service instance, all devices running BlackBerry 10 OS associated with the instance use the proxy profile to access web services on the Internet or DoD's network using the BlackBerry Infrastructure. Devices use the BlackBerry Infrastructure when a VPN or Wi-Fi connection is not available.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-001265On BlackBerry Device Service, navigate to the Servers and components menu and expand BlackBerry Solution topology >> BlackBerry Domain >> Component view >> BlackBerry Device Service. Click the name of the BlackBerry Device Service instance and click Edit instance. In the Instance associations section, in the Proxy profile drop-down list, select the preconfigured Proxy Profile for DoD use. Click Save all.On BlackBerry Device Service, navigate to the Servers and components menu and expand BlackBerry Solution topology >> BlackBerry Domain >> Component view >> BlackBerry Device Service. Click the name of the BlackBerry Device Service instance. Verify in the Instance associations pane, the preconfigured Proxy Profile for DoD use is shown as the value for the Proxy profile. If the preconfigured Proxy Profile for DoD use is not shown for the value for the Proxy profile. this is a finding.SRG-OS-999999-MOS-999999<GroupDescription></GroupDescription>BB10-00-000000BlackBerry 10 OS versions no longer supported by the manufacturer or vendor must not be installed on a device.<VulnDiscussion>Unsupported versions of the operating system do not contain new security-related features and security patches that address known vulnerabilities. Software or hardware no longer supported by the manufacturer or vendor are not maintained or updated for current vulnerabilities leaving them open to potential attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>DPMS Target BlackBerry OS 10.xDISA FSODPMS TargetBlackBerry OS 10.x2457CCI-000366Update or replace the BlackBerry 10 smartphone to version 10.2.x or higher and apply the BlackBerry 10.2.x OS STIG.Navigate to "Settings -> About" and then "Software Release"; note the version. If the version indicated is 10.1.x or lower, this is a finding. If the version indicated is 10.2.x or higher, the BlackBerry 10.2.x OS STIG must be applied.