UCF STIG Viewer Logo

BlackBerry 10 OSs Wi-Fi module must use EAP-TLS authentication when authenticating to DoD WLAN authentication servers.


Finding ID Version Rule ID IA Controls Severity
V-38304 BB10-00-000240 SV-50104r2_rule Medium
Without strong mutual authentication, a mobile device may connect to an unauthorized network. In many cases, the user may falsely believe that the device is connected to an authorized network and then provide authentication credentials and other sensitive information. EAP-TLS is strong mutual authentication, leveraging a public key infrastructure. Its use greatly mitigates risk associated with authentication transactions.
BlackBerry 10 OS Security Technical Implementation Guide 2014-08-27


Check Text ( C-45851r3_chk )
From either the Work Space or Personal Space, navigate to "Settings -> Network Connections -> Wi-Fi -> Saved" and select a saved DoD Wi-Fi profile to check. Ensure "Security Type" is set to "WPA Enterprise" or "WPA2 Enterprise" and "Security Sub Type" is set to "EAP-TLS". These options should be grayed out. Otherwise, this is a finding.

NOTE: Wi-Fi profiles, other than those connecting to DoD Wi-Fi networks, are not a finding. If no DoD Wi-Fi networks are saved,this requirement is NA.
Fix Text (F-43242r3_fix)
On BlackBerry Device Service,
select the affected Wi-Fi Profile, and set "Security Type" to "WPA Enterprise" or "WPA2 Enterprise", and "Security Sub Type" to "EAP-TLS".