| BBDS-00-000315 | High | The BlackBerry Device Service server must use mechanisms for authentication to a cryptographic module meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication. | MDM applications utilizing encryption are required to use approved encryption modules that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations,... |
| BBDS-00-000131 | High | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable two-factor encryption key generation on the mobile device. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000115 | High | BlackBerry accounts must not be assigned to the default IT policy on the BlackBerry Device Service server or any other non-STIG compliant IT policy. | The BlackBerry default policy on the BDS server does not include many DoD required security policies for data encryption, authentication, and access control. DoD enclaves are at risk of data... |
| BBDS-00-000110 | High | The BlackBerry Device Service server must prevent the installation of applications that are not digitally signed with an organizationally accepted private key. | Any additions of applications can potentially have significant effects on the overall security of the system. Digital signatures on code provide assurance that the code comes from a known source... |
| BBDS-00-003176 | High | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Disable any mobile OS service that connects to a cloud storage server. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-003177 | High | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Direct all work persona application traffic through the BlackBerry Device Service server. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000330 | High | The BlackBerry Device Service server must be able to filter both inbound and outbound traffic based on IP address and UDP/TCP port. | A host-based boundary protection mechanism is a host-based firewall. Host-based boundary protection mechanisms are employed on mobile devices, such as notebook/laptop computers, and other types... |
| BBDS-00-003131 | High | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Disallow mobile device applications the ability to reset the device lock timer. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000295 | High | The BlackBerry Device Service server must use organization defined replay-resistant authentication mechanisms for network access to privileged accounts. | An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Replay attacks, if... |
| BBDS-00-000290 | High | The BlackBerry Device Service server must require administrators to be authenticated with an individual authenticator prior to using a group authenticator. | To assure individual accountability and prevent unauthorized access, MDM administrators and users (and any processes acting on behalf of users) must be individually identified and authenticated. ... |
| BBDS-00-000320 | High | The BlackBerry Device Service server must employ strong identification and authentication techniques in the establishment of non-local maintenance and diagnostic sessions. | Lack of authentication enables anyone to gain access to the MDM. Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy.... |
| BBDS-00-000100 | High | The BlackBerry Device Service server must implement separation of administrator duties by requiring a specific role be assigned to each administrator account. | Separation of duties supports the management of individual accountability and reduces the power of one individual or administrative account. Employing a separation of duties model reduces the... |
| BBDS-00-000340 | High | The BlackBerry Device Service server must detect and report the version of the operating system, device drivers, and application software for managed mobile devices. | Organizations are required to identify information systems containing software affected by recently announced software flaws (and potential vulnerabilities resulting from those flaws) and report... |
| BBDS-00-002541 | High | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Disable copying data from inside a non-secure data area on a mobile device into the security container. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000156 | High | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable the transfer of any file-based data via Bluetooth. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000285 | Medium | BlackBerry Web Desktop Manager must be configured to disable a user's capability to perform self-service tasks. | The overall security posture of the BlackBerry system is dependent on strict configuration management controls, including ensuring only authorized BlackBerry devices are being used and authorized... |
| BBDS-00-000170 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable MMS messaging. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000280 | Medium | The BlackBerry Device Service server must provide the administrative functionality to specify a list of approved applications that must be installed on the mobile device and cannot be removed by the user. | DoD can perform due diligence on sources of software to mitigate the risk that malicious software is introduced to those sources. Therefore, if software is downloaded from a DoD approved source,... |
| BBDS-00-000165 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Bluetooth 128 bit encryption. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000150 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable Bluetooth. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000135 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Set the device inactivity timeout (the following settings must be available, at a minimum: Disable (no timeout), 15 minutes, and 60 minutes). | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000260 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Minimum MDM agent password length of eight or more characters. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000155 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable the Bluetooth discoverable mode. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000132 | Medium | If the BlackBerry Device Service server includes a mobile email management capability, the email client S/MIME encryption algorithm must be 3DES or AES. When AES is used, AES 128 bit encryption key length is the minimum requirement; AES 256 desired. | Cryptography is only as strong as the encryption modules/algorithms that are employed to encrypt the data. Strong encryption must be used to protect the integrity and confidentiality of the data.... |
| BBDS-00-000130 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable data-at-rest encryption on the mobile device. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000240 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Set the number of upper case letters in the MDM agent password. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000225 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Perform a "Data Wipe" function whereby all data stored in the security container is erased when the maximum number of incorrect passwords for the security container application has been reached. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000245 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Set the number of numbers in the MDM agent password. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000220 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable tethering (Wi-Fi, Bluetooth, or USB). | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000205 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable location services. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000160 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Bluetooth pairing using a randomly generated passkey size of at least 8 digits. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000175 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable Wi-Fi. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000195 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable the memory card port. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000190 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable the all cameras. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000200 | Medium | BlackBerry Web Desktop Manager must be configured to permit users to activate new BlackBerry devices only. | The overall security posture of the BlackBerry system is dependent on strict configuration management controls, including ensuring only authorized BlackBerry devices are being used and authorized... |
| BBDS-00-003178 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Disallow personal persona applications access to the work personas network connection. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-003179 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Disallow hyperlinks within work persona applications from opening within the personal persona browser application. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000140 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable the mobile device Bluetooth stack. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000305 | Medium | The BlackBerry Device Service server must support administrator authentication to the server via the Enterprise Authentication Mechanism's authentication. | In the DoD, Administrator credential requirements for authentication are defined by CTO 07-115Rev1, which is usually enforced by the Enterprise Authentication Mechanism. Non-complaint credential... |
| BBDS-00-000166 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Bluetooth radio range. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000300 | Medium | The BlackBerry Device Service server must be configured to accept only trusted connections to back-office enclave application or web push servers. Push servers are set up to push content to BlackBerry users. | Device authentication is a solution enabling an organization to manage both users and devices. This requirement applies to MDM servers that provide mobile device and user access to network shares,... |
| BBDS-00-000270 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Set the MDM agent inactivity timeout (the following settings must be available, at a minimum: Disable (no timeout), 15 minutes, and 60 minutes). | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000145 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable any supported Bluetooth profile. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000120 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Perform a "Data Wipe" function whereby all data stored in user addressable memory on the mobile device and the removable memory card is erased when the maximum number of incorrect passwords for device unlock has been reached. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000250 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Set the number of special characters in the MDM agent password. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000105 | Medium | The BlackBerry Device Service server must deploy operating system and application updates via over-the-air (OTA) provisioning for managed mobile devices. | Without the MDM ability to deploy operating systems and application updates over the air, it is possible for the mobile devices under the MDM's control to be susceptible to a zero day attack. ... |
| BBDS-00-000265 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Maximum MDM agent password history (3 previous passwords checked is the recommended setting). | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000255 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Maximum MDM agent password age (e.g., 30 days, 90 days, or 180 days). | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000230 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Set the number of incorrect password attempts before a data wipe procedure is initiated (minimum requirement is 3-10). | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000215 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable the USB Port mass storage mode. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000235 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable an MDM agent password. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000210 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable the video recorder. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-002543 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Disable access to the work persona via any device-to-device bridging application. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000185 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable the near-field communications (NFC) radio. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000180 | Medium | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable the Voice recorder. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000275 | Medium | The BlackBerry Device Service server must configure the mobile device agent to prohibit the download of software from a DoD non-approved source (e.g., DoD operated mobile device application store or BlackBerry Device Service server). | DoD can perform due diligence on sources of software to mitigate the risk that malicious software is introduced to those sources. Therefore, if software is downloaded from a DoD approved source,... |
| BBDS-00-000287 | Low | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Disallow any native applications pertaining to billing on a managed mobile device. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000310 | Low | The key store password for the certificate that the BlackBerry Administration Service (BAS) and BlackBerry Web Desktop Manager (BWDM) use must be changed from the default. | The key store password protects the server digital authentication certificates from unauthorized use. |
| BBDS-00-002431 | Low | The BlackBerry Device Service server must protect audit information on a managed mobile device from unauthorized distribution. | Audit data is considered sensitive, and is intended to be read by the System Administrator only. Allowing non-administrators access to this data could expose vulnerabilities in the system.
|
| BBDS-00-003180 | Low | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Set the number of allowed repeated characters in the mobile device unlock password. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-003110 | Low | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Enable or disable device unlock password. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-003130 | Low | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Device inactivity timeout whereby the user must reenter their user password or Smart Card PIN to unlock the device. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000335 | Low | The BlackBerry Device Service server must be configured so the connection between the BlackBerry Device Service server and the mobile device is initiated based on an out-bound connection request from the BlackBerry Device Service server only. | By configuring the BlackBerry Device Service server to connect to the mobile device on an out-bound connection, the traffic is segregated which made it more difficult for an intruder to compromise... |
| BBDS-00-003185 | Low | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Disallow sequential numbers in the mobile device unlock password. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000325 | Low | The server PKI digital certificate installed on the BlackBerry Device Service (BDS) Server to support BlackBerry Administration Service and BlackBerry Web Desktop Manager (BWDM) authentication must be a DoD PKI issued certificate. A self signed certificate will not be used. | When a self signed PKI certificate is used, a rogue BDS server can impersonate the DoD BDS server during SA connections to the BAS or when a BlackBerry user uses BWDM to connect to the BAS. In... |
| BBDS-00-000286 | Low | BlackBerry Device Service must be configured to disable a user's capability to perform a user initiated backup or restore of the work persona of a managed mobile device. | The overall security posture of the BlackBerry system is dependent on strict configuration management controls, including ensuring only authorized BlackBerry devices are being used and authorized... |
| BBDS-00-002542 | Low | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Allow only work persona contacts to be read from a native personal persona application. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-000288 | Low | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Disallow any native applications pertaining to billing on a managed mobile device. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
| BBDS-00-003120 | Low | The BlackBerry Device Service server must have the administrative functionality to centrally manage the following security policy rule on managed mobile devices: Minimum password length for the device unlock password is configured to the organizationally defined value when DoD sensitive data is being protected. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
