The BlackBerry Enterprise Mobility Server (BEMS) must be configured with an inactivity timeout of 15 minutes or less.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-79027	BEMS-00-013700	SV-93733r2_rule		Medium

Description
A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their application session prior to vacating the vicinity, applications need to be able to identify when a user's application session has idled and take action to initiate the session lock.

Description

A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their application session prior to vacating the vicinity, applications need to be able to identify when a user's application session has idled and take action to initiate the session lock.

STIG	Date
BlackBerry Enterprise Mobility Server 2.x Security Technical Implementation Guide	2020-05-15

Details

Check Text ( C-78615r2_chk )
Verify the BEMS inactivity timeout is set to 15 minutes or less as follows: 1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server. 2. Find the "maxIdleTime" field. (Note: “idelTimeout” may be the field, depending on the version of BEMS) 3. Verify it is set to 900 or less (seconds). (Note: time may be in milliseconds, depending on the version of BEMS. In this case, the value is 900000.) If the BEMS inactivity timeout is not set to 15 minutes (900 seconds) or less, this is a finding.

Check Text ( C-78615r2_chk )

Verify the BEMS inactivity timeout is set to 15 minutes or less as follows:

1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "maxIdleTime" field. (Note: “idelTimeout” may be the field, depending on the version of BEMS)
3. Verify it is set to 900 or less (seconds). (Note: time may be in milliseconds, depending on the version of BEMS. In this case, the value is 900000.)

If the BEMS inactivity timeout is not set to 15 minutes (900 seconds) or less, this is a finding.

Fix Text (F-85777r2_fix)
Configure BEMS with an inactivity timeout of 15 minutes or less. 1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server. 2. Find the "maxIdleTime" field and set it to 900 or less (seconds). (Note: “idelTimeout” may be the field and time may be in milliseconds, depending on the version of BEMS. In this case, the value is 900000.) 3. Save the file. 4. Restart the BEMS server.

Fix Text (F-85777r2_fix)

Configure BEMS with an inactivity timeout of 15 minutes or less.

1. Find the xml file "jetty.xml" located in the BEMS install directory on the BEMS host Windows server.
2. Find the "maxIdleTime" field and set it to 900 or less (seconds). (Note: “idelTimeout” may be the field and time may be in milliseconds, depending on the version of BEMS. In this case, the value is 900000.)
3. Save the file.
4. Restart the BEMS server.