An Application White List software configuration must be assigned to all BES user accounts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-16341	WIR1310-01	SV-17334r6_rule	ECSC-1	High

Description
The primary BlackBerry malware control is to set up one or more Application White List software configurations on the BES. Every user and group account must be assigned at least one Application White List software configuration. In an Application White List, the use of all non-core applications is denied unless an application is expressly allowed.

STIG	Date
BlackBerry Enterprise Server, Part 2 Security Technical Implementation Guide	2011-04-11

Details

Check Text ( C-14175r6_chk )
Check the BES to see if an Application White List software configuration has been assigned to each BES user account. (Note: Section 3.2.5.2 of the BlackBerry STIG Overview has instructions for setting up an Application White List software configuration and assigning it to a user or a group account.) For BES 5.0 -BAS > BlackBerry solution management > User > Manage users -Select at least 20 user accounts from differenct offices or sites on the BES at random and do the following: Click on the user account name. Click on the Software configuration tab. **Note the name of the software configuration assigned to the user (this will be the assigned “Application White List”). The name should be in a similar format to the following: “DISA Application White List 1.” For BES 4.1.x Review each user account on the BES and make a list of the software configuration assigned to each user: - In BlackBerry Manager, click on BlackBerry Domain. - Select the “All Users” tab. - If “Configuration Name” is not listed as one of the column headings, do the following: -Right click on the “Name” column heading. -In the “Column Chooser” dialog box, add “Configuration Name” to the list of columns listed under the “Visible columns” window. -Move the “Configuration Name” column up the list until it is listed immediately after the “Name” column. -Click “OK” to close the dialog box. The “Configuration Name” column should now be shown. - Click on the “Configuration Name” column heading to sort the list of users by Software Configuration. -Note the name of the software configuration assigned to the user (this will be the assigned “Application White List”). The name should be in a similar format to the following: “DISA Application White List 1.” Mark as a finding if any user account has not been assigned an Application White List software configuration. (Note that the required configuration of the Application White List will be verified in checks WIR1310-02 and WIR1310-03.)

Check Text ( C-14175r6_chk )

Check the BES to see if an Application White List software configuration has been assigned to each BES user account.

(Note: Section 3.2.5.2 of the BlackBerry STIG Overview has instructions for setting up an Application White List software configuration and assigning it to a user or a group account.)

For BES 5.0
-BAS > BlackBerry solution management > User > Manage users

-Select at least 20 user accounts from differenct offices or sites on the BES at random and do the following:
**Click on the user account name.
**Click on the Software configuration tab.
**Note the name of the software configuration assigned to the user (this will be the assigned “Application White List”). The name should be in a similar format to the following: “DISA Application White List 1.”

For BES 4.1.x
Review each user account on the BES and make a list of the software configuration assigned to each user:
- In BlackBerry Manager, click on BlackBerry Domain.
- Select the “All Users” tab.
- If “Configuration Name” is not listed as one of the column headings, do the following:
-Right click on the “Name” column heading.
-In the “Column Chooser” dialog box, add “Configuration Name” to the list of columns listed under the “Visible columns” window.
-Move the “Configuration Name” column up the list until it is listed immediately after the “Name” column.
-Click “OK” to close the dialog box. The “Configuration Name” column should now be shown.
- Click on the “Configuration Name” column heading to sort the list of users by Software Configuration.
-Note the name of the software configuration assigned to the user (this will be the assigned “Application White List”). The name should be in a similar format to the following: “DISA Application White List 1.”

Mark as a finding if any user account has not been assigned an Application White List software configuration. (Note that the required configuration of the Application White List will be verified in checks WIR1310-02 and WIR1310-03.)

Fix Text (F-23364r1_fix)
An application White List software configuration must be assigned to all BES user accounts.