The BlackBerry wireless email system must be set up with the required system components and software installed on the handheld device.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-14022	WIR1300-01	SV-14633r3_rule	ECSC-1	High

Description
The wireless email server architecture must comply with the DoD environment because approval of the BES is contingent on installation with the correct settings. DoD enclaves could be at risk of penetration or DoD data could be compromised if BES is not installed as required.

STIG	Date
BlackBerry Enterprise Server (version 5.x), Part 2 Security Technical Implementation Guide	2015-07-02

Details

Check Text ( C-14979r3_chk )
Detailed Policy Requirements: The BlackBerry wireless email system must be set up with the required system components and software installed on the handheld device. - The BES is installed and configured using either the architecture shown in Figure 2-1 (non-segmented architecture) or alternate segmented architecture shown in Figure 2-2 in the BlackBerry STIG Overview. - The BES and all other systems providing BlackBerry services (e.g., email server and LDAP server) are protected behind a corporate firewall. - The BES has a host-based firewall (e.g., McAfee Personal Firewall, Norton Personal Firewall) and/or dedicated hardware firewall. It is recommended that a BES site use the pre-configured, STIG compliant, IT policy that is provided with the STIG. This method increases compliance and reduces the chance of required configuration settings not being configured correctly. Check Procedures: Interview the ISSO and system administrator and review system network diagrams. Verify logical connectivity complies with the requirements of one of the approved architectures (view Figure 2-1 or Figure 2-2 of the BlackBerry STIG Overview) to see example architectures. Verify the BES Windows Server has a host-based firewall installed or an appliance firewall has been installed between the BES and the network. If the BES architecture is not configured as required with required firewalls, this is a finding.

Check Text ( C-14979r3_chk )

Detailed Policy Requirements:

The BlackBerry wireless email system must be set up with the required system components and software installed on the handheld device.

- The BES is installed and configured using either the architecture shown in Figure 2-1 (non-segmented architecture) or alternate segmented architecture shown in Figure 2-2 in the BlackBerry STIG Overview.
- The BES and all other systems providing BlackBerry services (e.g., email server and LDAP server) are protected behind a corporate firewall.
- The BES has a host-based firewall (e.g., McAfee Personal Firewall, Norton Personal Firewall) and/or dedicated hardware firewall.

It is recommended that a BES site use the pre-configured, STIG compliant, IT policy that is provided with the STIG. This method increases compliance and reduces the chance of required configuration settings not being configured correctly.

Check Procedures:
Interview the ISSO and system administrator and review system network diagrams.

Verify logical connectivity complies with the requirements of one of the approved architectures (view Figure 2-1 or Figure 2-2 of the BlackBerry STIG Overview) to see example architectures.

Verify the BES Windows Server has a host-based firewall installed or an appliance firewall has been installed between the BES and the network.

If the BES architecture is not configured as required with required firewalls, this is a finding.

Fix Text (F-13504r3_fix)
The ISSO will ensure the BES is installed and configured using either the BlackBerry Network architecture or the BlackBerry Segmented architecture.