The CMD management server administrator must receive required training.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-24970	WIR-WMSP-001-01	SV-30707r5_rule	PRTN-1	Low

Description
The security posture of the CMD management server could be compromised if the administrator is not trained to follow required procedures.

STIG	Date
CMD Management Server Policy Security Technical Implementation Guide (STIG)	2014-08-05

Details

Check Text ( C-31134r6_chk )
Detailed policy requirements: The CMD management server administrator must be trained on the following requirements: -Requirement that administrative service accounts will not be used to log into the CMD management server or any server service. -Activation passwords or PINs will consist of a pseudo-random pattern of at least eight characters consisting of at least two letters and two numbers. A new activation password must be selected each time one is assigned (e.g., the same password cannot be used for all users or for a group of users). -User and group accounts on the CMD management server will always be assigned a STIG-compliant security/IT policy. -For an MDM server that manages Samsung Knox 1.0 Android devices, the MDM system administrator must be trained to not remotely unlock the Knox security container. If a container is locked after the tenth incorrect password, this is an indicator the device may not be under the control of an authorized DoD user. MDM system administrators may unlock the Knox container if the device is physically in the possession of the administrator. Check procedures: -Verify the CMD management server administrator(s) has received the required training. The site should document when the training was completed. If the CMD management server administrator did not receive required training, this is a finding.

Check Text ( C-31134r6_chk )

Detailed policy requirements:
The CMD management server administrator must be trained on the following requirements:

-Requirement that administrative service accounts will not be used to log into the CMD management server or any server service.

-Activation passwords or PINs will consist of a pseudo-random pattern of at least eight characters consisting of at least two letters and two numbers. A new activation password must be selected each time one is assigned (e.g., the same password cannot be used for all users or for a group of users).

-User and group accounts on the CMD management server will always be assigned a STIG-compliant security/IT policy.

-For an MDM server that manages Samsung Knox 1.0 Android devices, the MDM system administrator must be trained to not remotely unlock the Knox security container. If a container is locked after the tenth incorrect password, this is an indicator the device may not be under the control of an authorized DoD user. MDM system administrators may unlock the Knox container if the device is physically in the possession of the administrator.

Check procedures:
-Verify the CMD management server administrator(s) has received the required training. The site should document when the training was completed.

If the CMD management server administrator did not receive required training, this is a finding.

Fix Text (F-27604r1_fix)
Have smartphone management server administrator complete and document his/her training.