Smartphones and tablets classified as non-enterprise activated must not be connected to a DoD network.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-30413	WIR-SPP-012	SV-40118r1_rule	ECWN-1	High

Description
Some smartphones and tablets, including some models of Windows 7, Android, iOS, and BlackBerry smartphones and tablets, are not authorized to connect to DoD networks or to DoD PCs that will be connected to DoD networks, because they do not have required security controls. There is a high risk of introducing malware on a DoD network if these types of devices are connected to a DoD network.

STIG	Date
General Mobile Device Policy (Non-Enterprise Activated) Security Technical Implementation Guide	2012-02-08

Details

Check Text ( C-39065r1_chk )
Smartphones and tablets classified as non-enterprise activated are not authorized to connect to a DoD networks. Examples of unauthorized DoD network connections include: -Connecting the mobile device to a DoD network interface device (switch, router, Wi-Fi access point, etc.). Allowed exception: the device can be connected to a DoD managed Internet-Gateway-only connected Wi-Fi access point (AP) (see the Wireless STIG for more information). -Connecting the mobile device to a DoD PC that is authorized to connect to a DoD network. - Managing the mobile device from a DoD network connected Mobile Device Management (MDM) server. -Connecting the mobile device to a web server located on a DoD network, unless the server is available to the general public. -Connecting the mobile device to a DoD email system. Check Procedures: Interview the IAO and 2-3 users who are using mobile OS devices that are managed by the site, which are not authorized to connect to DoD networks. Verify written policy and training material exists (or requirement is listed on a signed user agreement) stating mobile OS devices must not be connected to a DoD network, unless authorized to do so. Verify users are aware of the requirement. Mark as a finding if written policy or training material does not exist or users are not aware of the requirement.

Check Text ( C-39065r1_chk )

Smartphones and tablets classified as non-enterprise activated are not authorized to connect to a DoD networks.

Examples of unauthorized DoD network connections include:
-Connecting the mobile device to a DoD network interface device (switch, router, Wi-Fi access point, etc.). Allowed exception: the device can be connected to a DoD managed Internet-Gateway-only connected Wi-Fi access point (AP) (see the Wireless STIG for more information).

-Connecting the mobile device to a DoD PC that is authorized to connect to a DoD network.

- Managing the mobile device from a DoD network connected Mobile Device Management (MDM) server.

-Connecting the mobile device to a web server located on a DoD network, unless the server is available to the general public.

-Connecting the mobile device to a DoD email system.

Check Procedures:

Interview the IAO and 2-3 users who are using mobile OS devices that are managed by the site, which are not authorized to connect to DoD networks.

Verify written policy and training material exists (or requirement is listed on a signed user agreement) stating mobile OS devices must not be connected to a DoD network, unless authorized to do so. Verify users are aware of the requirement.

Mark as a finding if written policy or training material does not exist or users are not aware of the requirement.

Fix Text (F-34176r1_fix)
Do not connect smartphones and tablets classified as non-enterprise activated to DoD networks.