DAA must approve the use of personally-owned PEDs that are used to transmit, receive, store, or process DoD information. Owner must sign a forfeiture agreement in case of a security incident.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-15782	WIR0010	SV-16721r9_rule	ECSC-1 ECWN-1	Low

Description
The use of unauthorized personally-owned wireless devices to receive, store, process or transmit DoD data could expose sensitive DoD data to unauthorized people. The use of personally-owned PEDs must be controlled by the site. Users must agree to forfeit the PED when security incidents occur, follow all required security procedures, and install required software in order to protect the DoD network.

Description

The use of unauthorized personally-owned wireless devices to receive, store, process or transmit DoD data could expose sensitive DoD data to unauthorized people. The use of personally-owned PEDs must be controlled by the site. Users must agree to forfeit the PED when security incidents occur, follow all required security procedures, and install required software in order to protect the DoD network.

STIG	Date
General Wireless Policy Security Technical Implementation Guide	2011-04-08

Details

Check Text ( C-15968r6_chk )
Interview the IAO. 1. Ask if users are using personally-owned devices such as PDAs, BlackBerrys, laptops, or home computers to access sensitive enclave resources. 2. If personally-owned devices are allowed, verify written DAA approval exists and the SSP is annotated. 3. Verify a forfeiture agreement is being used at the site and users are trained to report security incidents on personally-owned devices. Mark as a CAT 1 finding if personally-owned devices are used for classified information. Hint: This check includes any non-DoD owned or approved devices such as computers, PEDs/PDAs, and wireless NICs. This applies to administrative and end-user access. Use for end-user is discouraged but may be approved by the DAA.

Check Text ( C-15968r6_chk )

Interview the IAO.
1. Ask if users are using personally-owned devices such as PDAs, BlackBerrys, laptops, or home computers to access sensitive enclave resources.
2. If personally-owned devices are allowed, verify written DAA approval exists and the SSP is annotated.
3. Verify a forfeiture agreement is being used at the site and users are trained to report security incidents on personally-owned devices.
Mark as a CAT 1 finding if personally-owned devices are used for classified information.

Hint: This check includes any non-DoD owned or approved devices such as computers, PEDs/PDAs, and wireless NICs. This applies to administrative and end-user access. Use for end-user is discouraged but may be approved by the DAA.

Fix Text (F-4558r5_fix)
Prohibit use or get required approvals (by DAA) and signed forfeiture agreement. Personally owned devices will not be used to access DoD restricted resources and information without DAA approval. Users should be trained on this requirement, configuration management procedures should be followed, and the devices must meet DoD security policies and standards.