“Re-challenge for CAC PIN every” must be set.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-24987	WIR-GMMS-004	SV-30727r2_rule	ECSC-1	Low

Description
A user’s CAC PIN or software certificate PIN is cached in memory on the device for a short period of time so a user does not have to re-enter his/her PIN every time the user’s digital certificates are required for an S/MIME operation. The cached memory is cleared after a set period of time to limit exposure of the digital certificates to unauthorized use. Otherwise, a hacker may be able to gain access to the device while the PIN is still cached in memory and access the Good application and gain access to sensitive DoD information.

Description

A user’s CAC PIN or software certificate PIN is cached in memory on the device for a short period of time so a user does not have to re-enter his/her PIN every time the user’s digital certificates are required for an S/MIME operation. The cached memory is cleared after a set period of time to limit exposure of the digital certificates to unauthorized use. Otherwise, a hacker may be able to gain access to the device while the PIN is still cached in memory and access the Good application and gain access to sensitive DoD information.

STIG	Date
Good Mobility Suite Server (Android OS) Security Technical Implementation Guide	2011-12-14

Details

Check Text ( C-31142r2_chk )
This is a Good security policy set check. Recommend all checks related to Good security policy set rules be reviewed using the following procedure. 1. Make a list of all Good security policy sets assigned to smartphone user accounts on the Good server using the following procedure: -Have the SA identify any non STIG/ISCG-compliant policy sets and STIG/ISCG-compliant policy sets on the server. --Log into the Good Mobile Control console. --Click on the Policies tab. --View all policy sets on the server. -Note: STIG-compliant policy sets should be identified as such in the policy title. Examples are as follows: ISCG_iOS_Policy_Set, STIG_WM6-5_Policy_Set, or STIG_Android_Policy_Set. It is recommended that all non-STIG/ISCG policy sets be deleted. 2. Select each policy set users are assigned to, and in turn, verify the required settings are in the policy set. -Note: If there is a finding, note the name of the non STIG/ISCG-compliant policy set in the Findings Details section in VMS/Component Provided Tracking Database. -Launch the Good Mobile Control Web console and click on the Policies tab. -Select the policy set for the smartphone devices and click on Handheld Authentication on the left side. -Verify “Re-challenge for CAC PIN every” is checked and set to 60 minutes or less. (Note: 15 minutes or less is the recommended setting.) Mark as a finding if “Re-challenge for CAC PIN every” is not checked and not set to the required value.

Check Text ( C-31142r2_chk )

This is a Good security policy set check. Recommend all checks related to Good security policy set rules be reviewed using the following procedure.

1. Make a list of all Good security policy sets assigned to smartphone user accounts on the Good server using the following procedure:

-Have the SA identify any non STIG/ISCG-compliant policy sets and STIG/ISCG-compliant policy sets on the server.
--Log into the Good Mobile Control console.
--Click on the Policies tab.
--View all policy sets on the server.

-Note: STIG-compliant policy sets should be identified as such in the policy title. Examples are as follows: ISCG_iOS_Policy_Set, STIG_WM6-5_Policy_Set, or STIG_Android_Policy_Set. It is recommended that all non-STIG/ISCG policy sets be deleted.

2. Select each policy set users are assigned to, and in turn, verify the required settings are in the policy set.

-Note: If there is a finding, note the name of the non STIG/ISCG-compliant policy set in the Findings Details section in VMS/Component Provided Tracking Database.

-Launch the Good Mobile Control Web console and click on the Policies tab.
-Select the policy set for the smartphone devices and click on Handheld Authentication on the left side.

-Verify “Re-challenge for CAC PIN every” is checked and set to 60 minutes or less.
(Note: 15 minutes or less is the recommended setting.)

Mark as a finding if “Re-challenge for CAC PIN every” is not checked and not set to the required value.

Fix Text (F-27628r2_fix)
Set the “Re-challenge for CAC PIN every” to checked and set to required value.