The Over-The-Air (OTA) device provisioning PIN must have expiration set.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-24998	WIR-GMMS-008	SV-30738r2_rule	ECWN-1	Medium

Description
The time period that a device can be provisioned via Over-The-Air (OTA) provisioning needs to be controlled to ensure unauthorized people do not have the capability to setup rogue devices on the network.

STIG	Date
Good Mobility Suite Server (Windows Phone 6.5) Security Technical Implementation Guide	2011-10-04

Details

Check Text ( C-31148r2_chk )
This is a Good security policy set check. Recommend all checks related to Good security policy set rules be reviewed using the following procedure. 1. Make a list of all Good security policy sets assigned to smartphone user accounts on the Good server using the following procedure: -Have the SA identify any non STIG/ISCG-compliant policy sets and STIG/ISCG-compliant policy sets on the server. --Log into the Good Mobile Control console. --Click on the Policies tab. --View all policy sets on the server. -Note: STIG-compliant policy sets should be identified as such in the policy title. Examples are as follows: ISCG_iOS_Policy_Set, STIG_WM6-5_Policy_Set, or STIG_Android_Policy_Set. It is recommended that all non-STIG/ISCG policy sets be deleted. 2. Select each policy set users are assigned to, and in turn, verify the required settings are in the policy set. -Note: If there is a finding, note the name of the non STIG/ISCG-compliant policy set in the Findings Details section in VMS/Component Provided Tracking Database. -Launch the Good Mobile Control Web console and click on the Policies tab. -Select the policy set for the smartphone and click on Provisioning on the left side. -Verify “OTA Provisioning PIN expires after” is checked and is set to 7 days or less. Mark as a finding if “OTA Provisioning PIN expires after” is not checked or is not set to 7 days or less.

Check Text ( C-31148r2_chk )

This is a Good security policy set check. Recommend all checks related to Good security policy set rules be reviewed using the following procedure.

1. Make a list of all Good security policy sets assigned to smartphone user accounts on the Good server using the following procedure:

-Have the SA identify any non STIG/ISCG-compliant policy sets and STIG/ISCG-compliant policy sets on the server.
--Log into the Good Mobile Control console.
--Click on the Policies tab.
--View all policy sets on the server.

-Note: STIG-compliant policy sets should be identified as such in the policy title. Examples are as follows: ISCG_iOS_Policy_Set, STIG_WM6-5_Policy_Set, or STIG_Android_Policy_Set. It is recommended that all non-STIG/ISCG policy sets be deleted.

2. Select each policy set users are assigned to, and in turn, verify the required settings are in the policy set.

-Note: If there is a finding, note the name of the non STIG/ISCG-compliant policy set in the Findings Details section in VMS/Component Provided Tracking Database.

-Launch the Good Mobile Control Web console and click on the Policies tab.
-Select the policy set for the smartphone and click on Provisioning on the left side.

-Verify “OTA Provisioning PIN expires after” is checked and is set to 7 days or less.

Mark as a finding if “OTA Provisioning PIN expires after” is not checked or is not set to 7 days or less.

Fix Text (F-27641r2_fix)
Set the Over-the-Air (OTA) device provisioning PIN as required.