UCF STIG Viewer Logo

The Good Mobility Suite email client must not accept certificate revocation information without verifying its authenticity.


Overview

Finding ID Version Rule ID IA Controls Severity
V-53113 GOOD-00-000100 SV-67329r1_rule Low
Description
If the operating system does not verify the authenticity of revocation information, there is the potential that an authorized system is providing false information. Acceptance of the false information could result in the installation of unauthorized software or connection to rogue networks, depending on the use for which the certificate is intended. Verifying the authenticity of revocation information mitigates this risk.
STIG Date
Good for Enterprise 8.x Security Technical Implementation Guide 2014-08-18

Details

Check Text ( C-54617r1_chk )
Review the Good Mobility Suite configuration to verify the mobile email client does not accept certificate revocation information without verifying its authenticity. Otherwise, this is a finding.
Fix Text (F-57923r2_fix)
Configure the Good Mobility Suite to not accept certificate revocation information without verifying its authenticity.

-Launch the Good Mobile Control Web console, select the Settings tab, and open the Secure Messaging (S/MIME) section
-Verify Enable Secure Messaging (S/MIME) is checked
-In addition, click on the Policies tab
-Select the policy set for the smart phone and click on Good For Enterprise Authentication
-Verify Enable S/MIME is checked