Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-53113 | GOOD-00-000100 | SV-67329r1_rule | Low |
Description |
---|
If the operating system does not verify the authenticity of revocation information, there is the potential that an authorized system is providing false information. Acceptance of the false information could result in the installation of unauthorized software or connection to rogue networks, depending on the use for which the certificate is intended. Verifying the authenticity of revocation information mitigates this risk. |
STIG | Date |
---|---|
Good for Enterprise 8.x Security Technical Implementation Guide | 2014-08-18 |
Check Text ( C-54617r1_chk ) |
---|
Review the Good Mobility Suite configuration to verify the mobile email client does not accept certificate revocation information without verifying its authenticity. Otherwise, this is a finding. |
Fix Text (F-57923r2_fix) |
---|
Configure the Good Mobility Suite to not accept certificate revocation information without verifying its authenticity. -Launch the Good Mobile Control Web console, select the Settings tab, and open the Secure Messaging (S/MIME) section -Verify Enable Secure Messaging (S/MIME) is checked -In addition, click on the Policies tab -Select the policy set for the smart phone and click on Good For Enterprise Authentication -Verify Enable S/MIME is checked |