Google Android 12 must be configured to disable multiuser modes.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-250436	GOOG-12-009000	SV-250436r802672_rule		Medium

Description
Multiuser mode allows multiple users to share a mobile device by providing a degree of separation between user data. To date, no mobile device with multiuser mode features meets DoD requirements for access control, data separation, and nonrepudiation for user accounts. In addition, the MDFPP does not include design requirements for multiuser account services. Disabling multiuser mode mitigates the risk of not meeting DoD multiuser account security policies. SFR ID: FMT_SMF_EXT.1.1 #47a

Description

Multiuser mode allows multiple users to share a mobile device by providing a degree of separation between user data. To date, no mobile device with multiuser mode features meets DoD requirements for access control, data separation, and nonrepudiation for user accounts. In addition, the MDFPP does not include design requirements for multiuser account services. Disabling multiuser mode mitigates the risk of not meeting DoD multiuser account security policies. SFR ID: FMT_SMF_EXT.1.1 #47a

STIG	Date
Google Android 12 COPE Security Technical Implementation Guide	2021-09-17

Details

Check Text ( C-53871r802670_chk )
Review documentation on the managed Google Android 12 device and inspect the configuration on the Google Android device to disable multi-user modes. This validation procedure is performed on both the EMM Administration Console and the managed Google Android 12 device. On the EMM console: COBO and COPE: 1. Open "User restrictions". 2. Open "Set user restrictions". 3. Verify that "Disallow modify accounts" is toggled to ON. On the managed Google Android 12 device: COBO and COPE: 1. Go to Settings >> Passwords & accounts >> Accounts for Owner. 2. Tap "Add account". 3. Verify that the action is not allowed. If the EMM console device policy is not set to disable multi-user modes or on the managed Google Android 12 device, the device policy is not set to disable multi-user modes, this is a finding.

Check Text ( C-53871r802670_chk )

Review documentation on the managed Google Android 12 device and inspect the configuration on the Google Android device to disable multi-user modes.

This validation procedure is performed on both the EMM Administration Console and the managed Google Android 12 device.

On the EMM console:

COBO and COPE:

1. Open "User restrictions".
2. Open "Set user restrictions".
3. Verify that "Disallow modify accounts" is toggled to ON.

On the managed Google Android 12 device:

COBO and COPE:

1. Go to Settings >> Passwords & accounts >> Accounts for Owner.
2. Tap "Add account".
3. Verify that the action is not allowed.

If the EMM console device policy is not set to disable multi-user modes or on the managed Google Android 12 device, the device policy is not set to disable multi-user modes, this is a finding.

Fix Text (F-53825r802671_fix)
Configure the Google Android 12 device to disable multi-user modes. On the EMM console: COBO and COPE: 1. Open "User restrictions". 2. Open "Set user restrictions". 3. Toggle "Disallow modify accounts" to ON.