Windows Phone 8.1 must be configured to lock the display after 15 minutes (or less) of inactivity.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-58941	MSWP-81-100808	SV-73371r1_rule		Medium

Description
The screen lock time-out must be set to a value that helps protect the device from unauthorized access. Having a too-long time-out would increase the window of opportunity for adversaries who gain physical access to the mobile device through loss, theft, etc. Such devices are much more likely to be in an unlocked state when acquired by an adversary, thus granting immediate access to the data on the mobile device. The maximum time-out period of 15 minutes has been selected to balance functionality and security; shorter time-out periods may be appropriate, depending on the risks posed to the mobile device. SFR ID: FMT_SMF.1.1 #02

Description

The screen lock time-out must be set to a value that helps protect the device from unauthorized access. Having a too-long time-out would increase the window of opportunity for adversaries who gain physical access to the mobile device through loss, theft, etc. Such devices are much more likely to be in an unlocked state when acquired by an adversary, thus granting immediate access to the data on the mobile device. The maximum time-out period of 15 minutes has been selected to balance functionality and security; shorter time-out periods may be appropriate, depending on the risks posed to the mobile device. SFR ID: FMT_SMF.1.1 #02

STIG	Date
Microsoft Windows Phone 8.1 Security Technical Implementation Guide	2015-03-26

Details

Check Text ( C-59771r1_chk )
This validation procedure is performed on both the MDM administration console and the Windows Phone mobile device. On the MDM administration console: 1. Ask the MDM administrator to display the device password settings. 2. Verify the device time-out/inactivity setting is turned on. 3. Verify the minimum length is set to 15 minutes. On the Windows Phone mobile device: 1. Initiate the test by leaving the phone idle for longer than 15 minutes 2. Tap the Power button to turn the screen on. 3. Swipe up the lock screen and reveal the unlock screen. 4. Verify that a password is required to gain access to the device. If the MDM is not configured to require a device lock after 15 minutes or less, or the device fails to lock in 15 minutes or less, this is a finding.

Check Text ( C-59771r1_chk )

This validation procedure is performed on both the MDM administration console and the Windows Phone mobile device.

On the MDM administration console:
1. Ask the MDM administrator to display the device password settings.
2. Verify the device time-out/inactivity setting is turned on.
3. Verify the minimum length is set to 15 minutes.

On the Windows Phone mobile device:
1. Initiate the test by leaving the phone idle for longer than 15 minutes
2. Tap the Power button to turn the screen on.
3. Swipe up the lock screen and reveal the unlock screen.
4. Verify that a password is required to gain access to the device.

If the MDM is not configured to require a device lock after 15 minutes or less, or the device fails to lock in 15 minutes or less, this is a finding.

Fix Text (F-64335r1_fix)
Configure Windows Phone 8.1 policies to lock the device after 15 minutes or less. Deploy the policy on managed devices.