Windows Phone 8.1 must have a mechanism to restrict capabilities of applications and OS components that leverage cloud storage by disabling the Backup feature.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-58979	MSWP-81-501413	SV-73409r1_rule		Medium

Description
While backup and collaboration of data is useful from a productivity perspective, if that same data can be shared to public locations through cloud storage services, data leakage scenarios are possible, enabling sensitive data to be shared outside of secure DoD locations. To mitigate these threats, the ability to store or backup data in public cloud areas should be blocked. For Windows Phone 8.1, this requirement is needed to prevent access to cloud services like OneDrive by OS applications and components such as: Office Hub/Applications OneNote Backup SFR ID: FMT_SMF.1.1 #42

Description

While backup and collaboration of data is useful from a productivity perspective, if that same data can be shared to public locations through cloud storage services, data leakage scenarios are possible, enabling sensitive data to be shared outside of secure DoD locations. To mitigate these threats, the ability to store or backup data in public cloud areas should be blocked. For Windows Phone 8.1, this requirement is needed to prevent access to cloud services like OneDrive by OS applications and components such as: Office Hub/Applications OneNote Backup SFR ID: FMT_SMF.1.1 #42

STIG	Date
Microsoft Windows Phone 8.1 Security Technical Implementation Guide	2015-03-26

Details

Check Text ( C-59809r1_chk )
The procedure is performed only on the Windows Phone 8.1 device. 1. From the Start page, swipe to the left to show the App list. 2. Find and tap on "Settings". 3. In the Settings list, tap on "backup". 4. Tap on "apps+settings", then verify the toggle for the setting "Settings backup" to set to Off. 5. Tap the phone's back button. 6. Tap on "text messages", then, in that setting, verify the toggle for "Text message backup" to set to Off. 7. Tap the phone's back button. 8. Tap on "photos+videos", then, in that setting, verify the "Don't upload" radio button for both the Photos and Videos settings is selected. If the Backup app under settings does not have the "apps+settings" toggle set to Off, the "text messages" toggle set to Off, and the "Don't upload" radio button selected for Photos and Videos in "photos+videos, this is a finding.

Check Text ( C-59809r1_chk )

The procedure is performed only on the Windows Phone 8.1 device.

1. From the Start page, swipe to the left to show the App list.
2. Find and tap on "Settings".
3. In the Settings list, tap on "backup".
4. Tap on "apps+settings", then verify the toggle for the setting "Settings backup" to set to Off.
5. Tap the phone's back button.
6. Tap on "text messages", then, in that setting, verify the toggle for "Text message backup" to set to Off.
7. Tap the phone's back button.
8. Tap on "photos+videos", then, in that setting, verify the "Don't upload" radio button for both the Photos and Videos settings is selected.

If the Backup app under settings does not have the "apps+settings" toggle set to Off, the "text messages" toggle set to Off, and the "Don't upload" radio button selected for Photos and Videos in "photos+videos, this is a finding.

Fix Text (F-64373r2_fix)
Configure a User Based Enforcement (UBE) to disable all Windows Phone Backup functions. For Windows Phone 8.1, the following procedure must be followed: 1. From the Start page, swipe to the left to show the App list. 2. Find and tap on "Settings". 3. In the Settings list, tap on "backup". 4. Tap on "apps+settings", then slide the toggle for the setting "Settings backup" to Off. You will see a warning that no more backups will occur. Confirm change by tapping on "turn off". 5. Tap the phone's back button. 6. Tap on "text messages", then, in that setting, slide the toggle for "Text message backup" to Off. 7. Tap the phone's back button. 8. Tap on "photos+videos", then, in that setting, select the "Don't upload" radio button for both the Photos and Videos settings.

Fix Text (F-64373r2_fix)

Configure a User Based Enforcement (UBE) to disable all Windows Phone Backup functions.

For Windows Phone 8.1, the following procedure must be followed:
1. From the Start page, swipe to the left to show the App list.
2. Find and tap on "Settings".
3. In the Settings list, tap on "backup".
4. Tap on "apps+settings", then slide the toggle for the setting "Settings backup" to Off. You will see a warning that no more backups will occur. Confirm change by tapping on "turn off".
5. Tap the phone's back button.
6. Tap on "text messages", then, in that setting, slide the toggle for "Text message backup" to Off.
7. Tap the phone's back button.
8. Tap on "photos+videos", then, in that setting, select the "Don't upload" radio button for both the Photos and Videos settings.