The Over-The-Air (OTA) device provisioning password must have expiration set.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-24998	WIR-GMMS-008	SV-30738r2_rule	ECWN-1	Medium

Description
The time period that a device can be provisioned via Over-The-Air (OTA) provisioning needs to be controlled to ensure unauthorized individuals do not have the capability to set up rogue devices on the network. Note Active Directory credentials should not be utilized for the OTA provisioning password.

STIG	Date
Mobile Device Management (MDM) Server Security Technical Implementation Guide (STIG)	2013-01-17

Details

Check Text ( C-31148r9_chk )
If the MDM agent uses OTA provisioning, use the following procedure: 1. Make a list of all iOS security policies listed on the MDM server that have been assigned to iOS devices and review each policy. 2. Select each security policy iOS devices are assigned to and, in turn, verify the required settings are in the policy. Verify the OTA PIN is set to expire in seven days or less. Mark as a finding if the OTA PIN is not set to expire in seven days or less. Note: If there is a finding, note the name of the policy in the Findings Details section in VMS/Component Provided Tracking Database. For the Good Technology MDM: -Verify “OTA Provisioning PIN expires after” is checked and is set to 7 days or less. -Verify “Allow OTA Provisioning PIN reuse” is unchecked.

Check Text ( C-31148r9_chk )

If the MDM agent uses OTA provisioning, use the following procedure:
1. Make a list of all iOS security policies listed on the MDM server that have been assigned to iOS devices and review each policy.
2. Select each security policy iOS devices are assigned to and, in turn, verify the required settings are in the policy. Verify the OTA PIN is set to expire in seven days or less.

Mark as a finding if the OTA PIN is not set to expire in seven days or less.

Note: If there is a finding, note the name of the policy in the Findings Details section in VMS/Component Provided Tracking Database.
For the Good Technology MDM:
-Verify “OTA Provisioning PIN expires after” is checked and is set to 7 days or less.
-Verify “Allow OTA Provisioning PIN reuse” is unchecked.

Fix Text (F-27641r4_fix)
Set the OTA device provisioning password expiration to seven days or less.