The MDM server must implement jailbreak detection on managed mobile devices.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-25004	WIR-GMMS-010-03	SV-30748r2_rule	ECWN-1	Low

Description
If a device is jailbroken, the user may have the ability to install unauthorized software that might disclose sensitive DoD information or attack other systems. The MDM should alert if there are indicators that the device has been jailbroken so actions, such as wiping the device, can be implemented to protect device data. For iOS, jailbreak detection by a third-party application is limited; therefore, this requirement is a defense-in-depth control to supplement iOS jailbreak controls.

Description

If a device is jailbroken, the user may have the ability to install unauthorized software that might disclose sensitive DoD information or attack other systems. The MDM should alert if there are indicators that the device has been jailbroken so actions, such as wiping the device, can be implemented to protect device data. For iOS, jailbreak detection by a third-party application is limited; therefore, this requirement is a defense-in-depth control to supplement iOS jailbreak controls.

STIG	Date
Mobile Device Management (MDM) Server Security Technical Implementation Guide (STIG)	2013-05-08

Details

Check Text ( C-42283r2_chk )
This requirement is only applicable to the Good Technology MDM server. 1. Make a list of all iOS security policies listed on the MDM server that have been assigned to iOS devices and review each policy. 2. Select each security policy iOS devices are assigned to and, in turn, verify the required settings are in the policy. Verify the latest available version of the MDM agent is set in the compliance rule. Verify that jailbreak detection has been turned on. Mark as a finding if the iOS security policy is not set up to enforce the required version of the MDM agent. Note: If there is a finding, note the name of the policy in the Findings Details section in VMS/Component Provided Tracking Database. For the Good Technology MDM: -On the left tab, select Compliance Manager. -Verify the “Good Client Version Verification” rule is listed. (Note that the rule title does not have to be exact.) -Open the rule by checking the box next to the rule, then click on Edit. -Verify the following are set: •Platform: iPhone •Check to run: Jailbreak/Rooted Detection •Application Name: “iOS Jailbreak detection” rule is listed. (Note that the rule title does not have to be exact.) •Failure Action: set to “Wipe Enterprise Data” •Verify "Check Every" is set to "1 hour"

Check Text ( C-42283r2_chk )

This requirement is only applicable to the Good Technology MDM server.

1. Make a list of all iOS security policies listed on the MDM server that have been assigned to iOS devices and review each policy.
2. Select each security policy iOS devices are assigned to and, in turn, verify the required settings are in the policy. Verify the latest available version of the MDM agent is set in the compliance rule. Verify that jailbreak detection has been turned on.

Mark as a finding if the iOS security policy is not set up to enforce the required version of the MDM agent.

Note: If there is a finding, note the name of the policy in the Findings Details section in VMS/Component Provided Tracking Database.

For the Good Technology MDM:
-On the left tab, select Compliance Manager.
-Verify the “Good Client Version Verification” rule is listed. (Note that the rule title does not have to be exact.)
-Open the rule by checking the box next to the rule, then click on Edit.

-Verify the following are set:
•Platform: iPhone
•Check to run: Jailbreak/Rooted Detection
•Application Name: “iOS Jailbreak detection” rule is listed. (Note that the rule title does not have to be exact.)
•Failure Action: set to “Wipe Enterprise Data”
•Verify "Check Every" is set to "1 hour"

Fix Text (F-27653r3_fix)
Set up compliance rules in the MDM server implementing jailbreak detection and set up the rule to wipe the device if a jailbreak has been detected.