The MDM server must deny all connections to DoD network servers by managed mobile devices except for network servers that have the capability to support PKI based mutual authentication between the network server and the mobile device user.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-36156	SRG-APP-161-MDM-156-MDM	SV-47560r1_rule		High

Description
Device authentication is a solution enabling an organization to manage both users and devices. This requirement applies to MDM servers that provide mobile device and user access to network shares, web servers, and other network resources located on the internal enclave (back-office servers, etc.). This connection bypasses user network authentication mechanisms (i.e., CAC authentication). Therefore, the MDM server must allow connections to only back-office network resources that support CAC authentication with the mobile device user.

Description

Device authentication is a solution enabling an organization to manage both users and devices. This requirement applies to MDM servers that provide mobile device and user access to network shares, web servers, and other network resources located on the internal enclave (back-office servers, etc.). This connection bypasses user network authentication mechanisms (i.e., CAC authentication). Therefore, the MDM server must allow connections to only back-office network resources that support CAC authentication with the mobile device user.

STIG	Date
Mobile Device Manager Security Requirements Guide	2013-01-24

Details

Check Text ( C-44396r1_chk )
Review the MDM server configuration to ensure the MDM server denies all connections to DoD network servers by managed mobile devices except for network servers that have the capability to support PKI based mutual authentication between the network server and the mobile device user. If this function is not performed, this is a finding.

Fix Text (F-40686r1_fix)
Configure the MDM server to deny all connections to DoD network servers by managed mobile devices except for network servers that have the capability to support PKI based mutual authentication between the network server and the mobile device user.