If the MDM server includes a mobile email management capability, the email client must verify all digital certificates in the certificate chain when performing PKI transactions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-36210	SRG-APP-175-MDM-194-MEM	SV-47614r1_rule		Low

Description
If an adversary is able to compromise one of the certificates in the certificate chain, the adversary may be able to sign lower level certificates in the chain. This would enable the adversary to masquerade as other users or systems. By providing the mobile user with such false assurance, the adversary may be able obtain DoD information, capture authentication credentials, and perform other unauthorized functions. Verifying all digital certificates in the chain mitigates this risk.

Description

If an adversary is able to compromise one of the certificates in the certificate chain, the adversary may be able to sign lower level certificates in the chain. This would enable the adversary to masquerade as other users or systems. By providing the mobile user with such false assurance, the adversary may be able obtain DoD information, capture authentication credentials, and perform other unauthorized functions. Verifying all digital certificates in the chain mitigates this risk.

STIG	Date
Mobile Device Manager Security Requirements Guide	2013-01-24

Details

Check Text ( C-44450r1_chk )
Determine if the MDM server includes a mobile email management capability. If no, this requirement is not applicable. If yes, perform the following procedure: Verify the mobile email client verifies all digital certificates in the certificate chain (user, intermediate, and root) when performing PKI transactions. Talk to the site system administrator and have them confirm this capability exists in the MDM server. Also, review the MDM server configuration. If the mobile email client does not verify all digital certificates in the certificate chain (user, intermediate, and root) when performing PKI transactions, this is a finding.

Check Text ( C-44450r1_chk )

Determine if the MDM server includes a mobile email management capability. If no, this requirement is not applicable. If yes, perform the following procedure: Verify the mobile email client verifies all digital certificates in the certificate chain (user, intermediate, and root) when performing PKI transactions. Talk to the site system administrator and have them confirm this capability exists in the MDM server. Also, review the MDM server configuration. If the mobile email client does not verify all digital certificates in the certificate chain (user, intermediate, and root) when performing PKI transactions, this is a finding.

Fix Text (F-40740r1_fix)
Configure the MDM server verifies all digital certificates in the certificate chain (user, intermediate, and root) when performing PKI transactions.