The Mobile OS must block both the inbound and outbound traffic between instant messaging clients that are independently configured by end users and external service providers or other unapproved DoD systems.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-33165	SRG-OS-000176-MOS-000098	SV-43563r2_rule		Medium

Description
Many instant messaging systems have known vulnerabilities, some of which allow an adversary to install malware on the device. This malware can then be used to obtain sensitive information or further compromise DoD information systems. Restricting IM traffic to DoD authorized IM systems mitigates the risk of using IM technology.

STIG	Date
Mobile Operating System Security Requirements Guide	2013-07-03

Details

Check Text ( C-41426r1_chk )
Inspect the mobile operating system configuration for prohibiting the use of non-DoD authorized instant messaging (IM) systems. If non-DoD authorized IM clients pass either inbound or outbound traffic, this is a finding.

Fix Text (F-37065r1_fix)
Remove non-DoD authorized IM applications from the device.