The organization must not use DoD-issued software certificates for Non-enterprise activated CMDs.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| SRG-MPOL-044 | SRG-MPOL-044 | SRG-MPOL-044_rule | High |
| Description |
|---|
| If DoD issued certificates are utilized, the device may be able to connect to sites/systems that are otherwise prohibited without the certificate. Non-enterprise activated CMDs are not authorized to access DoD information. In addition, the certificate store will not be protected with AES encryption or be FIPS validated. DoD PKI certificates would be at risk of being compromised. |
| STIG | Date |
|---|---|
| Mobile Policy Security Requirements Guide | 2012-10-10 |
Details
| Check Text ( C-SRG-MPOL-044_chk ) |
|---|
| Review the organization's published implementation guidance on the use of non-enterprise activated CMDs to determine if DoD software certificates are prohibited from being utilized on the devices. If DoD software certificates are not prohibited, this is a finding. |
| Fix Text (F-SRG-MPOL-044_fix) |
|---|
| Ensure non-enterprise activated CMDs do not use DoD-issued software certificates. |