Develop policy that states CMD software updates must only originate from DoD approved sources.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35981	SRG-MPOL-063	SV-47297r1_rule		Medium

Description
Users must not accept over-the-air (OTA) wireless software updates from the wireless carrier or other non-DoD sources unless the updates have been tested and DoD approved. Unauthorized/unapproved software updates could include malware or cause a degradation of the security posture of the CMD and DoD network infrastructure. All software updates should be reviewed and/or tested by the CMD system administrator and originate from an approved DoD source. Wireless software updates should be pushed from the CMD management server, when this feature is available. Otherwise, the site administrator should verify the non-DoD source of the update has been approved by IT management.

Description

Users must not accept over-the-air (OTA) wireless software updates from the wireless carrier or other non-DoD sources unless the updates have been tested and DoD approved. Unauthorized/unapproved software updates could include malware or cause a degradation of the security posture of the CMD and DoD network infrastructure. All software updates should be reviewed and/or tested by the CMD system administrator and originate from an approved DoD source. Wireless software updates should be pushed from the CMD management server, when this feature is available. Otherwise, the site administrator should verify the non-DoD source of the update has been approved by IT management.

STIG	Date
Mobile Policy Security Requirements Guide	2013-01-24

Details

Check Text ( C-44218r1_chk )
Review the site's procedure/policy on software updates for CMDs and ensure it includes a requirement for updates to be obtained from a DoD approved source. Verify the site CMD handheld administrator and the CMD management server administrator are aware of the requirement. Determine what procedures are used at the site for installing software updates on site-managed CMDs. If the site does not have procedures in place for users to down-load software updates from only a DoD approved source, this is a finding.

Check Text ( C-44218r1_chk )

Review the site's procedure/policy on software updates for CMDs and ensure it includes a requirement for updates to be obtained from a DoD approved source. Verify the site CMD handheld administrator and the CMD management server administrator are aware of the requirement.

Determine what procedures are used at the site for installing software updates on site-managed CMDs.

If the site does not have procedures in place for users to down-load software updates from only a DoD approved source, this is a finding.

Fix Text (F-40508r1_fix)
Develop policy requiring CMD software updates originate from DoD approved sources.