The Samsung Android 14 BYOAD and DOD enterprise must be configured to limit access to only AO-approved, corporate-owned enterprise IT resources.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-260405	KNOX-14-801100	SV-260405r950726_rule		High

Description
Note: IT resources includes DOD networks and applications (for example, DOD email). The system administrator must have the capability to limit access of the BYOAD to DOD networks and DOD IT resources based on mission needs and risk. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DOD sensitive information. The AO should document networks, IT resources, and enterprise applications that BYOAD can access. Examples of EMM security controls are as follows: 1. Device access restrictions: Restrict or isolate access based on the devices access type (i .e., from the internet), authentication type (e.g., password), credential strength, etc. 2. User and device activity monitoring: Configured to detect anomalous activity, malicious activity, and unauthorized attempts to access DOD information. 3. Device health tracking: Monitor device attestation, health, and agents reporting compromised applications, connections, intrusions, and/or signatures. Reference: DOD policy "Use of Non-Government Mobile Devices" (3.b.(2)ii). SFR ID: FMT_SMF_EXT.1.1 #47

Description

Note: IT resources includes DOD networks and applications (for example, DOD email). The system administrator must have the capability to limit access of the BYOAD to DOD networks and DOD IT resources based on mission needs and risk. An adversary could exploit vulnerabilities created by the weaker configuration to compromise DOD sensitive information. The AO should document networks, IT resources, and enterprise applications that BYOAD can access. Examples of EMM security controls are as follows: 1. Device access restrictions: Restrict or isolate access based on the devices access type (i .e., from the internet), authentication type (e.g., password), credential strength, etc. 2. User and device activity monitoring: Configured to detect anomalous activity, malicious activity, and unauthorized attempts to access DOD information. 3. Device health tracking: Monitor device attestation, health, and agents reporting compromised applications, connections, intrusions, and/or signatures. Reference: DOD policy "Use of Non-Government Mobile Devices" (3.b.(2)ii). SFR ID: FMT_SMF_EXT.1.1 #47

STIG	Date
Samsung Android 14 BYOAD Security Technical Implementation Guide	2024-02-16

Details

Check Text ( C-64135r950724_chk )
Verify the EMM system and DOD enterprise have been configured to limit the Samsung Android 14 BYOAD access to only AO-approved enterprise IT resources. The exact procedure will depend on the EMM system used and IT resources at the site. If the EMM system and DOD enterprise have not been configured to limit Samsung Android 14 BYOAD access to only AO-approved enterprise IT resources, this is a finding.

Check Text ( C-64135r950724_chk )

Verify the EMM system and DOD enterprise have been configured to limit the Samsung Android 14 BYOAD access to only AO-approved enterprise IT resources. The exact procedure will depend on the EMM system used and IT resources at the site.

If the EMM system and DOD enterprise have not been configured to limit Samsung Android 14 BYOAD access to only AO-approved enterprise IT resources, this is a finding.

Fix Text (F-64042r950725_fix)
Configure the EEM system and DOD enterprise to limit the Samsung Android 14 BYOAD access to only AO-approved enterprise IT resources. The exact procedure will depend on the EMM system used and IT resources at the site.