The Samsung Android device must be configured to enable Certificate Revocation List (CRL) status checking.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-260459	KNOX-14-725010	SV-260459r950956_rule		Medium

Description
A CRL allows a certificate issuer to revoke a certificate for any reason, including improperly issued certificates and compromise of the private keys. Checking the revocation status of the certificate mitigates the risk associated with using a compromised certificate. For this reason, users must not be able to disable this configuration. Samsung Android can control CRL checking but only using Knox APIs. Alternatively, CRL checking is based on app development best practice. SFR ID: FMT_MOF_EXT.1.2 #47

Description

A CRL allows a certificate issuer to revoke a certificate for any reason, including improperly issued certificates and compromise of the private keys. Checking the revocation status of the certificate mitigates the risk associated with using a compromised certificate. For this reason, users must not be able to disable this configuration. Samsung Android can control CRL checking but only using Knox APIs. Alternatively, CRL checking is based on app development best practice. SFR ID: FMT_MOF_EXT.1.2 #47

STIG	Date
Samsung Android 14 MDFPP 3.3 BYOAD Security Technical Implementation Guide	2024-02-21

Details

Check Text ( C-64189r950954_chk )
Review the configuration to confirm that revocation checking is enabled. Verify the revocation checklist is set to "All Applications". This procedure is performed on the management tool. On the management tool: 1. Open Certificates Policy >> Revocation section. 2. Select "Get CRL". 3. Verify Toast message "Get revocation check: true". If on the management tool the revocation check is disabled, this is a finding.

Check Text ( C-64189r950954_chk )

Review the configuration to confirm that revocation checking is enabled. Verify the revocation checklist is set to "All Applications".

This procedure is performed on the management tool.

On the management tool:
1. Open Certificates Policy >> Revocation section.
2. Select "Get CRL".
3. Verify Toast message "Get revocation check: true".

If on the management tool the revocation check is disabled, this is a finding.

Fix Text (F-64096r950955_fix)
Configure the Samsung Android devices to enable CRL revocation checks for all applications. These revocation checks must be enabled using the Knox KPE APIs. On the management tool, in the Certificate Policy restrictions, enable "Revocation Checks" for "All Applications".