UCF STIG Viewer Logo

Samsung Android must be configured to disable Face Recognition. Note: This requirement is not applicable (NA) for specific biometric authentication factors included in the product Common Criteria evaluation.


Finding ID Version Rule ID IA Controls Severity
V-99937 KNOX-10-002200 SV-109041r1_rule Medium
The fingerprint reader can be used to authenticate the user in order to unlock the mobile device. At this time, no mobile device biometric reader has been evaluated as meeting the security requirements of the MDFPP or been approved for DoD use on mobile devices. This technology could allow unauthorized users to have access to DoD sensitive data if compromised. By not permitting the use of non-password authentication mechanisms, users are forced to use passcodes that meet DoD passcode requirements. SFR ID: FMT_SMF_EXT.1.1 #23, FIA_UAU.5.1
Samsung Android OS 10 with Knox 3.x Security Technical Implementation Guide 2020-03-24


Check Text ( C-98787r1_chk )
Review Samsung Android configuration settings to determine if Face Recognition is disabled.

This validation procedure is performed on both the management tool Administration Console and the Samsung Android device.

On the management tool, in the device restrictions section, verify that "Face" is set to "Disable".

On the Samsung Android device, do the following:
1. Open Settings >> Lock screen >> Screen lock type.
2. Enter current password.
3. Verify that "Face" is disabled and cannot be enabled.

If on the management tool "Face" is not set to "Disable", or on the Samsung Android device "Face" can be enabled, this is a finding.
Fix Text (F-105621r1_fix)
Configure the Samsung Android to disable Face Recognition.

On the management tool, in the device restrictions section, set "Face" to "Disable".