UCF STIG Viewer Logo

The Samsung Knox for Android container must implement the management setting: Disable automatic completion of browser text input.


Overview

Finding ID Version Rule ID IA Controls Severity
V-61263 KNOX-39-021000 SV-75743r1_rule Medium
Description
The auto-fill functionality in the web browser allows the user to complete a form that contains sensitive information, such as PII, without previous knowledge of the information. By allowing the use of an auto-fill functionality, an adversary who learns a user's MOS device password, or who otherwise is able to unlock the device, may be able to further breach other systems by relying on the auto-fill feature to provide information unknown to the adversary. By disabling the auto-fill functionality, the risk of an adversary gaining further information about the device's user or comprising other systems is significantly mitigated. SFR ID: FMT_SMF_EXT.1.1 #45
STIG Date
Samsung Android OS 5 with Knox 2.0 Security Technical Implementation Guide 2016-02-24

Details

Check Text ( C-62219r1_chk )
This validation procedure is performed on both the MDM Administration Console and the Samsung Knox for Android device.

Check whether the appropriate setting is configured on the MDM Administration Console:
1. Ask the MDM administrator to display the "Allow browser auto-fill" setting in the "Android Knox Container -> Container Restrictions" rule.
2. Verify the setting is disabled.

On the Samsung Knox for Android device:
1. Open the Knox container.
2. Launch the browser application.
3. Select the application's setting menu.
4. Select "Auto fill forms".
5. Verify "Auto fill forms" is disabled and attempt to enable this setting.

If the "Allow browser auto-fill" configuration in the MDM console is enabled, or if the user is able to successfully enable this setting, this is a finding.
Fix Text (F-67123r1_fix)
Configure the mobile operating system to disable browser auto-fill for the container browser application.

On the MDM Administration Console, disable the "Allow browser auto-fill" setting in the "Android Knox Container -> Container Restrictions" rule.