The Samsung KNOX for Android platform must be configured to enable a Certificate Revocation Status (CRL) Check.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-69661	KNOX-35-028500	SV-84283r1_rule		Medium

Description
A CRL allows a certificate issuer to revoke a certificate for any reason, including improperly issued certificates and compromise of the private keys. Checking the revocation status of the certificate mitigates the risk associated with using a compromised certificate. SFR ID: FMT_SMF_EXT.1.1 #45

STIG	Date
Samsung Android OS 6 (with KNOX 2.x) Security Technical Implementation Guide	2016-11-14

Details

Check Text ( C-70097r1_chk )
This validation procedure is performed on the MDM Administration Console. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Enable Certificate Revocation Status (CRL) Check" settings in the "Android Restrictions" rule. 2. Verify the value is enabled and configured for all applications. If the setting is disabled, this is a finding.

Check Text ( C-70097r1_chk )

This validation procedure is performed on the MDM Administration Console.

Check whether the appropriate setting is configured on the MDM Administration Console:
1. Ask the MDM administrator to display the "Enable Certificate Revocation Status (CRL) Check" settings in the "Android Restrictions" rule.
2. Verify the value is enabled and configured for all applications.

If the setting is disabled, this is a finding.

Fix Text (F-75851r1_fix)
Configure the operating system to configure certification revocation status checking (CRL). On the MDM Administration Console, configure "Enable Certificate Revocation Status (CRL) Check" settings for all applications in the "Android Restrictions" rule.