UCF STIG Viewer Logo

The Samsung KNOX for Android platform must be configured to enable a Certificate Revocation Status (CRL) Check.


Overview

Finding ID Version Rule ID IA Controls Severity
V-69661 KNOX-35-028500 SV-84283r1_rule Medium
Description
A CRL allows a certificate issuer to revoke a certificate for any reason, including improperly issued certificates and compromise of the private keys. Checking the revocation status of the certificate mitigates the risk associated with using a compromised certificate. SFR ID: FMT_SMF_EXT.1.1 #45
STIG Date
Samsung Android OS 6 (with KNOX 2.x) Security Technical Implementation Guide 2016-11-14

Details

Check Text ( C-70097r1_chk )
This validation procedure is performed on the MDM Administration Console.

Check whether the appropriate setting is configured on the MDM Administration Console:
1. Ask the MDM administrator to display the "Enable Certificate Revocation Status (CRL) Check" settings in the "Android Restrictions" rule.
2. Verify the value is enabled and configured for all applications.

If the setting is disabled, this is a finding.
Fix Text (F-75851r1_fix)
Configure the operating system to configure certification revocation status checking (CRL).

On the MDM Administration Console, configure "Enable Certificate Revocation Status (CRL) Check" settings for all applications in the "Android Restrictions" rule.