Samsung Knox Android must authenticate devices before establishing remote network (e.g., VPN) connections using bidirectional cryptographically based authentication between devices.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-48269	KNOX-23-012800	SV-61141r1_rule		Medium

Description
Without strong mutual authentication a mobile device may connect to an unauthorized network. In many cases, the user may falsely believe that the device is connected to an authorized network and then provide authentication credentials and other sensitive information. A strong bidirectional cryptographically based authentication method mitigates this risk. SFR ID: FMT_SMF.1.1 #42

STIG	Date
Samsung Android (with Knox 1.x) STIG	2014-04-22

Details

Check Text ( C-50701r1_chk )
This validation procedure is performed on the MDM Administrative Console. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Disable Insecure VPN Connections" checkbox in the "Android Restrictions" rule. 2. Verify the checkbox is selected. If the "Disable Insecure VPN Connections" checkbox is not selected, this is a finding.

Check Text ( C-50701r1_chk )

This validation procedure is performed on the MDM Administrative Console.

Check whether the appropriate setting is configured on the MDM Administration Console:
1. Ask the MDM administrator to display the "Disable Insecure VPN Connections" checkbox in the "Android Restrictions" rule.
2. Verify the checkbox is selected.

If the "Disable Insecure VPN Connections" checkbox is not selected, this is a finding.

Fix Text (F-51877r1_fix)
Configure the operating system to authenticate devices before establishing remote connections. On the MDM Console, check the "Disable Insecure VPN Connections" checkbox in the "Android Restrictions" rule.