The Samsung Knox Android VPN client must use either IPSec or SSL/TLS when connecting to DoD networks.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-48279	KNOX-23-013000	SV-61151r1_rule		Medium

Description
Use of non-standard communications protocols can affect both the availability and confidentiality of communications. IPSec and SSL/TLS are both well-known and tested protocols that provide strong assurance with respect to both IA and interoperability. SFR ID: FMT_SMF.1.1 #42

STIG	Date
Samsung Android (with Knox 1.x) STIG	2014-04-22

Details

Check Text ( C-50711r1_chk )
This validation procedure is performed on the MDM Administrative Console. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the administrator to display the "Disable Insecure VPN Connections" checkbox in the "Android Restrictions" rule. 2. Verify the checkbox is selected. If the "Disable Insecure VPN Connections" checkbox is not selected, this is a finding.

Check Text ( C-50711r1_chk )

This validation procedure is performed on the MDM Administrative Console.

Check whether the appropriate setting is configured on the MDM Administration Console:
1. Ask the administrator to display the "Disable Insecure VPN Connections" checkbox in the "Android Restrictions" rule.
2. Verify the checkbox is selected.

If the "Disable Insecure VPN Connections" checkbox is not selected, this is a finding.

Fix Text (F-51887r1_fix)
Configure the mobile operating system's VPN client to use IPSec or SSL/TLS when connecting to a DoD network. On the MDM Console, check the "Disable Insecure VPN Connections" checkbox in the "Android Restrictions" rule.