The Samsung Knox for Android container must be configured to implement the management setting: disable automatic completion of browser text input.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-56145	KNOX-39-021000	SV-70399r1_rule		Medium

Description
The auto-fill functionality in the web browser allows the user to complete a form that contains sensitive information, such as PII, without previous knowledge of the information. By allowing the use of an auto-fill functionality, an adversary who learns a user's MOS device password, or who otherwise is able to unlock the device, may be able to further breach other systems by relying on the auto-fill feature to provide information unknown to the adversary. By disabling the auto-fill functionality, the risk of an adversary gaining further information about the device's user or comprising other systems is significantly mitigated. SFR ID: FMT_SMF.1.1 #42

Description

The auto-fill functionality in the web browser allows the user to complete a form that contains sensitive information, such as PII, without previous knowledge of the information. By allowing the use of an auto-fill functionality, an adversary who learns a user's MOS device password, or who otherwise is able to unlock the device, may be able to further breach other systems by relying on the auto-fill feature to provide information unknown to the adversary. By disabling the auto-fill functionality, the risk of an adversary gaining further information about the device's user or comprising other systems is significantly mitigated. SFR ID: FMT_SMF.1.1 #42

STIG	Date
Samsung Android (with Knox 2.x) STIG	2015-01-05

Details

Check Text ( C-56715r1_chk )
This validation procedure is performed on both the MDM Administration Console and the Samsung Knox for Android device. Check whether the appropriate setting is configured on the MDM Administration Console: 1. Ask the MDM administrator to display the "Allow browser auto-fill" setting in the "Android Knox Container -> Container Restrictions" rule. 2. Verify the setting is disabled. On the Samsung Knox for Android device: 1. Open the Knox container. 2. Launch the browser application. 3. Select the application's setting menu. 4. Select "Auto fill forms". 5. Verify "Auto fill forms" is disabled and attempt to enable this setting. If the "Allow browser auto-fill" configuration in the MDM console is enabled, or if the user is able to successfully enable this setting, this is a finding.

Check Text ( C-56715r1_chk )

This validation procedure is performed on both the MDM Administration Console and the Samsung Knox for Android device.

Check whether the appropriate setting is configured on the MDM Administration Console:
1. Ask the MDM administrator to display the "Allow browser auto-fill" setting in the "Android Knox Container -> Container Restrictions" rule.
2. Verify the setting is disabled.

On the Samsung Knox for Android device:
1. Open the Knox container.
2. Launch the browser application.
3. Select the application's setting menu.
4. Select "Auto fill forms".
5. Verify "Auto fill forms" is disabled and attempt to enable this setting.

If the "Allow browser auto-fill" configuration in the MDM console is enabled, or if the user is able to successfully enable this setting, this is a finding.

Fix Text (F-61021r1_fix)
Configure the mobile operating system to disable browser auto-fill for the container browser application. On the MDM Administration Console, disable the "Allow browser auto-fill" setting in the "Android Knox Container -> Container Restrictions" rule.