{
"stig": {
"date": "2013-05-03",
"description": "Developed by Samsung Electronics Co., Ltd.; Fixmo Inc.; and General Dynamics C4 Systems, Inc. in coordination with DISA for use in the DoD.",
"findings": {
"KNOX-00-000100": {
"checkid": "C-KNOX-00-000100_chk",
"checktext": "This check procedure is performed on the Samsung Knox Android device only.\n\nVerify that an MDM agent is present on the device and communicating with its associated MDM server. \n\nFor example, on a Samsung Knox Android device running Fixmo Sentinel:\n1. Open the application list and verify the presence of Fixmo Sentinel.\n2. Open the Fixmo Sentinel MDM agent, press the menu button and select \"Details\".\n3. Verify Profile ID is not \"NULL\".\n4. Press the menu button and select \"Poll Server\" and ensure no errors are generated in the messages list.\n\nIf an MDM agent is not present on the Samsung Knox Android device, this is a finding. If the MDM agent is Fixmo Sentinel, if the Profile ID is \"NULL\", or if polling the server generates an error, this is a finding.\n",
"description": "Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not implemented, the system may be vulnerable to a variety of attacks. The use of an MDM allows an organization to assign values to security related parameters across all the devices it manages. This provides assurance that the required mobile OS security controls are being enforced, and that the device user or an adversary has not modified or disabled the controls. It also greatly increases efficiency and manageability of devices in a large scale environment relative to an environment in which each device must be configured separately.",
"fixid": "F-KNOX-00-000100_fix",
"fixtext": "Implement an MDM agent on the device to centrally manage configuration settings.",
"iacontrols": null,
"id": "KNOX-00-000100",
"ruleID": "KNOX-00-000100_rule",
"severity": "medium",
"title": "The mobile operating system must employ mobile device management services to centrally manage configuration settings, including security policies.",
"version": "KNOX-00-000100"
},
"KNOX-01-000200": {
"checkid": "C-KNOX-01-000200_chk",
"checktext": "This check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device.\n\nNote: For device unlock on mobile operating systems with no access to sensitive or classified information, the password length must be at least four digits. For mobile devices that store, process, or transmit sensitive information, the password length must be a minimum of 8 characters. \n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the \"Min Length\" setting in the \"Android Password Restrictions\" rule. \n2. Verify the value of the setting is the same or greater than the required length.\n\nOn the Samsung Knox Android device:\n1. Open the device settings.\n2. Select \"Lock screen\".\n3. Select \"Screen lock\".\n4. Enter current password.\n5. Select Password.\n6. Attempt to enter a password with fewer characters than the required length.\n\nIf the configured value of the \"Min Length\" setting is less than the required length or if MOS accepts a password less than the required length, this is a finding.",
"description": "Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute force attacks. The ability to crack a password is a function of how many times an attempt to crack the password, how quickly the adversary can do each attempt, and the size of the password space. The longer the minimum length of the password is, the larger the password space.",
"fixid": "F-KNOX-01-000200_fix",
"fixtext": "Configure the mobile operating system to enforce a minimum length for the device unlock password.\n\nFor example, on the Fixmo Sentinel Administration Console, set the \"Min Length\" value to 8 or greater in the \"Android Password Restrictions\" rule.",
"iacontrols": null,
"id": "KNOX-01-000200",
"ruleID": "KNOX-01-000200_rule",
"severity": "medium",
"title": "The mobile operating system must enforce a minimum length for the device unlock password.",
"version": "KNOX-01-000200"
},
"KNOX-01-000300": {
"checkid": "C-KNOX-01-000300_chk",
"checktext": "This check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the \"Max Time To Lock\" setting in the \"Android Password Restrictions\" rule. \n2. Verify the configured value is 15 or less. \n\nOn the Samsung Knox Android device:\n1. Unlock the device. \n2. Refrain from performing any activity on the device for 15 minutes. \n3. Verify the MOS requires user to enter the device unlock password to access the MOS.\n\nIf the device is not configured to lock after 15 minutes or less of inactivity, this is a finding.",
"description": "The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until the user reestablishes access using established identification and authentication procedures.\n\nA device lock is a temporary action taken when a user stops work but does not want to shut down because of the temporary nature of the hiatus. During the device lock a publicly viewable pattern is visible on the associated display, hiding what was previously visible on the screen. Once invoked, the device lock shall remain in place until the user re-authenticates. No other system activity aside from re-authentication can unlock the system.\n\nThe operating system must lock the device after the organization defined time period. This prevents others from gaining access to the device when not in the user's possession and accessing sensitive DoD information. A device lock mitigates the risk that an adversary can access data on an unattended mobile device but only after the maximum of 15 minute period of inactivity.",
"fixid": "F-KNOX-01-000300_fix",
"fixtext": "Configure the mobile operating system to lock the device after no more than 15 minutes of inactivity.\n\nFor example, on the Fixmo Sentinel Administration Console, set the \"Max Time To Lock\" value to 15 or less in the \"Android Password Restrictions\" rule.",
"iacontrols": null,
"id": "KNOX-01-000300",
"ruleID": "KNOX-01-000300_rule",
"severity": "medium",
"title": "The mobile operating system must lock the device after no more than 15 minutes of inactivity.",
"version": "KNOX-01-000300"
},
"KNOX-01-000400": {
"checkid": "C-KNOX-01-000400_chk",
"checktext": "This check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device. The result from the KNOX-01-000200 check procedure on the MDM Administration Console may be used here since both involve checking the password length setting. \n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n 1. Ask the MDM administrator to display the \"Min Length\" setting in the \"Android Password Restrictions\" rule.\n 2. Verify the configured value is greater than 0.\n Note: By setting password length to a number greater than 0, the mobile operating system prevents the user from being able to disable the password.\n\nOn the Samsung Knox Android Device:\n1. Open the device settings.\n2. Select \"Lock Screen\".\n3. Select \"Screen lock\".\n4. Enter current password.\n5. Verify the \"None\" option cannot be selected.\n\nIf the \"Min Length\" setting is null or 0, or if the MOS allows the user to disable the password-protected lock feature, this is a finding.",
"description": "If the user is able to disable the password-protected lock feature, the user can change the configuration of the device to allow access without a password. The modified configuration would enable an adversary with access to the device to obtain DoD information and possibly other information resources on other systems. An operating system that does not allow a user to disable this feature mitigates the risk of this attack. In cases in which the mobile operating system relies on another application for protected data storage (e.g., if FIPS 140-2 validated encryption for unclassified use is not native to the device), then this requirement applies to both the device lock password and the password to the data storage application.",
"fixid": "F-KNOX-01-000400_fix",
"fixtext": "Configure the operating system to prohibit a user from disabling the password-protected lock feature.\n\nFor example, on the Fixmo Sentinel Administration Console, set the \"Min Length\" to a number greater than 0 in the \"Android Password Restrictions\" rule.\n\nNOTE: By setting password length to a number greater than 0, the mobile operating system prevents the user from being able to disable the password.\n\n",
"iacontrols": null,
"id": "KNOX-01-000400",
"ruleID": "KNOX-01-000400_rule",
"severity": "medium",
"title": "The mobile operating system must not permit a user to disable the password-protected lock feature on the device.",
"version": "KNOX-01-000400"
},
"KNOX-02-000500": {
"checkid": "C-KNOX-02-000500_chk",
"checktext": "This check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the \"Min Uppercase\" setting in the \"Android Honeycomb Password Restrictions\" rule of the Knox Android STIG policy. \n2. Verify the value of the setting is 1 or greater. \n\nOn the Samsung Knox Android device:\n1. Open the device settings.\n2. Select \"Lock screen\".\n3. Select \"Screen lock\".\n4. Enter current password.\n5. Select \"Password\".\n6. Attempt to enter a password that does not contain any upper case alphabetic characters. \n\nIf the configured value of \"Min Uppercase\" is not 1 or greater on the MDM console, or if the MOS accepts a password with no upper case alphabetic characters, this is a finding.",
"description": "Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Setting minimum numbers of certain types of characters increases password complexity, and therefore makes it more difficult for an adversary to discover the password. In the DoD, the expectation is that the setting will range from a minimum of 1 to 2 upper case alphabetic characters in the device unlock password. The parameter should be selected based on a risk assessment that weighs factors, such as the environments the device will be located and operational requirements for users to access data in a timely manner.",
"fixid": "F-KNOX-02-000500_fix",
"fixtext": "Configure the mobile operating system to prohibit the device unlock password from containing fewer than a specified minimum number of upper case alphabetic characters.\n\nFor example, on the Fixmo Sentinel Administration Console, set the \"Min Uppercase\" value to 1 or more in the \"Android Honeycomb Password Restrictions\" rule.",
"iacontrols": null,
"id": "KNOX-02-000500",
"ruleID": "KNOX-02-000500_rule",
"severity": "medium",
"title": "The mobile operating system must disallow the device unlock password from containing fewer than a specified minimum number of upper case alphabetic characters.",
"version": "KNOX-02-000500"
},
"KNOX-02-000600": {
"checkid": "C-KNOX-02-000600_chk",
"checktext": "This check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the \"Min Lowercase\" setting in the \"Android Honeycomb Password Restrictions\" rule. \n2. Verify the value of the setting is 1 or greater. \n\nOn the Samsung Knox Android device:\n1. Open the device settings.\n2. Select \"Lock screen\".\n3. Select \"Screen lock\".\n4. Enter current password.\n5. Select \"Password\".\n6. Attempt to enter a password that does not contain any lowercase alphabetic characters. \n\nIf the configured value of \"Min Lowercase\" is not 1 or greater on the MDM console, or if the MOS accepts a password with no lowercase alphabetic characters, this is a finding.",
"description": "Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Setting minimum numbers of certain types of characters increases password complexity, and therefore makes it more difficult for an adversary to discover the password. In the DoD, the expectation is that the setting will range from a minimum of 1 to 2 lower case characters in the device unlock password. The parameter should be selected based on a risk assessment that weighs factors, such as the environments the device will be located and operational requirements for users to access data in a timely manner.",
"fixid": "F-KNOX-02-000600_fix",
"fixtext": "Configure the mobile operating system to disallow the device unlock password from containing fewer than a specified minimum number of lower case alphabetic characters.\n\nFor example, on the Fixmo Sentinel Administration Console, set the \"Min Lowercase\" value to 1 or more in the \"Android Honeycomb Password Restrictions\" rule.\n\n\n",
"iacontrols": null,
"id": "KNOX-02-000600",
"ruleID": "KNOX-02-000600_rule",
"severity": "medium",
"title": "The mobile operating system must disallow the device unlock password from containing fewer than a specified minimum number of lower case alphabetic characters.",
"version": "KNOX-02-000600"
},
"KNOX-02-000700": {
"checkid": "C-KNOX-02-000700_chk",
"checktext": "This check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the \"Min Numeric\" setting in the \"Android Honeycomb Password Restrictions\" rule. \n2. Verify the value of the setting is 1 or greater. \n\nOn the Samsung Knox Android device:\n1. Open the device settings.\n2. Select \"Lock screen\".\n3. Select \"Screen lock\".\n4. Enter current password.\n5. Select \"Password\".\n6. Attempt to enter a password that does not contain any numbers. \n\nIf the configured value for \"Min Numeric\" is not 1 or greater, or if the MOS accepts a password without any numbers, this is a finding.",
"description": "Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Setting minimum numbers of certain types of characters increases password complexity, and therefore makes it more difficult for an adversary to discover the password. In the DoD, the expectation is that the setting will range from a minimum of 1 to 2 numeric characters in the device unlock password. The parameter should be selected based on a risk assessment that weighs factors, such as the environments the device will be located and operational requirements for users to access data in a timely manner.",
"fixid": "F-KNOX-02-000700_fix",
"fixtext": "Configure the mobile operating system to disallow the device unlock password from containing fewer than a specified minimum number of numeric characters.\n\nFor example, on the Fixmo Sentinel Administration Console, set the \"Min Numeric\" value to 1 or more in the Android \"Honeycomb Password Restrictions\" rule.",
"iacontrols": null,
"id": "KNOX-02-000700",
"ruleID": "KNOX-02-000700_rule",
"severity": "medium",
"title": "The mobile operating system must disallow the device unlock password from containing fewer than a specified minimum number of numeric characters.",
"version": "KNOX-02-000700"
},
"KNOX-02-000800": {
"checkid": "C-KNOX-02-000800_chk",
"checktext": "If the local command determines that there is not a need for password rotation based on the expected operational use of the device, this requirement does not apply. \n \nThis check procedure is performed using an MDM tool.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the configured value for \"Exp Timeout\" in the \"Android Honeycomb Password Restrictions\" rule.\n2. Verify the value is set to 120 or less.\n\nIf the \"Exp Timeout\" value is not set to 120 days or less, this is a finding.",
"description": "Changing passcodes regularly prevents an attacker who has compromised the password from re-using it to regain access. This is an unlikely scenario, but is addressed by setting a password expiration. The IA control only needs to be enforced in product level STIGs if there is a need for such rotation based on the expected operational use of the device.",
"fixid": "F-KNOX-02-000800_fix",
"fixtext": "Configure the mobile operating system to have a maximum lifetime of 120 days for the device unlock password.\n\nFor example, on the Fixmo Sentinel Administration Console, set the \"Exp Timeout\" value to 120 or less in the \"Android Honeycomb Password Restrictions\" rule.",
"iacontrols": null,
"id": "KNOX-02-000800",
"ruleID": "KNOX-02-000800_rule",
"severity": "low",
"title": "The mobile operating system must enforce a maximum lifetime of 120 days for the device unlock password (password age).",
"version": "KNOX-02-000800"
},
"KNOX-02-000900": {
"checkid": "C-KNOX-02-000900_chk",
"checktext": "If the local command determines that there is not a need for password rotation based on the expected operational use of the device, this requirement does not apply. \n\nThis check procedure is performed using an MDM tool.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the configured value for \"PIN History\" in the \"Android Honeycomb Password Restrictions\" rule. \n2. Verify the configured value is 5 or less. \n\nIf the configured value for \"PIN History\" is not 5 or less, this is a finding.",
"description": "Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute force attacks. Remembering the prior five device unlock passwords enables the operating system from permitting those passwords to be reused, which increases the resistance against password attacks.",
"fixid": "F-KNOX-02-000900_fix",
"fixtext": "Configure the mobile operating system to prohibit a user from reusing any of the last five previously used device unlock passwords.\n\nFor example, on the Fixmo Sentinel Administration Console, set the \"PIN History\" value to 5 or less in the \"Android Honeycomb Password Restrictions\" rule.",
"iacontrols": null,
"id": "KNOX-02-000900",
"ruleID": "KNOX-02-000900_rule",
"severity": "low",
"title": "The mobile operating system must prohibit a user from reusing any of the last five previously used device unlock passwords.",
"version": "KNOX-02-000900"
},
"KNOX-03-001000": {
"checkid": "C-KNOX-03-001000_chk",
"checktext": "This check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the \"Min Mutation on Change\" setting in the \"Android Knox Password Restrictions\" rule. \n2. Verify the value of the setting is 2 or greater. \n\nOn the Samsung Knox Android device:\n1. Open the device settings.\n2. Select \"Lock screen\".\n3. Select \"Screen lock\".\n4. Enter current password.\n5. Select \"Password\".\n6. Attempt to enter a password that is the same as the previously existing password with one of its characters changed. \n\nIf the configured value of \"Min Mutation on Change\" is not two or greater on the MDM console, or if the MOS accepts the password with a single character changed, this is a finding.",
"description": "If an adversary learns part or all of a password, the adversary can use this information to more easily crack a user's subsequent passwords if the passwords do not differ significantly from one to the next. Requiring a user to change at least two characters in the password is an effective way of preserving the protection provided by password complexity in this context.",
"fixid": "F-KNOX-03-001000_fix",
"fixtext": "Configure the mobile operating system to require at least two characters to be changed when the device unlock password is changed.\n\nFor example, on the Fixmo Sentinel Administration Console, set the \"Min Mutation on Change\" value to 2 or more in the \"Android Knox Password Restrictions\" rule.\n\n\n\n\n",
"iacontrols": null,
"id": "KNOX-03-001000",
"ruleID": "KNOX-03-001000_rule",
"severity": "medium",
"title": "The mobile operating system must force the user to change at least two characters of the device unlock password whenever the password is changed.",
"version": "KNOX-03-001000"
},
"KNOX-03-001100": {
"checkid": "C-KNOX-03-001100_chk",
"checktext": "This check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n 1. Ask the MDM administrator to display the \"Max Sequential Chars\" setting in the \"Android Knox Password Restrictions\" rule.\n 2. Verify the configured value is 2 or greater.\n\nOn the Samsung Knox Android device:\n1. Open the device settings.\n2. Select \"Lock Screen\".\n3. Select \"Screen lock\".\n4. Enter current password.\n5. Select \"Password\".\n6. Attempt to enter a password that contains three sequential numbers. \n\nIf the \"Max Sequential Chars\" setting is not 2 or greater, or if the MOS accepts a password with three sequential numbers, this is a finding.",
"description": "Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Passwords with sequential numbers (e.g., 456 or 987) are considered easier to crack than random patterns. Therefore, disallowing sequential numbers makes it more difficult for an adversary to discover the password.",
"fixid": "F-KNOX-03-001100_fix",
"fixtext": "Configure the mobile operating system to disallow more than two sequential numbers in the device unlock password.\n\nFor example, on the Fixmo Sentinel Administration Console, set the \"Max Sequential Chars\" value to 2 or greater in the \"Android Knox Password Restrictions\" rule.",
"iacontrols": null,
"id": "KNOX-03-001100",
"ruleID": "KNOX-03-001100_rule",
"severity": "medium",
"title": "The mobile operating system must disallow more than two sequential numbers (e.g., 456) in the device unlock password.",
"version": "KNOX-03-001100"
},
"KNOX-04-001200": {
"checkid": "C-KNOX-04-001200_chk",
"checktext": "This check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor, example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the \"Disable USB Debugging\" checkbox in the \"Android Knox Base Restrictions\" rule. \n2. Verify the checkbox is selected. \n\nOn the Samsung Knox Android device:\n1. Open the device settings.\n2. Select \"Developer Options\".\n3. Verify the \"USB debugging\" checkbox is not selected. \n\nIf either the \"Disable USB Debugging\" checkbox is not selected on the MDM administration console or the \"USB debugging\" checkbox is selected on the device, this is a finding. \n\nNote: Knox Android complies with this requirement by disabling features that would require more detailed information in the audit logs. Privileged text-based commands can only be performed via the Android Debug Bridge, which is disabled by selecting the \"Disable USB Debugging\" checkbox as described above.",
"description": "Information system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control, includes timestamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.\n\nThe audit configuration must be adaptable to include organization defined additional, more detailed information in the audit records for audit events identified by type, location, or subject. Examples of this information include VPN state, communications interface, and duration of event.",
"fixid": "F-KNOX-04-001200_fix",
"fixtext": "Disable the ability to enter privileged text-based commands, thereby eliminating the need to audit them.\n\nFor example, on the Fixmo Sentinel Administration Console, check the \"Disable USB Debugging\" checkbox in the \"Android Knox Base Restrictions\" rule.",
"iacontrols": null,
"id": "KNOX-04-001200",
"ruleID": "KNOX-04-001200_rule",
"severity": "low",
"title": "The mobile operating system must include organization defined additional, more detailed information in the audit records for audit events identified by type, location, or subject.",
"version": "KNOX-04-001200"
},
"KNOX-04-001300": {
"checkid": "C-KNOX-04-001300_chk",
"checktext": "This check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the \"Disable USB Debugging\", \"Disable Vendor USB Protocol\", and \"Disable USB Media Player\" checkboxes in the \"Android Knox Base Restrictions\" rule.\n2. Verify all of the checkboxes are selected.\n\nOn the Samsung Knox Android device:\n1. With the device locked, connect the device to another device via a USB cable.\n2. Verify the MOS file system is not accessible.\n3. Unlock the device and open the device settings.\n4. Select \"Developer Options\".\n5. Ensure the \"USB debugging\" checkbox is not checked and cannot be checked by the user.\n\nIf any one of the \"Disable USB debugging\", \"Disable Vendor USB Protocol\", or \"Disable USB Media Player\" checkboxes is not selected in Fixmo Sentinel; or if the file system is accessible via a USB connection when the device is locked; or the user can select the \"USB debugging\" checkbox within Samsung Knox, this is a finding.",
"description": "Authentication may occur either by reentry of the device unlock passcode at the time of connection, through another passcode with the same or stronger complexity, or through PKI certificates. Authentication mitigates the risk that an adversary who obtains physical possession of the device is not able to use the tethered connection to access sensitive data on the device or otherwise tamper with its operating system or applications.",
"fixid": "F-KNOX-04-001300_fix",
"fixtext": "Configure the operating system to require authentication of tethered connections.\n\nFor example, on the Fixmo Sentinel Administration Console, check the \"Disable USB Debugging\", \"Disable Vendor USB Protocol\", and \"Disable USB Media Player\" checkboxes in the \"Android Knox Base Restrictions\" rule.\n\n",
"iacontrols": null,
"id": "KNOX-04-001300",
"ruleID": "KNOX-04-001300_rule",
"severity": "medium",
"title": "The mobile operating system must authenticate tethered connections to the device.",
"version": "KNOX-04-001300"
},
"KNOX-04-001400": {
"checkid": "C-KNOX-04-001400_chk",
"checktext": "This check procedure contains several elements from KNOX-04-001300 (SRG-OS-000231-MOS-000122). Results from that check procedure may be reused here.\n\nThis check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the administrator to display the \"Disable USB Debugging\" and \"Disable Vendor USB Protocol\" checkboxes in the \"Android Knox Base Restrictions\" rule.\n2. Verify both of the checkboxes are selected.\n3. Ask the administrator to display the \"Disable USB Tethering\" checkbox in the \"Android Knox Restrictions\" rule.\n4. Verify the checkbox is selected. \n\nOn the Samsung Knox Android device:\n1. With the device locked, connect the device to another device via a USB cable.\n2. Verify the MOS file system is not accessible.\n3. Unlock the device and open the device settings.\n4. Select \"Developer Options\".\n5. Verify the \"USB debugging\" checkbox is not checked.\n6. Verify the user cannot select the \"USB debugging\" checkbox.\n\nIf any one or more of the \"Disable USB debugging\", \"Disable Vendor USB Protocol\", or \"Disable USB tethering\" checkboxes is not selected; the file system is accessible via a USB connection when the device is locked; or the user can select the \"USB debugging\" checkbox within Samsung Knox Android, this is a finding.\n\nNote: This IA control is implemented by disabling any USB connection that someone could use to get access to the contact database when the device is locked. These connections are Android Debug Bridge, Vendor USB Protocol and USB Tethering. Once these features are disabled it is no longer feasible to access the contact database when the device is locked.",
"description": "On some devices, users can access the device's contact database to obtain phone numbers and other information using voice-activated Bluetooth peripherals even when the mobile device is locked. Often this information is personally identifiable information (PII), which is considered sensitive. It could also be used by an adversary to profile the user or engage in social engineering to obtain further information from other unsuspecting users. Disabling access to the contact database in these situations mitigates the risk of this attack. The DAA may waive this requirement with written notice if the operational environment requires this capability.",
"fixid": "F-KNOX-04-001400_fix",
"fixtext": "Configure the operating system to disable access to the device's contact database when the device is locked.\n\nFor example, on the Fixmo Sentinel Administration Console, check the \"Disable USB Debugging\" and \"Disable Vendor USB Protocol\" checkboxes in the \"Android Knox Base Restrictions\" rule.\n\nAlso on the Fixmo Sentinel Administration Console, check the \"Disable USB Tethering\" checkbox in the \"Android Knox Restrictions\" rule.",
"iacontrols": null,
"id": "KNOX-04-001400",
"ruleID": "KNOX-04-001400_rule",
"severity": "medium",
"title": "The mobile operating system must disable access to the device's contact database when the device is locked.",
"version": "KNOX-04-001400"
},
"KNOX-04-001500": {
"checkid": "C-KNOX-04-001500_chk",
"checktext": "This check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the list of whitelisted Bluetooth devices in the \"Android Restrictions\" rule. \n2. Verify only the BAI smart card reader and headset are present on the list (Note: this is signified by a single entry of \"401D59\").\n\nOn the Samsung Knox Android device:\n1. Open device settings and select \"Bluetooth\".\n2. Review existing Bluetooth devices and verify that only the BAI smart card reader and headset are paired and/or are able to pair.\n\nIf there are any unauthorized Bluetooth devices on the whitelist, this is a finding.",
"description": "Bluetooth mutual authentication provides assurance that both the mobile device and Bluetooth peripheral are legitimate. If the authentication does not occur immediately before permitting a network connection, there is the potential for a man-in-the-middle attack in which a third device intercepts the traffic between the two legitimate devices. Mutual authentication prevents this from occurring.",
"fixid": "F-KNOX-04-001500_fix",
"fixtext": "Configure the operating system's Bluetooth stack to prohibit data transfer between devices prior to Bluetooth mutual authentication.\n\nFor example, on the Fixmo Sentinel Administration Console, enter the manufacturer ID of the Bluetooth MAC address (first 6 characters) of each device that should be allowed to pair on the whitelist of the \"Android Restrictions\" rule.\n\nNote: To whitelist the Biometric Associates, LP Bluetooth Smart Card Reader enter: \"401D59\".",
"iacontrols": null,
"id": "KNOX-04-001500",
"ruleID": "KNOX-04-001500_rule",
"severity": "medium",
"title": "The mobile operating system's Bluetooth module must not permit any data transfer between devices prior to Bluetooth mutual authentication.",
"version": "KNOX-04-001500"
},
"KNOX-04-001600": {
"checkid": "C-KNOX-04-001600_chk",
"checktext": "This check procedure is identical to check procedure for KNOX-04-001500 (SRG-OS-000114-MOS-000068). It need not be repeated if results have been acquired from that check procedure. \n\nThis check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the administrator to display the list of whitelisted Bluetooth devices in the \"Android Restrictions\" group. \n2. Verify only the BAI smart card reader and headset are present on the list (Note: this is signified by a single entry of \"401D59\").\n\nOn the Samsung Knox Android device:\n1. Open device settings and select \"Bluetooth\".\n2. Review existing Bluetooth devices and verify that only the BAI smart card reader and headset are paired and/or are able to pair.\n\n\nIf there are any unauthorized devices on the whitelist, this is a finding.",
"description": "If data traffic is sent unencrypted, an adversary may be able to read it to obtain sensitive information. 128-bit Bluetooth encryption for data communications mitigates the risk of unauthorized eavesdropping. DoD has determined that FIPS 140-2 validated encryption is not required for voice communications.",
"fixid": "F-KNOX-04-001600_fix",
"fixtext": "Limit Bluetooth devices to those known to employ 128-bit Bluetooth encryption.\n\nFor example, on the Fixmo Sentinel Administration Console, enter the manufacturer ID of the Bluetooth MAC Address (first 6 characters) of each device that should be allowed to pair on the whitelist of the \"Android Restrictions\" rule.\n\nNote: To whitelist the Biometric Associates, LP Bluetooth Smart Card Reader enter: 401D59",
"iacontrols": null,
"id": "KNOX-04-001600",
"ruleID": "KNOX-04-001600_rule",
"severity": "medium",
"title": "The mobile operating system's Bluetooth stack must use 128-bit Bluetooth encryption when performing data communications with other Bluetooth devices.",
"version": "KNOX-04-001600"
},
"KNOX-05-001800": {
"checkid": "C-KNOX-05-001800_chk",
"checktext": "This check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device. In some cases, there will be integrity services software that runs independently from the MDM.\n\nCheck that the appropriate setting is configured on the MDM or integrity services server.\n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the \"Scan Freq\" setting in the \"Android Communication Frequency\" rule.\n2. Verify the value of the setting is 6 or less. \n\nOn the Samsung Knox Android device, open the application list and verify the presence of an integrity services agent. For example, if the integrity services agent is Fixmo Sentinel:\n1. Open the Fixmo Sentinel MDM agent.\n2. Press the menu button and select Details.\n3. Verify the configured value for \"Scan Freq\" is 6 or less.\n\nIf the configured value for \"Scan Freq\" is greater than 6 on either the MDM console or in the integrity services agent, this is a finding.",
"description": "Unauthorized changes to the operating system software or information on the system can possibly result in integrity or availability concerns. In order to quickly react to this situation, the operating system must detect these changes. One aspect of detection is the frequency at which the scans occur. The ability to set an appropriate frequency mitigates the risk that an attack will go without detection longer than the scanning interval.",
"fixid": "F-KNOX-05-001800_fix",
"fixtext": "Configure the mobile operating system so that the device integrity validation scan frequency is at least once every six hours.\n\nFor example, on the Fixmo Sentinel Administration Console, set the \"Scan Freq\" value to 6 in the \"Android Communication Frequency\" rule.",
"iacontrols": null,
"id": "KNOX-05-001800",
"ruleID": "KNOX-05-001800_rule",
"severity": "low",
"title": "The mobile operating system must conduct a device integrity scan at least once every six hours.",
"version": "KNOX-05-001800"
},
"KNOX-06-001900": {
"checkid": "C-KNOX-06-001900_chk",
"checktext": "This check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the address/port restrictions configured in the \"Android Firewall\" rule. \n2. Print or copy these so that they are available for the check procedure to be performed on each sampled device. \n\nOn the Samsung Knox Android device:\n1. Open the device Internet Browser.\n2. Attempt to navigate to a blocked IP address and port.\n3. Verify the attempt fails.\n\nIf it is feasible to access a blocked IP address or port, this is a finding.",
"description": "Open ports provide an attack surface that an adversary can then potentially use to breach system security. If an adversary can communicate with the mobile device from any IP address, then the device may be open to any other device on the Internet. Reducing the attack surface through IP address and port restrictions mitigates this risk.",
"fixid": "F-KNOX-06-001900_fix",
"fixtext": "Configure the mobile operating system to filter both inbound and outbound traffic based on IP address and UDP/TCP port.\n\nFor example, on the Fixmo Sentinel Administration Console, enter the allowed and denied IP addresses and ports in the \"Android Firewall\" rule.",
"iacontrols": null,
"id": "KNOX-06-001900",
"ruleID": "KNOX-06-001900_rule",
"severity": "low",
"title": "The mobile operating system must be able to filter both inbound and outbound traffic based on IP address and UDP/TCP port.",
"version": "KNOX-06-001900"
},
"KNOX-07-002100": {
"checkid": "C-KNOX-07-002100_chk",
"checktext": "This check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the list of server authentication certificates in the \"Android Certificate Configuration\" rule. \n2. Verify only DoD PKI issued or DoD approved server authentication certificates are present (Note: these may include those approved by the local command).\n\nOn the Samsung Knox Android device:\n1. Open device settings.\n2. Select \"Security\".\n3. Select \"Trusted credentials\".\n4. Select the \"User\" tab.\n5. Verify no certificates are listed, or that any that are listed have been authorized.\n\nIf there are unapproved device authentication certificates present on the MDM whitelist or on the \"User\" tab of the \"Trusted Credentials\" setting in the device's \"Security\" settings, this is a finding.\n",
"description": "If unauthorized device authentication certificates are installed on the device, there is the potential that the device may connect to a rogue device or network. Rogue devices can mimic the behavior of authorized equipment to trick the user into providing authentication credentials, which could then in turn be used to compromise DoD information and networks. Restricting device authentication certificates to an authorized list mitigates the risk of attaching to rogue devices and networks.",
"fixid": "F-KNOX-07-002100_fix",
"fixtext": "Remove non-approved server authentication certificates from the device.\n\nFor example, on the Fixmo Sentinel Administration Console, modify the certificate whitelist so that it only includes DoD PKI issued or DoD approved server authentication certificates in the \"Android Certificate Configuration\" rule.",
"iacontrols": null,
"id": "KNOX-07-002100",
"ruleID": "KNOX-07-002100_rule",
"severity": "medium",
"title": "Only DoD PKI-issued or DoD-approved server authentication certificates may be installed on DoD mobile operating system devices.",
"version": "KNOX-07-002100"
},
"KNOX-08-002200": {
"checkid": "C-KNOX-08-002200_chk",
"checktext": "This check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the \"Storage Encryption\" checkbox in the \"Android Honeycomb Restrictions\" rule. \n2. Verify the \"Storage Encryption\" checkbox is checked. \n\nOn the Samsung Knox Android device:\n1. Open the device settings.\n2. Select \"Security\". \n3. Verify \"Encrypt device\" is greyed out and \"Encrypted\" is displayed.\n4. Select \"Encrypt external SD card\".\n5. Verify \"The encryption policy has been applied\" is displayed at the bottom of the screen.\n\nNOTE: If no SD card is inserted, Step 5 should display \"SD card is not inserted\" at the bottom of the screen.\n\nIf the specified encryption settings are not set to the appropriate values, this is a finding.",
"description": "If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. AES encryption with appropriate key lengths provides assurance that the cryptography is adequate.",
"fixid": "F-KNOX-08-002200_fix",
"fixtext": "Configure the MOS to encrypt call data on the mobile device using AES encryption.\n\nFor example, on the Fixmo Sentinel Administration Console, check the \"Storage Encryption\" checkbox in the \"Android Honeycomb Restrictions\" rule.",
"iacontrols": null,
"id": "KNOX-08-002200",
"ruleID": "KNOX-08-002200_rule",
"severity": "medium",
"title": "The mobile operating system must encrypt all data on the mobile device using AES encryption (AES 128 bit encryption key length is the minimum requirement; AES 256-bit desired).",
"version": "KNOX-08-002200"
},
"KNOX-12-002300": {
"checkid": "C-KNOX-12-002300_chk",
"checktext": "This check procedure is performed using an MDM tool.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the \"Enforce Signature Blacklisting\" checkbox in the \"Android Knox Restrictions\" rule.\n2. Verify the checkbox is selected.\n\nIf the \"Enforce Signature Blacklisting\" checkbox is not selected, this is a finding.\n\nNOTE: Selecting the \"Enforce Signature Blacklisting\" checkbox activates the Knox Android application quarantine capability.\n",
"description": "Any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system. Digital signatures on code provide assurance that the code comes from a known source and has not been modified.",
"fixid": "F-KNOX-12-002300_fix",
"fixtext": "Configure the operating system to prevent the installation of applications that are not digitally signed with a DoD-approved private key.\n\nFor example, on the Fixmo Sentinel Administration Console, check \"Enforce Signature Blacklisting\" in the \"Android Knox Restrictions\" rule.\n",
"iacontrols": null,
"id": "KNOX-12-002300",
"ruleID": "KNOX-12-002300_rule",
"severity": "high",
"title": "The mobile operating system must prevent the installation of applications that are not digitally signed with a DoD-approved private key.",
"version": "KNOX-12-002300"
},
"KNOX-12-002400": {
"checkid": "C-KNOX-12-002400_chk",
"checktext": "This check procedure is identical to the one provided for KNOX-12-002300 (SRG-OS-000090-MOS-000060). It need not be repeated if results have been acquired from that check procedure.\n\nThis check procedure is performed using an MDM tool.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the \"Enforce Signature Blacklisting\" checkbox in the \"Android Knox Restrictions\" rule.\n2. Verify the checkbox is selected.\n\nIf the \"Enforce Signature Blacklisting\" checkbox is not selected, this is a finding.\n\nNOTE: Selecting the \"Enforce Signature Blacklisting\" checkbox activates the Knox Android application quarantine capability.\n",
"description": "The operating system must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what types of installations are prohibited (e.g., software whose pedigree with regard to being potentially malicious is unknown or suspect) by the organization. The installation and execution of unauthorized software on an operating system may allow the application to obtain sensitive information or further compromise the system. Preventing a user from installing unapproved applications mitigates this risk.",
"fixid": "F-KNOX-12-002400_fix",
"fixtext": "Configure the mobile operating system to prevent a user from installing unapproved applications.\n\nFor example, on the Fixmo Sentinel Administration Console, check the \"Enforce Signature Blacklisting\" in the \"Android Knox Restrictions\" rule.",
"iacontrols": null,
"id": "KNOX-12-002400",
"ruleID": "KNOX-12-002400_rule",
"severity": "high",
"title": "The mobile operating system must prevent a user from installing unapproved applications.",
"version": "KNOX-12-002400"
},
"KNOX-13-002500": {
"checkid": "C-KNOX-13-002500_chk",
"checktext": "This check procedure is performed on both the MDM Administration Console and the Samsung Knox Android device.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console: \n1. Ask the MDM administrator to display the \"Disable Manual Date Time Changes\" checkbox in the \"Android Knox Restrictions\" rule. \n2. Verify the checkbox is selected. \n\nOn the Samsung Knox Android device:\n1. Open the device settings.\n2. Select \"Date and time\".\n3. Verify the \"Automatic date and time\" checkbox is checked.\n4. Verify a user cannot deselect the \"Automatic date and time\" checkbox.\n\nIf either the \"Disable Manual Date Time Changes\" checkbox is not checked on the MDM administration console; or the \"Automatic date and time\" checkbox is not checked on the device; or if it is possible to deselect this option on the device, this is a finding.",
"description": "Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events. \n\nPeriodically synchronizing internal clocks with an authoritative time source is needed in order to correctly correlate the timing of events that occur across the enterprise. The two authoritative time sources for mobile operating systems are an authoritative time server which is synchronized with redundant United States Naval Observatory (USNO) time servers as designated for the appropriate DoD network (NIPRNet or SIPRNet) or the Global Positioning System (GPS).\n\nTimestamps generated by the audit system in mobile operating systems shall include both date and time. The time may be expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.",
"fixid": "F-KNOX-13-002500_fix",
"fixtext": "Configure the mobile operating system to synchronize the internal clock at least once every 24 hours with an authoritative time server or the Global Positioning System.\n\nFor example, on the Fixmo Sentinel Administration Console, check the \"Disable Manual Date Time Changes\" checkbox in the \"Android Knox Restrictions\" rule.",
"iacontrols": null,
"id": "KNOX-13-002500",
"ruleID": "KNOX-13-002500_rule",
"severity": "low",
"title": "The mobile operating system must synchronize the internal clock at least once every 24 hours with an authoritative time server or the Global Positioning System.",
"version": "KNOX-13-002500"
},
"KNOX-13-002600": {
"checkid": "C-KNOX-13-002600_chk",
"checktext": "This check procedure is performed using an MDM tool.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the \"Disable Insecure VPN Connections\" checkbox in the \"Android Knox Restrictions\" rule. \n2. Verify the checkbox is selected.\n\nIf the \"Disable Insecure VPN Connections\" checkbox is not selected, this is a finding.",
"description": "Without strong mutual authentication a mobile device may connect to an unauthorized network. In many cases, the user may falsely believe that the device is connected to an authorized network and then provide authentication credentials and other sensitive information. A strong bidirectional cryptographically based authentication method mitigates this risk.",
"fixid": "F-KNOX-13-002600_fix",
"fixtext": "Configure the operating system to authenticate devices before establishing remote connections.\n\nFor example, on the Fixmo Sentinel Administration Console, check the \"Disable Insecure VPN Connections\" checkbox in the \"Android Knox Restrictions\" rule.",
"iacontrols": null,
"id": "KNOX-13-002600",
"ruleID": "KNOX-13-002600_rule",
"severity": "medium",
"title": "The mobile operating system must authenticate devices before establishing remote network (e.g., VPN) connections using bidirectional cryptographically based authentication between devices.",
"version": "KNOX-13-002600"
},
"KNOX-13-002700": {
"checkid": "C-KNOX-13-002700_chk",
"checktext": "This check procedure is performed using an MDM tool.\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the administrator to display the \"Disable Insecure VPN Connections\" checkbox in the \"Android Knox Restrictions\" rule. \n2. Verify the checkbox is selected. \n\nIf the \"Disable Insecure VPN Connections\" checkbox is not selected, this is a finding.",
"description": "Use of non-standard communications protocols can affect both the availability and confidentiality of communications. IPSec and SSL/TLS are both well-known and tested protocols that provide strong assurance with respect to both IA and interoperability.",
"fixid": "F-KNOX-13-002700_fix",
"fixtext": "Configure the mobile operating system's VPN client to use IPSec or SSL/TLS when connecting to a DoD network.\n\nFor example, on the Fixmo Sentinel Administration Console, check the \"Disable Insecure VPN Connections\" checkbox in the \"Android Knox Restrictions\" rule.",
"iacontrols": null,
"id": "KNOX-13-002700",
"ruleID": "KNOX-13-002700_rule",
"severity": "medium",
"title": "The mobile operating system's VPN client must use either IPSec or SSL/TLS when connecting to DoD networks.",
"version": "KNOX-13-002700"
},
"KNOX-13-002800": {
"checkid": "C-KNOX-13-002800_chk",
"checktext": "This check procedure is performed on both the Fixmo Sentinel Administration Console and the Samsung Knox device.\n\n\nCheck that the appropriate setting is configured on the MDM server. \n\nFor example, on the Fixmo Sentinel Administration Console:\n1. Ask the MDM administrator to display the \"Web Proxy\" field in the \"Android Knox Restrictions\" rule. \n2. Verify this field contains both an IP address and port of a DoD proxy or content filtering server using the format [IP Address]:[port number].\nNote: If the format is not correct, the setting may not be enforced.\n\nOn the Samsung Knox device:\n1. Open the Internet browser.\n2. Navigate to a known blocked or filtered website.\n3. Verify the website cannot be accessed.\nIf greater assurance is required, access a number of Internet websites and verify traffic flows through a DoD proxy server by viewing the traffic using a network protocol analyzer or by communicating with personnel that manage the proxy server. \n\n\nIf a proxy or web content filtering server is not configured on the MDM console using the format [IP Address]:[port number], or the device successfully accesses any known blocked website, this is a finding.\n",
"description": "Proxy servers can inspect traffic for malware and other signs of a security attack. Allowing a mobile device to access the public Internet without proxy server inspection forgoes the protection that the proxy server would otherwise provide. Malware downloaded onto the device could have a wide variety of malicious consequences, including loss of sensitive DoD information. Forcing traffic to flow through a proxy server greatly mitigates the risk of access to public Internet resources.",
"fixid": "F-KNOX-13-002800_fix",
"fixtext": "Disable browsers that do not support a feature to direct all traffic to a designated proxy server. Configure browsers that support this functionality to direct all traffic to a designated proxy server.\n\nFor example, on the Fixmo Sentinel Administration Console, enter the both IP address and port of the DoD proxy in the \"Web Proxy\" field in the \"Android Knox Restrictions\" rule. The format must be [IP Address]:[port number].\n\nNote: This setting only applies to the stock browser, but third party browsers would have to be whitelisted prior to operation.",
"iacontrols": null,
"id": "KNOX-13-002800",
"ruleID": "KNOX-13-002800_rule",
"severity": "medium",
"title": "The mobile operating system must prevent a user from using a browser that does not direct its traffic to a DoD proxy server.",
"version": "KNOX-13-002800"
}
},
"profiles": {
"MAC-1_Classified": {
"description": "",
"findings": {
"KNOX-00-000100": "true",
"KNOX-01-000200": "true",
"KNOX-01-000300": "true",
"KNOX-01-000400": "true",
"KNOX-02-000500": "true",
"KNOX-02-000600": "true",
"KNOX-02-000700": "true",
"KNOX-02-000800": "true",
"KNOX-02-000900": "true",
"KNOX-03-001000": "true",
"KNOX-03-001100": "true",
"KNOX-04-001200": "true",
"KNOX-04-001300": "true",
"KNOX-04-001400": "true",
"KNOX-04-001500": "true",
"KNOX-04-001600": "true",
"KNOX-05-001800": "true",
"KNOX-06-001900": "true",
"KNOX-07-002100": "true",
"KNOX-08-002200": "true",
"KNOX-12-002300": "true",
"KNOX-12-002400": "true",
"KNOX-13-002500": "true",
"KNOX-13-002600": "true",
"KNOX-13-002700": "true",
"KNOX-13-002800": "true"
},
"id": "MAC-1_Classified",
"title": "I - Mission Critical Classified"
},
"MAC-1_Public": {
"description": "",
"findings": {
"KNOX-00-000100": "true",
"KNOX-01-000200": "true",
"KNOX-01-000300": "true",
"KNOX-01-000400": "true",
"KNOX-02-000500": "true",
"KNOX-02-000600": "true",
"KNOX-02-000700": "true",
"KNOX-02-000800": "true",
"KNOX-02-000900": "true",
"KNOX-03-001000": "true",
"KNOX-03-001100": "true",
"KNOX-04-001200": "true",
"KNOX-04-001300": "true",
"KNOX-04-001400": "true",
"KNOX-04-001500": "true",
"KNOX-04-001600": "true",
"KNOX-05-001800": "true",
"KNOX-06-001900": "true",
"KNOX-07-002100": "true",
"KNOX-08-002200": "true",
"KNOX-12-002300": "true",
"KNOX-12-002400": "true",
"KNOX-13-002500": "true",
"KNOX-13-002600": "true",
"KNOX-13-002700": "true",
"KNOX-13-002800": "true"
},
"id": "MAC-1_Public",
"title": "I - Mission Critical Public"
},
"MAC-1_Sensitive": {
"description": "",
"findings": {
"KNOX-00-000100": "true",
"KNOX-01-000200": "true",
"KNOX-01-000300": "true",
"KNOX-01-000400": "true",
"KNOX-02-000500": "true",
"KNOX-02-000600": "true",
"KNOX-02-000700": "true",
"KNOX-02-000800": "true",
"KNOX-02-000900": "true",
"KNOX-03-001000": "true",
"KNOX-03-001100": "true",
"KNOX-04-001200": "true",
"KNOX-04-001300": "true",
"KNOX-04-001400": "true",
"KNOX-04-001500": "true",
"KNOX-04-001600": "true",
"KNOX-05-001800": "true",
"KNOX-06-001900": "true",
"KNOX-07-002100": "true",
"KNOX-08-002200": "true",
"KNOX-12-002300": "true",
"KNOX-12-002400": "true",
"KNOX-13-002500": "true",
"KNOX-13-002600": "true",
"KNOX-13-002700": "true",
"KNOX-13-002800": "true"
},
"id": "MAC-1_Sensitive",
"title": "I - Mission Critical Sensitive"
},
"MAC-2_Classified": {
"description": "",
"findings": {
"KNOX-00-000100": "true",
"KNOX-01-000200": "true",
"KNOX-01-000300": "true",
"KNOX-01-000400": "true",
"KNOX-02-000500": "true",
"KNOX-02-000600": "true",
"KNOX-02-000700": "true",
"KNOX-02-000800": "true",
"KNOX-02-000900": "true",
"KNOX-03-001000": "true",
"KNOX-03-001100": "true",
"KNOX-04-001200": "true",
"KNOX-04-001300": "true",
"KNOX-04-001400": "true",
"KNOX-04-001500": "true",
"KNOX-04-001600": "true",
"KNOX-05-001800": "true",
"KNOX-06-001900": "true",
"KNOX-07-002100": "true",
"KNOX-08-002200": "true",
"KNOX-12-002300": "true",
"KNOX-12-002400": "true",
"KNOX-13-002500": "true",
"KNOX-13-002600": "true",
"KNOX-13-002700": "true",
"KNOX-13-002800": "true"
},
"id": "MAC-2_Classified",
"title": "II - Mission Support Classified"
},
"MAC-2_Public": {
"description": "",
"findings": {
"KNOX-00-000100": "true",
"KNOX-01-000200": "true",
"KNOX-01-000300": "true",
"KNOX-01-000400": "true",
"KNOX-02-000500": "true",
"KNOX-02-000600": "true",
"KNOX-02-000700": "true",
"KNOX-02-000800": "true",
"KNOX-02-000900": "true",
"KNOX-03-001000": "true",
"KNOX-03-001100": "true",
"KNOX-04-001200": "true",
"KNOX-04-001300": "true",
"KNOX-04-001400": "true",
"KNOX-04-001500": "true",
"KNOX-04-001600": "true",
"KNOX-05-001800": "true",
"KNOX-06-001900": "true",
"KNOX-07-002100": "true",
"KNOX-08-002200": "true",
"KNOX-12-002300": "true",
"KNOX-12-002400": "true",
"KNOX-13-002500": "true",
"KNOX-13-002600": "true",
"KNOX-13-002700": "true",
"KNOX-13-002800": "true"
},
"id": "MAC-2_Public",
"title": "II - Mission Support Public"
},
"MAC-2_Sensitive": {
"description": "",
"findings": {
"KNOX-00-000100": "true",
"KNOX-01-000200": "true",
"KNOX-01-000300": "true",
"KNOX-01-000400": "true",
"KNOX-02-000500": "true",
"KNOX-02-000600": "true",
"KNOX-02-000700": "true",
"KNOX-02-000800": "true",
"KNOX-02-000900": "true",
"KNOX-03-001000": "true",
"KNOX-03-001100": "true",
"KNOX-04-001200": "true",
"KNOX-04-001300": "true",
"KNOX-04-001400": "true",
"KNOX-04-001500": "true",
"KNOX-04-001600": "true",
"KNOX-05-001800": "true",
"KNOX-06-001900": "true",
"KNOX-07-002100": "true",
"KNOX-08-002200": "true",
"KNOX-12-002300": "true",
"KNOX-12-002400": "true",
"KNOX-13-002500": "true",
"KNOX-13-002600": "true",
"KNOX-13-002700": "true",
"KNOX-13-002800": "true"
},
"id": "MAC-2_Sensitive",
"title": "II - Mission Support Sensitive"
},
"MAC-3_Classified": {
"description": "",
"findings": {
"KNOX-00-000100": "true",
"KNOX-01-000200": "true",
"KNOX-01-000300": "true",
"KNOX-01-000400": "true",
"KNOX-02-000500": "true",
"KNOX-02-000600": "true",
"KNOX-02-000700": "true",
"KNOX-02-000800": "true",
"KNOX-02-000900": "true",
"KNOX-03-001000": "true",
"KNOX-03-001100": "true",
"KNOX-04-001200": "true",
"KNOX-04-001300": "true",
"KNOX-04-001400": "true",
"KNOX-04-001500": "true",
"KNOX-04-001600": "true",
"KNOX-05-001800": "true",
"KNOX-06-001900": "true",
"KNOX-07-002100": "true",
"KNOX-08-002200": "true",
"KNOX-12-002300": "true",
"KNOX-12-002400": "true",
"KNOX-13-002500": "true",
"KNOX-13-002600": "true",
"KNOX-13-002700": "true",
"KNOX-13-002800": "true"
},
"id": "MAC-3_Classified",
"title": "III - Administrative Classified"
},
"MAC-3_Public": {
"description": "",
"findings": {
"KNOX-00-000100": "true",
"KNOX-01-000200": "true",
"KNOX-01-000300": "true",
"KNOX-01-000400": "true",
"KNOX-02-000500": "true",
"KNOX-02-000600": "true",
"KNOX-02-000700": "true",
"KNOX-02-000800": "true",
"KNOX-02-000900": "true",
"KNOX-03-001000": "true",
"KNOX-03-001100": "true",
"KNOX-04-001200": "true",
"KNOX-04-001300": "true",
"KNOX-04-001400": "true",
"KNOX-04-001500": "true",
"KNOX-04-001600": "true",
"KNOX-05-001800": "true",
"KNOX-06-001900": "true",
"KNOX-07-002100": "true",
"KNOX-08-002200": "true",
"KNOX-12-002300": "true",
"KNOX-12-002400": "true",
"KNOX-13-002500": "true",
"KNOX-13-002600": "true",
"KNOX-13-002700": "true",
"KNOX-13-002800": "true"
},
"id": "MAC-3_Public",
"title": "III - Administrative Public"
},
"MAC-3_Sensitive": {
"description": "",
"findings": {
"KNOX-00-000100": "true",
"KNOX-01-000200": "true",
"KNOX-01-000300": "true",
"KNOX-01-000400": "true",
"KNOX-02-000500": "true",
"KNOX-02-000600": "true",
"KNOX-02-000700": "true",
"KNOX-02-000800": "true",
"KNOX-02-000900": "true",
"KNOX-03-001000": "true",
"KNOX-03-001100": "true",
"KNOX-04-001200": "true",
"KNOX-04-001300": "true",
"KNOX-04-001400": "true",
"KNOX-04-001500": "true",
"KNOX-04-001600": "true",
"KNOX-05-001800": "true",
"KNOX-06-001900": "true",
"KNOX-07-002100": "true",
"KNOX-08-002200": "true",
"KNOX-12-002300": "true",
"KNOX-12-002400": "true",
"KNOX-13-002500": "true",
"KNOX-13-002600": "true",
"KNOX-13-002700": "true",
"KNOX-13-002800": "true"
},
"id": "MAC-3_Sensitive",
"title": "III - Administrative Sensitive"
}
},
"slug": "samsung_knox_android_1.0",
"title": "Samsung Knox Android 1.0 STIG",
"version": "1"
}
}