KNOX-12-002300 | High | The mobile operating system must prevent the installation of applications that are not digitally signed with a DoD-approved private key. | Any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system.... |
KNOX-12-002400 | High | The mobile operating system must prevent a user from installing unapproved applications. | The operating system must enforce software installation by users based upon what types of software installations are permitted (e.g., updates and security patches to existing software) and what... |
KNOX-01-000400 | Medium | The mobile operating system must not permit a user to disable the password-protected lock feature on the device. | If the user is able to disable the password-protected lock feature, the user can change the configuration of the device to allow access without a password. The modified configuration would enable... |
KNOX-03-001100 | Medium | The mobile operating system must disallow more than two sequential numbers (e.g., 456) in the device unlock password. | Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Passwords with sequential numbers (e.g., 456 or 987) are considered... |
KNOX-13-002700 | Medium | The mobile operating system's VPN client must use either IPSec or SSL/TLS when connecting to DoD networks. | Use of non-standard communications protocols can affect both the availability and confidentiality of communications. IPSec and SSL/TLS are both well-known and tested protocols that provide strong... |
KNOX-03-001000 | Medium | The mobile operating system must force the user to change at least two characters of the device unlock password whenever the password is changed. | If an adversary learns part or all of a password, the adversary can use this information to more easily crack a user's subsequent passwords if the passwords do not differ significantly from one to... |
KNOX-13-002600 | Medium | The mobile operating system must authenticate devices before establishing remote network (e.g., VPN) connections using bidirectional cryptographically based authentication between devices. | Without strong mutual authentication a mobile device may connect to an unauthorized network. In many cases, the user may falsely believe that the device is connected to an authorized network and... |
KNOX-08-002200 | Medium | The mobile operating system must encrypt all data on the mobile device using AES encryption (AES 128 bit encryption key length is the minimum requirement; AES 256-bit desired). | If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly,... |
KNOX-04-001300 | Medium | The mobile operating system must authenticate tethered connections to the device. | Authentication may occur either by reentry of the device unlock passcode at the time of connection, through another passcode with the same or stronger complexity, or through PKI certificates.... |
KNOX-02-000500 | Medium | The mobile operating system must disallow the device unlock password from containing fewer than a specified minimum number of upper case alphabetic characters. | Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Setting minimum numbers of certain types of characters increases... |
KNOX-04-001400 | Medium | The mobile operating system must disable access to the device's contact database when the device is locked. | On some devices, users can access the device's contact database to obtain phone numbers and other information using voice-activated Bluetooth peripherals even when the mobile device is locked.... |
KNOX-02-000700 | Medium | The mobile operating system must disallow the device unlock password from containing fewer than a specified minimum number of numeric characters. | Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Setting minimum numbers of certain types of characters increases... |
KNOX-07-002100 | Medium | Only DoD PKI-issued or DoD-approved server authentication certificates may be installed on DoD mobile operating system devices. | If unauthorized device authentication certificates are installed on the device, there is the potential that the device may connect to a rogue device or network. Rogue devices can mimic the... |
KNOX-02-000600 | Medium | The mobile operating system must disallow the device unlock password from containing fewer than a specified minimum number of lower case alphabetic characters. | Password complexity or strength refers to how difficult it is to determine a password using a dictionary or brute force attack. Setting minimum numbers of certain types of characters increases... |
KNOX-00-000100 | Medium | The mobile operating system must employ mobile device management services to centrally manage configuration settings, including security policies. | Security related parameters are those parameters impacting the security state of the system and include parameters related to the implementation of other IA controls. If these controls are not... |
KNOX-13-002800 | Medium | The mobile operating system must prevent a user from using a browser that does not direct its traffic to a DoD proxy server. | Proxy servers can inspect traffic for malware and other signs of a security attack. Allowing a mobile device to access the public Internet without proxy server inspection forgoes the protection... |
KNOX-01-000200 | Medium | The mobile operating system must enforce a minimum length for the device unlock password. | Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute force attacks. The ability to crack a password is a function of how many times an... |
KNOX-04-001500 | Medium | The mobile operating system's Bluetooth module must not permit any data transfer between devices prior to Bluetooth mutual authentication. | Bluetooth mutual authentication provides assurance that both the mobile device and Bluetooth peripheral are legitimate. If the authentication does not occur immediately before permitting a network... |
KNOX-01-000300 | Medium | The mobile operating system must lock the device after no more than 15 minutes of inactivity. | The device lock function prevents further access to the system by initiating a session lock after a period of inactivity or upon receiving a request from a user. The device lock is retained until... |
KNOX-04-001600 | Medium | The mobile operating system's Bluetooth stack must use 128-bit Bluetooth encryption when performing data communications with other Bluetooth devices. | If data traffic is sent unencrypted, an adversary may be able to read it to obtain sensitive information. 128-bit Bluetooth encryption for data communications mitigates the risk of unauthorized... |
KNOX-05-001800 | Low | The mobile operating system must conduct a device integrity scan at least once every six hours. | Unauthorized changes to the operating system software or information on the system can possibly result in integrity or availability concerns. In order to quickly react to this situation, the... |
KNOX-13-002500 | Low | The mobile operating system must synchronize the internal clock at least once every 24 hours with an authoritative time server or the Global Positioning System. | Determining the correct time a particular application event occurred on a system is critical when conducting forensic analysis and investigating system events.
Periodically synchronizing... |
KNOX-04-001200 | Low | The mobile operating system must include organization defined additional, more detailed information in the audit records for audit events identified by type, location, or subject. | Information system auditing capability is critical for accurate forensic analysis. Audit record content that may be necessary to satisfy the requirement of this control, includes timestamps,... |
KNOX-06-001900 | Low | The mobile operating system must be able to filter both inbound and outbound traffic based on IP address and UDP/TCP port. | Open ports provide an attack surface that an adversary can then potentially use to breach system security. If an adversary can communicate with the mobile device from any IP address, then the... |
KNOX-02-000900 | Low | The mobile operating system must prohibit a user from reusing any of the last five previously used device unlock passwords. | Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute force attacks. Remembering the prior five device unlock passwords enables the... |
KNOX-02-000800 | Low | The mobile operating system must enforce a maximum lifetime of 120 days for the device unlock password (password age). | Changing passcodes regularly prevents an attacker who has compromised the password from re-using it to regain access. This is an unlikely scenario, but is addressed by setting a password... |