Smartphone Instant Messaging (IM) client application must connect only to a DoD controlled IM server that is compliant with the Instant Messaging STIG.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-24965	WIR-SPP-009	SV-30702r2_rule	ECSC-1	Medium

Description
Non-DoD IM servers can be located anywhere in the world and if a DoD smartphone IM client connects to a non-DoD IM server, malware could be installed on the smartphone from the server or sensitive DoD data on the smartphone could be transferred to the server. In addition, if malware is installed on the smartphone, this could lead to hacker attacks on the DoD enclave the smartphone connects to.

STIG	Date
Smartphone Policy Security Technical Implementation Guide	2011-06-20

Details

Check Text ( C-31129r2_chk )
Interview the IAO or smartphone system administrator and determine if smartphone IM is used on site-managed smartphones. If yes, determine what server the smartphone IM system connects to. - The server should be managed by a DoD site. - The IM system must be compliant with the Instant Messaging STIG. Mark as a finding if: - the IM server the smartphone IM app connects to is not managed by a DoD site.

Check Text ( C-31129r2_chk )

Interview the IAO or smartphone system administrator and determine if smartphone IM is used on site-managed smartphones.

If yes, determine what server the smartphone IM system connects to.
- The server should be managed by a DoD site.
- The IM system must be compliant with the Instant Messaging STIG.

Mark as a finding if:
- the IM server the smartphone IM app connects to is not managed by a DoD site.

Fix Text (F-27600r1_fix)
Follow security requirements for Instant Messaging (IM) applications on smartphones.