Mobile device users must complete required training before being provided mobile devices or allowed access to DoD networks with a mobile device.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-24961	WIR-SPP-006-01	SV-30698r3_rule	PETN-1	Low

Description
Users are the first line of security controls for smartphone systems. They must be trained in using smartphone security controls or the system could be vulnerable to attack.

STIG	Date
Smartphone Policy Security Technical Implementation Guide	2012-10-09

Details

Check Text ( C-31120r7_chk )
Detailed Policy Requirements: This requirement applies to mobile operating system (OS) smartphones and tablets. All mobile device users must receive required training on the following topics before they are provided a mobile device or allowed access to DoD networks with a mobile device. Training is divided into two groups: Group A (general topics) and Group B (device specific topics). DISA’s Smartphones and Tablets security course satisfies the requirement for Group A training topics. The course is located at: http://iase.disa.mil/eta/smartphone_tablet_v1/launchpage.htm. Group A – General Topics a. Requirement that personally-owned PEDs are not used to transmit, receive, store, or process DoD information unless approved by the DAA and the owner signs forfeiture agreement in case of a security incident. b. Procedures for wireless device usage in and around classified processing areas. c. Requirement that PEDs with digital cameras (still and video) are not allowed in any SCIF or other areas where classified documents or information is stored, transmitted, or processed. d. Procedures for a data spill. e. Requirement that wireless email devices and systems are not used to send, receive, store, or process classified messages (does not apply to the SME PED). f. Requirement that smartphone devices and systems will not be connected to classified DoD networks or information systems. g. Requirement that a user immediately notify appropriate site contacts (i.e., IAO, smartphone management server administrator, supervisor, etc.) when his/her smartphone has been lost or stolen. h. Secure Bluetooth Smart Card Reader (SCR) usage: --Secure pairing procedures. --Perform secure pairing immediately after the SCR is reset. --Accept only Bluetooth connection requests from devices they control. --Monitor Bluetooth connection requests and activity in order to detect possible attacks and unauthorized activity. i. Procedures on how to sign and encrypt email. j. If Short Message Service (SMS) and/or Multi-media Messaging Service (MMS) are used, IA awareness training material should include SMS/MMS security issues. k. Requirement that Over-The-Air (OTA) wireless software updates should only come from DoD approved sources. l. When smartphone Wi-Fi Service is used, the following training will be completed: --Procedures for setting up a secure Wi-Fi connection and verifying the active connection is to a known access point. --Approved connection options (i.e., enterprise, home, etc.). --Requirements for home Wi-Fi connections. --The Wi-Fi radio will be disabled by the user whenever a Wi-Fi connection is not being used. --The Wi-Fi radio must never be enabled while the smartphone is connected to a PC. m. Do not discuss sensitive or classified information on non-secure (devices not FIPS 140-2 certified or NSA Type-1 certified for voice) cellular phones, cordless phones, and two-way radios used for voice communications. n. Do not connect PDAs, smartphones, and tablets to any workstation that stores, processes, or transmits classified data. (Exception: SME PED) o. The installation of user owned applications, including geo-location aware applications, on the mobile device will be based on the Command’s Mobile Device Personal Use Policy. p. The use of the mobile OS device to view and/or download personal email will be based the Command’s Mobile Device Personal Use Policy. q. The download of user owned data (music files, picture files, etc.) on the mobile device will be based the Command’s Mobile Device Personal Use Policy. r. The use of the mobile device to connect to user social media web accounts will be based the Command’s Mobile Device Personal Use Policy. s. When the Bluetooth radio is authorized for use with an approved smartcard reader or handsfree headset, the user will disable the Bluetooth radio whenever a Bluetooth connection is not being used. t. All radios on the mobile device (Wi-Fi, Bluetooth) must be turned off when not needed. u. Procedure on how to disable Location Services on the device. Location Services must be disabled for all applications or enabled only for applications approved by the DAA for location based services. Group B – Device Specific Topics Additional BlackBerry requirements: a. If the use of the BlackBerry Keeper is approved by the DAA, users are trained on password configuration and change requirements. --Passwords must be changed at least every 90 days. b. When SCR is used with a PC, users with PC administrative rights will not disable the RIM Bluetooth Lockdown tool on the PC. c. When using an approved Bluetooth headset or handsfree device the following procedures will be followed: -The user will pair only an approved device to the BlackBerry handheld. -If the user receives a request for Bluetooth pairing on their BlackBerry handheld from a Bluetooth device other than their smart card reader (CAC reader) or headset, the request will not be accepted by the user. -Pairing of a Bluetooth headset with the BlackBerry handheld will be completed in a non-public area whenever possible. Additional iOS device (iPhone and iPad) requirements: a. Procedure on how to disable the device Bluetooth radio when not being used. b. Procedure on how to disable the device Wi-Fi radio when not being used. c. Procedure to disable "Ask to Join Networks" Wi-Fi feature. This feature must be disabled at all times. d. iMessage should be considered an unsecure messaging application, similar to cellular SMS. Sensitive information should not be sent via iMessage. e. Procedure for not allowing applications access to PIM date (calendar, address book, etc.) when prompted during application install. The only allowed exception is for the secure email application (for example, the Good application). Additional Android requirements: a. Procedure on how to disable the device Bluetooth radio when not being used. b. Procedure on how to disable the device Wi-Fi radio when not being used. Additional training requirements for mobile device not authorized to connect to a DoD network or store/process sensitive DoD information (Non-Enterprise activated). a. Mobile Device (Non-Enterprise Activated) must not be connected to a DoD wired or wireless network. Allowed exception: the device can be connected to a DoD managed Internet-Gateway-only connected Wi-Fi access point (AP). b. Mobile Device (Non-Enterprise Activated) must not have sensitive or classified data stored or processed on the device. c. Mobile Device (Non-Enterprise Activated) must not be used to connect to a DoD email system. d. The user will read and be familiar with the local site and/or Command must publish a Personal Use Policy for site/Command managed or owned mobile devices (smartphones and tablets). Additional BlackBerry Playbook Tablet requirements: When using BlackBerry Bridge, the user will not attach files saved on the Playbook to email messages sent on the BlackBerry smartphone. Note: Listing training requirements in the User Agreement is an acceptable procedure for informing/training users on many of the required training topics. Check Procedures: - Review site smartphone training material to see if it contains the required content. Note: Some training content may be listed in the User Agreement signed by the user. - Verify site training records show that smartphone users received required training and training occurred before the user was issued a smartphone or tablet. Check training records for approximately five users, picked at random. Mark as a finding if training material does not contain required content.

Check Text ( C-31120r7_chk )

Detailed Policy Requirements:
This requirement applies to mobile operating system (OS) smartphones and tablets.

All mobile device users must receive required training on the following topics before they are provided a mobile device or allowed access to DoD networks with a mobile device. Training is divided into two groups: Group A (general topics) and Group B (device specific topics). DISA’s Smartphones and Tablets security course satisfies the requirement for Group A training topics. The course is located at: http://iase.disa.mil/eta/smartphone_tablet_v1/launchpage.htm.

Group A – General Topics

a. Requirement that personally-owned PEDs are not used to transmit, receive, store, or process DoD information unless approved by the DAA and the owner signs forfeiture agreement in case of a security incident.

b. Procedures for wireless device usage in and around classified processing areas.

c. Requirement that PEDs with digital cameras (still and video) are not allowed in any SCIF or other areas where classified documents or information is stored, transmitted, or processed.

d. Procedures for a data spill.

e. Requirement that wireless email devices and systems are not used to send, receive, store, or process classified messages (does not apply to the SME PED).

f. Requirement that smartphone devices and systems will not be connected to classified DoD networks or information systems.

g. Requirement that a user immediately notify appropriate site contacts (i.e., IAO, smartphone management server administrator, supervisor, etc.) when his/her smartphone has been lost or stolen.

h. Secure Bluetooth Smart Card Reader (SCR) usage:
--Secure pairing procedures.
--Perform secure pairing immediately after the SCR is reset.
--Accept only Bluetooth connection requests from devices they control.
--Monitor Bluetooth connection requests and activity in order to detect possible attacks and unauthorized activity.

i. Procedures on how to sign and encrypt email.

j. If Short Message Service (SMS) and/or Multi-media Messaging Service (MMS) are used, IA awareness training material should include SMS/MMS security issues.

k. Requirement that Over-The-Air (OTA) wireless software updates should only come from DoD approved sources.

l. When smartphone Wi-Fi Service is used, the following training will be completed:
--Procedures for setting up a secure Wi-Fi connection and verifying the active connection is to a known access point.
--Approved connection options (i.e., enterprise, home, etc.).
--Requirements for home Wi-Fi connections.
--The Wi-Fi radio will be disabled by the user whenever a Wi-Fi connection is not being used.
--The Wi-Fi radio must never be enabled while the smartphone is connected to a PC.

m. Do not discuss sensitive or classified information on non-secure (devices not FIPS 140-2 certified or NSA Type-1 certified for voice) cellular phones, cordless phones, and two-way radios used for voice communications.

n. Do not connect PDAs, smartphones, and tablets to any workstation that stores, processes, or transmits classified data. (Exception: SME PED)

o. The installation of user owned applications, including geo-location aware applications, on the mobile device will be based on the Command’s Mobile Device Personal Use Policy.

p. The use of the mobile OS device to view and/or download personal email will be based the Command’s Mobile Device Personal Use Policy.

q. The download of user owned data (music files, picture files, etc.) on the mobile device will be based the Command’s Mobile Device Personal Use Policy.

r. The use of the mobile device to connect to user social media web accounts will be based the Command’s Mobile Device Personal Use Policy.

s. When the Bluetooth radio is authorized for use with an approved smartcard reader or handsfree headset, the user will disable the Bluetooth radio whenever a Bluetooth connection is not being used.

t. All radios on the mobile device (Wi-Fi, Bluetooth) must be turned off when not needed.

u. Procedure on how to disable Location Services on the device. Location Services must be disabled for all applications or enabled only for applications approved by the DAA for location based services.

Group B – Device Specific Topics

Additional BlackBerry requirements:
a. If the use of the BlackBerry Keeper is approved by the DAA, users are trained on password configuration and change requirements.
--Passwords must be changed at least every 90 days.

b. When SCR is used with a PC, users with PC administrative rights will not disable the RIM Bluetooth Lockdown tool on the PC.

c. When using an approved Bluetooth headset or handsfree device the following procedures will be followed:
-The user will pair only an approved device to the BlackBerry handheld.
-If the user receives a request for Bluetooth pairing on their BlackBerry handheld from a Bluetooth device other than their smart card reader (CAC reader) or headset, the request will not be accepted by the user.
-Pairing of a Bluetooth headset with the BlackBerry handheld will be completed in a non-public area whenever possible.

Additional iOS device (iPhone and iPad) requirements:
a. Procedure on how to disable the device Bluetooth radio when not being used.

b. Procedure on how to disable the device Wi-Fi radio when not being used.

c. Procedure to disable "Ask to Join Networks" Wi-Fi feature. This feature must be disabled at all times.

d. iMessage should be considered an unsecure messaging application, similar to cellular SMS. Sensitive information should not be sent via iMessage.

e. Procedure for not allowing applications access to PIM date (calendar, address book, etc.) when prompted during application install. The only allowed exception is for the secure email application (for example, the Good application).

Additional Android requirements:
a. Procedure on how to disable the device Bluetooth radio when not being used.

b. Procedure on how to disable the device Wi-Fi radio when not being used.

Additional training requirements for mobile device not authorized to connect to a DoD network or store/process sensitive DoD information (Non-Enterprise activated).
a. Mobile Device (Non-Enterprise Activated) must not be connected to a DoD wired or wireless network. Allowed exception: the device can be connected to a DoD managed Internet-Gateway-only connected Wi-Fi access point (AP).

b. Mobile Device (Non-Enterprise Activated) must not have sensitive or classified data stored or processed on the device.

c. Mobile Device (Non-Enterprise Activated) must not be used to connect to a DoD email system.

d. The user will read and be familiar with the local site and/or Command must publish a Personal Use Policy for site/Command managed or owned mobile devices (smartphones and tablets).

Additional BlackBerry Playbook Tablet requirements:
When using BlackBerry Bridge, the user will not attach files saved on the Playbook to email messages sent on the BlackBerry smartphone.

Note: Listing training requirements in the User Agreement is an acceptable procedure for informing/training users on many of the required training topics.

Check Procedures:
- Review site smartphone training material to see if it contains the required content.
Note: Some training content may be listed in the User Agreement signed by the user.

- Verify site training records show that smartphone users received required training and training occurred before the user was issued a smartphone or tablet. Check training records for approximately five users, picked at random.

Mark as a finding if training material does not contain required content.

Fix Text (F-27591r2_fix)
All mobile device users will complete required training.