kriterion 0.0.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.gitignore +2 -0
- data/.ruby-version +1 -0
- data/.travis.yml +5 -0
- data/Dockerfile +18 -0
- data/Gemfile +12 -0
- data/Gemfile.lock +62 -0
- data/LICENSE.txt +21 -0
- data/README.md +58 -0
- data/Rakefile +6 -0
- data/bin/setup +8 -0
- data/bin/update_stigs.rb +42 -0
- data/criterion.gemspec +31 -0
- data/docker-compose.yml +14 -0
- data/exe/kriterion +16 -0
- data/lib/kriterion.rb +16 -0
- data/lib/kriterion/api.rb +27 -0
- data/lib/kriterion/backend.rb +13 -0
- data/lib/kriterion/backend/mongodb.rb +235 -0
- data/lib/kriterion/cli.rb +28 -0
- data/lib/kriterion/cli/api.rb +35 -0
- data/lib/kriterion/cli/worker.rb +35 -0
- data/lib/kriterion/event.rb +36 -0
- data/lib/kriterion/item.rb +42 -0
- data/lib/kriterion/logs.rb +14 -0
- data/lib/kriterion/metrics.rb +22 -0
- data/lib/kriterion/object.rb +50 -0
- data/lib/kriterion/report.rb +69 -0
- data/lib/kriterion/resource.rb +60 -0
- data/lib/kriterion/section.rb +32 -0
- data/lib/kriterion/standard.rb +65 -0
- data/lib/kriterion/version.rb +3 -0
- data/lib/kriterion/worker.rb +280 -0
- data/standards/cis_red_hat_enterprise_linux_7.json +34 -0
- data/standards/stig_a10_networks_adc_alg.json +209 -0
- data/standards/stig_a10_networks_adc_ndm.json +233 -0
- data/standards/stig_active_directory_domain.json +257 -0
- data/standards/stig_active_directory_forest.json +41 -0
- data/standards/stig_active_directory_service_2003.json +173 -0
- data/standards/stig_active_directory_service_2008.json +167 -0
- data/standards/stig_adobe_acrobat_pro_xi.json +167 -0
- data/standards/stig_adobe_acrobat_reader_dc_classic_track.json +179 -0
- data/standards/stig_adobe_acrobat_reader_dc_continuous_track.json +179 -0
- data/standards/stig_adobe_coldfusion_11.json +611 -0
- data/standards/stig_airwatch_mdm.json +185 -0
- data/standards/stig_aix_5.3.json +3095 -0
- data/standards/stig_aix_6.1.json +3047 -0
- data/standards/stig_akamai_ksd_service_impact_level_2_alg.json +209 -0
- data/standards/stig_akamai_ksd_service_impact_level_2_ndm.json +155 -0
- data/standards/stig_android_2.2_dell.json +311 -0
- data/standards/stig_apache_2.2_serverwindows.json +347 -0
- data/standards/stig_apache_2.2_sitewindows_security_implementation_guide.json +179 -0
- data/standards/stig_apache_server_2.0unix.json +341 -0
- data/standards/stig_apache_server_2.0windows.json +341 -0
- data/standards/stig_apache_server_2.2unix.json +347 -0
- data/standards/stig_apache_server_2.2windows.json +347 -0
- data/standards/stig_apache_site_2.0unix.json +185 -0
- data/standards/stig_apache_site_2.0windows.json +179 -0
- data/standards/stig_apache_site_2.2unix.json +185 -0
- data/standards/stig_apache_site_2.2windows.json +179 -0
- data/standards/stig_apple_ios6.json +341 -0
- data/standards/stig_apple_ios_10.json +245 -0
- data/standards/stig_apple_ios_11.json +269 -0
- data/standards/stig_apple_ios_4_good_mobility_suite_interim_security_configuration_guide_iscg.json +257 -0
- data/standards/stig_apple_ios_5.json +329 -0
- data/standards/stig_apple_ios_6.json +335 -0
- data/standards/stig_apple_ios_6_interim_security_configuration_guide_iscg.json +371 -0
- data/standards/stig_apple_ios_7.json +185 -0
- data/standards/stig_apple_ios_8_interim_security_configuration_guide.json +251 -0
- data/standards/stig_apple_ios_9_interim_security_configuration_guide.json +245 -0
- data/standards/stig_apple_os_x_10.10_yosemite_workstation.json +851 -0
- data/standards/stig_apple_os_x_10.11.json +725 -0
- data/standards/stig_apple_os_x_10.12.json +737 -0
- data/standards/stig_apple_os_x_10.8_mountain_lion_workstation.json +1241 -0
- data/standards/stig_apple_os_x_10.9_mavericks_workstation.json +809 -0
- data/standards/stig_application_layer_gateway_alg_security_requirements_guide_srg.json +911 -0
- data/standards/stig_application_layer_gateway_security_requirements_guide.json +911 -0
- data/standards/stig_application_security_and_development.json +1745 -0
- data/standards/stig_application_security_and_development_checklist.json +959 -0
- data/standards/stig_application_security_requirements_guide.json +1961 -0
- data/standards/stig_application_server_security_requirements_guide.json +791 -0
- data/standards/stig_arcgisserver_10.3.json +143 -0
- data/standards/stig_arista_mls_dcs-7000_series_l2s.json +53 -0
- data/standards/stig_arista_mls_dcs-7000_series_ndm.json +197 -0
- data/standards/stig_arista_mls_dcs-7000_series_rtr.json +143 -0
- data/standards/stig_bind_9.x.json +431 -0
- data/standards/stig_bind_dns.json +317 -0
- data/standards/stig_blackberry_10.2.x_os.json +179 -0
- data/standards/stig_blackberry_10_os.json +227 -0
- data/standards/stig_blackberry_bes_12.3.x_mdm.json +65 -0
- data/standards/stig_blackberry_bes_12.5.x_mdm.json +65 -0
- data/standards/stig_blackberry_device_service_6.2.json +425 -0
- data/standards/stig_blackberry_enterprise_mobility_server_2.x.json +149 -0
- data/standards/stig_blackberry_enterprise_server,_part_1.json +35 -0
- data/standards/stig_blackberry_enterprise_server,_part_2.json +155 -0
- data/standards/stig_blackberry_enterprise_server,_part_3.json +647 -0
- data/standards/stig_blackberry_enterprise_server_version_5.x,_part_1.json +35 -0
- data/standards/stig_blackberry_enterprise_server_version_5.x,_part_2.json +155 -0
- data/standards/stig_blackberry_enterprise_server_version_5.x,_part_3.json +653 -0
- data/standards/stig_blackberry_enterprise_service_v10.1.x_blackberry_device_service.json +317 -0
- data/standards/stig_blackberry_enterprise_service_v10.2.x_blackberry_device_service.json +263 -0
- data/standards/stig_blackberry_handheld_device.json +125 -0
- data/standards/stig_blackberry_os_10.3.x.json +257 -0
- data/standards/stig_blackberry_os_7.x.json +107 -0
- data/standards/stig_blackberry_os_7.x.x.json +101 -0
- data/standards/stig_blackberry_os_version_5-7.json +107 -0
- data/standards/stig_blackberry_playbook.json +65 -0
- data/standards/stig_blackberry_playbook_os_nea_mode.json +65 -0
- data/standards/stig_blackberry_playbook_os_v2.1.json +197 -0
- data/standards/stig_blackberry_uem_12.7.json +59 -0
- data/standards/stig_bluetoothzigbee.json +35 -0
- data/standards/stig_ca_api_gateway_alg.json +497 -0
- data/standards/stig_cisco_css_dns.json +71 -0
- data/standards/stig_cisco_ios_xe_release_3_ndm.json +395 -0
- data/standards/stig_cisco_ios_xe_release_3_rtr.json +149 -0
- data/standards/stig_cmd_management_server_policy.json +53 -0
- data/standards/stig_commercial_mobile_device_cmd_policy.json +83 -0
- data/standards/stig_csfc_campus_wlan_policy_security_implementation_guide.json +95 -0
- data/standards/stig_database_security_requirements_guide.json +767 -0
- data/standards/stig_dbn-6300_idps.json +107 -0
- data/standards/stig_dbn-6300_ndm.json +359 -0
- data/standards/stig_defense_switched_network.json +683 -0
- data/standards/stig_defense_switched_network_dsn.json +653 -0
- data/standards/stig_desktop_applications_general.json +41 -0
- data/standards/stig_dns_policy.json +155 -0
- data/standards/stig_domain_name_system_dns_security_requirements_guide.json +599 -0
- data/standards/stig_draft_aix.json +3503 -0
- data/standards/stig_edb_postgres_advanced_server.json +665 -0
- data/standards/stig_email_services_policy.json +137 -0
- data/standards/stig_exchange_2010_client_access_server.json +179 -0
- data/standards/stig_exchange_2010_edge_transport_server.json +389 -0
- data/standards/stig_exchange_2010_hub_transport_server.json +269 -0
- data/standards/stig_exchange_2010_mailbox_server.json +209 -0
- data/standards/stig_f5_big-ip_access_policy_manager_11.x.json +149 -0
- data/standards/stig_f5_big-ip_advanced_firewall_manager_11.x.json +41 -0
- data/standards/stig_f5_big-ip_application_security_manager_11.x.json +89 -0
- data/standards/stig_f5_big-ip_device_management_11.x.json +467 -0
- data/standards/stig_f5_big-ip_local_traffic_manager_11.x.json +407 -0
- data/standards/stig_final_draft_general_wireless_policy.json +71 -0
- data/standards/stig_firewall.json +449 -0
- data/standards/stig_firewall_-_cisco.json +449 -0
- data/standards/stig_firewall_security_requirements_guide.json +257 -0
- data/standards/stig_forescout_counteract_alg.json +83 -0
- data/standards/stig_forescout_counteract_ndm.json +239 -0
- data/standards/stig_free_space_optics_device.json +143 -0
- data/standards/stig_general_mobile_device_policy_non-enterprise_activated.json +113 -0
- data/standards/stig_general_mobile_device_technical_non-enterprise_activated.json +59 -0
- data/standards/stig_general_purpose_operating_system_srg.json +1199 -0
- data/standards/stig_general_wireless_policy.json +71 -0
- data/standards/stig_good_mobility_suite_server_android_os.json +203 -0
- data/standards/stig_good_mobility_suite_server_apple_ios_4_interim_security_configuration_guide_iscg.json +209 -0
- data/standards/stig_good_mobility_suite_server_windows_phone_6.5.json +449 -0
- data/standards/stig_goodenterprise_8.x.json +401 -0
- data/standards/stig_google_chrome_browser.json +209 -0
- data/standards/stig_google_chrome_current_windows.json +215 -0
- data/standards/stig_google_chrome_draft.json +281 -0
- data/standards/stig_google_chrome_v23_windows.json +275 -0
- data/standards/stig_google_chrome_v24_windows.json +263 -0
- data/standards/stig_google_chrome_v24_windows_benchmark.json +227 -0
- data/standards/stig_google_search_appliance.json +209 -0
- data/standards/stig_harris_secnet_11_54.json +89 -0
- data/standards/stig_hp-ux_11.23.json +3215 -0
- data/standards/stig_hp-ux_11.31.json +3155 -0
- data/standards/stig_hp-ux_smse.json +431 -0
- data/standards/stig_hpe_3par_storeserv_3.2.x.json +131 -0
- data/standards/stig_ibm_datapower_alg.json +401 -0
- data/standards/stig_ibm_datapower_network_device_management.json +395 -0
- data/standards/stig_ibm_db2_v10.5_luw.json +575 -0
- data/standards/stig_ibm_hardware_management_console_hmc.json +221 -0
- data/standards/stig_ibm_hardware_management_console_hmc_policies.json +35 -0
- data/standards/stig_ibm_maas360_v2.3.x_mdm.json +59 -0
- data/standards/stig_ibm_zvm_using_ca_vm:secure.json +473 -0
- data/standards/stig_idps_security_requirements_guide_srg.json +1865 -0
- data/standards/stig_idsips.json +257 -0
- data/standards/stig_iis6_server.json +221 -0
- data/standards/stig_iis6_site.json +263 -0
- data/standards/stig_iis_7.0_web_server.json +155 -0
- data/standards/stig_iis_7.0_web_site.json +299 -0
- data/standards/stig_iis_8.5_server.json +293 -0
- data/standards/stig_iis_8.5_site.json +347 -0
- data/standards/stig_infoblox_7.x_dns.json +419 -0
- data/standards/stig_infrastructure_l3_switch.json +599 -0
- data/standards/stig_infrastructure_l3_switch_-_cisco.json +659 -0
- data/standards/stig_infrastructure_l3_switch_secure_technical_implementation_guide_-_cisco.json +659 -0
- data/standards/stig_infrastructure_router.json +479 -0
- data/standards/stig_infrastructure_router_-_cisco.json +539 -0
- data/standards/stig_infrastructure_router_-_juniper.json +485 -0
- data/standards/stig_infrastructure_router__cisco.json +539 -0
- data/standards/stig_infrastructure_router__juniper.json +485 -0
- data/standards/stig_internet_explorer_8.json +821 -0
- data/standards/stig_internet_explorer_9.json +815 -0
- data/standards/stig_intrusion_detection_and_prevention_systems_idps_security_requirements_guide.json +371 -0
- data/standards/stig_ipsec_vpn_gateway.json +521 -0
- data/standards/stig_java_runtime_environment_jre_6_unix.json +65 -0
- data/standards/stig_java_runtime_environment_jre_6_win7.json +65 -0
- data/standards/stig_java_runtime_environment_jre_6_windows_xp.json +77 -0
- data/standards/stig_java_runtime_environment_jre_6_winxp.json +65 -0
- data/standards/stig_java_runtime_environment_jre_7_unix.json +65 -0
- data/standards/stig_java_runtime_environment_jre_7_win7.json +65 -0
- data/standards/stig_java_runtime_environment_jre_7_winxp.json +65 -0
- data/standards/stig_java_runtime_environment_jre_version_6_unix.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_6_windows_7.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_6_windows_xp.json +65 -0
- data/standards/stig_java_runtime_environment_jre_version_7_unix.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_7_windows_7.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_7_winxp.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_8_unix.json +107 -0
- data/standards/stig_java_runtime_environment_jre_version_8_windows.json +107 -0
- data/standards/stig_jboss_eap_6.3.json +413 -0
- data/standards/stig_juniper_srx_sg_alg.json +155 -0
- data/standards/stig_juniper_srx_sg_idps.json +179 -0
- data/standards/stig_juniper_srx_sg_ndm.json +443 -0
- data/standards/stig_juniper_srx_sg_vpn.json +185 -0
- data/standards/stig_keyboard_video_and_mouse_switch.json +269 -0
- data/standards/stig_l3_kov-26_talon_wireless_role.json +77 -0
- data/standards/stig_layer_2_switch.json +347 -0
- data/standards/stig_layer_2_switch_-_cisco.json +365 -0
- data/standards/stig_lg_android_5.x_interim_security_configuration_guide.json +245 -0
- data/standards/stig_lg_android_6.x.json +281 -0
- data/standards/stig_mac_osx_10.6_workstation.json +1319 -0
- data/standards/stig_mac_osx_10.6_workstation_draft.json +1319 -0
- data/standards/stig_mainframe_product_security_requirements_guide.json +1115 -0
- data/standards/stig_mcafee_application_control_7.x.json +203 -0
- data/standards/stig_mcafee_move_2.63.6.1_multi-platform_client.json +149 -0
- data/standards/stig_mcafee_move_2.63.6.1_multi-platform_oss.json +101 -0
- data/standards/stig_mcafee_move_2.6_multi-platform_client.json +149 -0
- data/standards/stig_mcafee_move_2.6_multi-platform_oss.json +101 -0
- data/standards/stig_mcafee_move_3.6.1_multi-platform_client.json +149 -0
- data/standards/stig_mcafee_move_3.6.1_multi-platform_oss.json +101 -0
- data/standards/stig_mcafee_move_agentless_3.03.6.1_security_virtual_appliance.json +167 -0
- data/standards/stig_mcafee_move_agentless_3.0_security_virtual_appliance.json +167 -0
- data/standards/stig_mcafee_move_agentless_3.0_vsel_1.9sva.json +203 -0
- data/standards/stig_mcafee_move_agentless_3.6.1_security_virtual_appliance.json +167 -0
- data/standards/stig_mcafee_move_av_agentless_4.5.json +155 -0
- data/standards/stig_mcafee_move_av_multi-platform_4.5.json +215 -0
- data/standards/stig_mcafee_virusscan_8.8_local_client.json +533 -0
- data/standards/stig_mcafee_virusscan_8.8_managed_client.json +533 -0
- data/standards/stig_mcafee_vsel_1.92.0_local_client.json +245 -0
- data/standards/stig_mcafee_vsel_1.92.0_managed_client.json +239 -0
- data/standards/stig_mdm_server_policy.json +47 -0
- data/standards/stig_microsoft_access_2003.json +47 -0
- data/standards/stig_microsoft_access_2007.json +77 -0
- data/standards/stig_microsoft_access_2010.json +119 -0
- data/standards/stig_microsoft_access_2013.json +113 -0
- data/standards/stig_microsoft_access_2016.json +107 -0
- data/standards/stig_microsoft_dot_net_framework_4.0.json +101 -0
- data/standards/stig_microsoft_excel_2003.json +47 -0
- data/standards/stig_microsoft_excel_2007.json +155 -0
- data/standards/stig_microsoft_excel_2010.json +287 -0
- data/standards/stig_microsoft_excel_2013.json +293 -0
- data/standards/stig_microsoft_excel_2016.json +257 -0
- data/standards/stig_microsoft_exchange_2010_client_access_server_role.json +71 -0
- data/standards/stig_microsoft_exchange_2010_core_server.json +47 -0
- data/standards/stig_microsoft_exchange_2010_edge_transport_server_role.json +233 -0
- data/standards/stig_microsoft_exchange_2010_hub_transport_server_role.json +125 -0
- data/standards/stig_microsoft_exchange_2010_mailbox_server_role.json +107 -0
- data/standards/stig_microsoft_exchange_server_2003.json +647 -0
- data/standards/stig_microsoft_groove_2013.json +71 -0
- data/standards/stig_microsoft_ie_version_6.json +599 -0
- data/standards/stig_microsoft_ie_version_7.json +749 -0
- data/standards/stig_microsoft_infopath_2003.json +41 -0
- data/standards/stig_microsoft_infopath_2007.json +167 -0
- data/standards/stig_microsoft_infopath_2010.json +155 -0
- data/standards/stig_microsoft_infopath_2013.json +149 -0
- data/standards/stig_microsoft_internet_explorer_10.json +857 -0
- data/standards/stig_microsoft_internet_explorer_11.json +839 -0
- data/standards/stig_microsoft_internet_explorer_9.json +821 -0
- data/standards/stig_microsoft_lync_2013.json +29 -0
- data/standards/stig_microsoft_office_system_2007.json +221 -0
- data/standards/stig_microsoft_office_system_2010.json +233 -0
- data/standards/stig_microsoft_office_system_2013.json +293 -0
- data/standards/stig_microsoft_office_system_2016.json +131 -0
- data/standards/stig_microsoft_onedrivebusiness_2016.json +89 -0
- data/standards/stig_microsoft_onenote_2010.json +77 -0
- data/standards/stig_microsoft_onenote_2013.json +71 -0
- data/standards/stig_microsoft_onenote_2016.json +71 -0
- data/standards/stig_microsoft_outlook_2003.json +65 -0
- data/standards/stig_microsoft_outlook_2007.json +479 -0
- data/standards/stig_microsoft_outlook_2010.json +515 -0
- data/standards/stig_microsoft_outlook_2013.json +497 -0
- data/standards/stig_microsoft_outlook_2016.json +359 -0
- data/standards/stig_microsoft_powerpoint_2003.json +47 -0
- data/standards/stig_microsoft_powerpoint_2007.json +131 -0
- data/standards/stig_microsoft_powerpoint_2010.json +191 -0
- data/standards/stig_microsoft_powerpoint_2013.json +251 -0
- data/standards/stig_microsoft_powerpoint_2016.json +233 -0
- data/standards/stig_microsoft_project_2010.json +83 -0
- data/standards/stig_microsoft_project_2013.json +95 -0
- data/standards/stig_microsoft_project_2016.json +95 -0
- data/standards/stig_microsoft_publisher_2010.json +107 -0
- data/standards/stig_microsoft_publisher_2013.json +101 -0
- data/standards/stig_microsoft_publisher_2016.json +101 -0
- data/standards/stig_microsoft_sharepoint_designer_2013.json +71 -0
- data/standards/stig_microsoft_skypebusiness_2016.json +29 -0
- data/standards/stig_microsoft_sql_server_2005_database.json +167 -0
- data/standards/stig_microsoft_sql_server_2005_instance.json +1001 -0
- data/standards/stig_microsoft_sql_server_2012_database.json +179 -0
- data/standards/stig_microsoft_sql_server_2012_database_instance.json +929 -0
- data/standards/stig_microsoft_visio_2013.json +89 -0
- data/standards/stig_microsoft_visio_2016.json +89 -0
- data/standards/stig_microsoft_windows_10_mobile.json +215 -0
- data/standards/stig_microsoft_windows_2008_server_domain_name_system.json +269 -0
- data/standards/stig_microsoft_windows_2012_server_domain_name_system.json +551 -0
- data/standards/stig_microsoft_windows_phone_8.1.json +161 -0
- data/standards/stig_microsoft_windows_server_2012_domain_controller.json +2633 -0
- data/standards/stig_microsoft_windows_server_2012_member_server.json +2411 -0
- data/standards/stig_microsoft_word_2003.json +47 -0
- data/standards/stig_microsoft_word_2007.json +119 -0
- data/standards/stig_microsoft_word_2010.json +221 -0
- data/standards/stig_microsoft_word_2013.json +221 -0
- data/standards/stig_microsoft_word_2016.json +215 -0
- data/standards/stig_mobile_application_management_mam_server.json +95 -0
- data/standards/stig_mobile_application_security_requirements_guide.json +233 -0
- data/standards/stig_mobile_device_integrity_scanning_mdis_server.json +119 -0
- data/standards/stig_mobile_device_management_mdm_server.json +125 -0
- data/standards/stig_mobile_device_manager_security_requirements_guide.json +2555 -0
- data/standards/stig_mobile_email_management_mem_server.json +197 -0
- data/standards/stig_mobile_operating_system_security_requirements_guide.json +1943 -0
- data/standards/stig_mobile_policy.json +35 -0
- data/standards/stig_mobile_policy_security_requirements_guide.json +437 -0
- data/standards/stig_mobileiron_core_v9.x_mdm.json +89 -0
- data/standards/stig_mobility_policy.json +65 -0
- data/standards/stig_mozilla_firefox.json +161 -0
- data/standards/stig_ms_exchange_2013_client_access_server.json +209 -0
- data/standards/stig_ms_exchange_2013_edge_transport_server.json +443 -0
- data/standards/stig_ms_exchange_2013_mailbox_server.json +437 -0
- data/standards/stig_ms_sharepoint_2010.json +269 -0
- data/standards/stig_ms_sharepoint_2013.json +245 -0
- data/standards/stig_ms_sharepoint_designer_2013.json +71 -0
- data/standards/stig_ms_sql_server_2014_database.json +263 -0
- data/standards/stig_ms_sql_server_2014_instance.json +575 -0
- data/standards/stig_ms_sql_server_2016_database.json +185 -0
- data/standards/stig_ms_sql_server_2016_instance.json +731 -0
- data/standards/stig_ms_windows_defender_antivirus.json +257 -0
- data/standards/stig_multifunction_device_and_network_printers.json +131 -0
- data/standards/stig_network_device_management_security_requirements_guide.json +863 -0
- data/standards/stig_network_devices.json +389 -0
- data/standards/stig_network_infrastructure_policy.json +455 -0
- data/standards/stig_network_security_requirements_guide.json +1961 -0
- data/standards/stig_operating_system_security_requirements_guide.json +1961 -0
- data/standards/stig_oracle_10_database_installation.json +527 -0
- data/standards/stig_oracle_10_database_instance.json +569 -0
- data/standards/stig_oracle_11_database_installation.json +527 -0
- data/standards/stig_oracle_11_database_instance.json +551 -0
- data/standards/stig_oracle_database_10g_installation.json +527 -0
- data/standards/stig_oracle_database_10g_instance.json +581 -0
- data/standards/stig_oracle_database_11.2g.json +1229 -0
- data/standards/stig_oracle_database_11g_installation.json +527 -0
- data/standards/stig_oracle_database_11g_instance.json +575 -0
- data/standards/stig_oracle_database_12c.json +1217 -0
- data/standards/stig_oracle_http_server_12.1.3.json +1703 -0
- data/standards/stig_oracle_linux_5.json +3431 -0
- data/standards/stig_oracle_linux_6.json +1583 -0
- data/standards/stig_oracle_weblogic_server_12c.json +443 -0
- data/standards/stig_palo_alto_networks_alg.json +311 -0
- data/standards/stig_palo_alto_networks_idps.json +185 -0
- data/standards/stig_palo_alto_networks_ndm.json +251 -0
- data/standards/stig_pda.json +83 -0
- data/standards/stig_pdasmartphone.json +95 -0
- data/standards/stig_perimeter_l3_switch.json +923 -0
- data/standards/stig_perimeter_l3_switch_-_cisco.json +1001 -0
- data/standards/stig_perimeter_router.json +803 -0
- data/standards/stig_perimeter_router_cisco.json +881 -0
- data/standards/stig_perimeter_router_juniper.json +803 -0
- data/standards/stig_postgresql_9.x.json +677 -0
- data/standards/stig_red_hat_enterprise_linux_5.json +3437 -0
- data/standards/stig_red_hat_enterprise_linux_6.json +1565 -0
- data/standards/stig_red_hat_enterprise_linux_7.json +1451 -0
- data/standards/stig_remote_access_policy.json +317 -0
- data/standards/stig_removable_storage_and_external_connection_technologies.json +143 -0
- data/standards/stig_removable_storage_and_external_connections.json +137 -0
- data/standards/stig_rfid_scanner.json +35 -0
- data/standards/stig_rfid_workstation.json +23 -0
- data/standards/stig_riverbed_steelhead_cx_v8_alg.json +83 -0
- data/standards/stig_riverbed_steelhead_cx_v8_ndm.json +371 -0
- data/standards/stig_router_security_requirements_guide.json +575 -0
- data/standards/stig_samsung_android_os_5_with_knox_2.0.json +365 -0
- data/standards/stig_samsung_android_os_6_with_knox_2.x.json +377 -0
- data/standards/stig_samsung_android_os_7_with_knox_2.x.json +443 -0
- data/standards/stig_samsung_android_with_knox_1.x.json +293 -0
- data/standards/stig_samsung_android_with_knox_2.x.json +371 -0
- data/standards/stig_samsung_knox_android_1.0.json +167 -0
- data/standards/stig_sharepoint_2010.json +269 -0
- data/standards/stig_sharepoint_2013.json +245 -0
- data/standards/stig_smartphone_policy.json +131 -0
- data/standards/stig_solaris_10_sparc.json +3029 -0
- data/standards/stig_solaris_10_x86.json +3065 -0
- data/standards/stig_solaris_11_sparc.json +1427 -0
- data/standards/stig_solaris_11_x86.json +1421 -0
- data/standards/stig_solaris_9_sparc.json +2915 -0
- data/standards/stig_solaris_9_x86.json +2915 -0
- data/standards/stig_sun_ray_4.json +185 -0
- data/standards/stig_sun_ray_4_policy.json +77 -0
- data/standards/stig_suse_linux_enterprise_server_v11system_z.json +3311 -0
- data/standards/stig_symantec_endpoint_protection_12.1_local_client_antivirus.json +689 -0
- data/standards/stig_symantec_endpoint_protection_12.1_managed_client_antivirus.json +695 -0
- data/standards/stig_tanium_6.5.json +461 -0
- data/standards/stig_tanium_7.0.json +803 -0
- data/standards/stig_test_and_development_zone_a.json +167 -0
- data/standards/stig_test_and_development_zone_b.json +179 -0
- data/standards/stig_test_and_development_zone_c.json +143 -0
- data/standards/stig_test_and_development_zone_d.json +143 -0
- data/standards/stig_traditional_security.json +917 -0
- data/standards/stig_unix_srg.json +3287 -0
- data/standards/stig_video_services_policy.json +497 -0
- data/standards/stig_video_teleconference.json +47 -0
- data/standards/stig_video_teleconference_vtc.json +12 -0
- data/standards/stig_vmware_esx_3_policy.json +155 -0
- data/standards/stig_vmware_esx_3_server.json +3791 -0
- data/standards/stig_vmware_esx_3_virtual_center.json +257 -0
- data/standards/stig_vmware_esx_3_virtual_machine.json +53 -0
- data/standards/stig_vmware_esxi_server_5.0.json +809 -0
- data/standards/stig_vmware_esxi_v5.json +5177 -0
- data/standards/stig_vmware_esxi_version_5_virtual_machine.json +317 -0
- data/standards/stig_vmware_nsx_distributed_firewall.json +83 -0
- data/standards/stig_vmware_nsx_distributed_logical_router.json +35 -0
- data/standards/stig_vmware_nsx_manager.json +191 -0
- data/standards/stig_vmware_vcenter_server.json +179 -0
- data/standards/stig_vmware_vcenter_server_version_5.json +149 -0
- data/standards/stig_vmware_vsphere_esxi_6.0.json +659 -0
- data/standards/stig_vmware_vsphere_vcenter_server_version_6.json +311 -0
- data/standards/stig_vmware_vsphere_virtual_machine_version_6.json +269 -0
- data/standards/stig_voice_and_video_over_internet_protocol_vvoip_policy.json +407 -0
- data/standards/stig_voice_video_endpoint_security_requirements_guide.json +395 -0
- data/standards/stig_voice_video_services_policy.json +671 -0
- data/standards/stig_voice_video_session_management_security_requirements_guide.json +329 -0
- data/standards/stig_voicevideo_over_internet_protocol.json +419 -0
- data/standards/stig_voicevideo_over_internet_protocol_vvoip.json +263 -0
- data/standards/stig_voicevideo_services_policy.json +569 -0
- data/standards/stig_web_policy.json +95 -0
- data/standards/stig_web_server.json +317 -0
- data/standards/stig_web_server_security_requirements_guide.json +587 -0
- data/standards/stig_win2k3_audit.json +761 -0
- data/standards/stig_win2k8_audit.json +1085 -0
- data/standards/stig_win2k8_r2_audit.json +1637 -0
- data/standards/stig_win7_audit.json +1613 -0
- data/standards/stig_windows_10.json +1691 -0
- data/standards/stig_windows_2003_domain_controller.json +893 -0
- data/standards/stig_windows_2003_member_server.json +845 -0
- data/standards/stig_windows_2008_domain_controller.json +1475 -0
- data/standards/stig_windows_2008_member_server.json +1301 -0
- data/standards/stig_windows_7.json +1781 -0
- data/standards/stig_windows_8.json +2399 -0
- data/standards/stig_windows_88.1.json +2273 -0
- data/standards/stig_windows_8_8.1.json +2297 -0
- data/standards/stig_windows_defender_antivirus.json +239 -0
- data/standards/stig_windows_dns.json +185 -0
- data/standards/stig_windows_firewall_with_advanced_security.json +137 -0
- data/standards/stig_windows_paw.json +155 -0
- data/standards/stig_windows_phone_6.5_with_good_mobility_suite.json +65 -0
- data/standards/stig_windows_server_2008_r2_domain_controller.json +1961 -0
- data/standards/stig_windows_server_2008_r2_member_server.json +1745 -0
- data/standards/stig_windows_server_20122012_r2_domain_controller.json +2255 -0
- data/standards/stig_windows_server_20122012_r2_member_server.json +2045 -0
- data/standards/stig_windows_server_2012_2012_r2_domain_controller.json +2279 -0
- data/standards/stig_windows_server_2012_2012_r2_member_server.json +2075 -0
- data/standards/stig_windows_server_2012_domain_controller.json +2471 -0
- data/standards/stig_windows_server_2012_member_server.json +2249 -0
- data/standards/stig_windows_server_2016.json +1661 -0
- data/standards/stig_windows_vista.json +1517 -0
- data/standards/stig_windows_xp.json +893 -0
- data/standards/stig_wireless_keyboard_and_mouse.json +23 -0
- data/standards/stig_wireless_management_server_policy.json +53 -0
- data/standards/stig_wireless_remote_access_policy_security_implementation_guide.json +29 -0
- data/standards/stig_wlan_access_point_enclave-niprnet_connected.json +227 -0
- data/standards/stig_wlan_access_point_internet_gateway_only_connection.json +209 -0
- data/standards/stig_wlan_access_point_policy.json +17 -0
- data/standards/stig_wlan_authentication_server.json +29 -0
- data/standards/stig_wlan_bridge.json +209 -0
- data/standards/stig_wlan_client.json +65 -0
- data/standards/stig_wlan_controller.json +215 -0
- data/standards/stig_wlan_ids_sensorserver.json +23 -0
- data/standards/stig_wman_access_point.json +263 -0
- data/standards/stig_wman_bridge.json +209 -0
- data/standards/stig_wman_subscriber.json +65 -0
- data/standards/stig_zos_acf2.json +1451 -0
- data/standards/stig_zos_bmc_control-dacf2.json +53 -0
- data/standards/stig_zos_bmc_control-dracf.json +59 -0
- data/standards/stig_zos_bmc_control-dtss.json +65 -0
- data/standards/stig_zos_bmc_control-macf2.json +59 -0
- data/standards/stig_zos_bmc_control-mracf.json +65 -0
- data/standards/stig_zos_bmc_control-mrestartacf2.json +23 -0
- data/standards/stig_zos_bmc_control-mrestartracf.json +23 -0
- data/standards/stig_zos_bmc_control-mrestarttss.json +23 -0
- data/standards/stig_zos_bmc_control-mtss.json +71 -0
- data/standards/stig_zos_bmc_control-oacf2.json +53 -0
- data/standards/stig_zos_bmc_control-oracf.json +59 -0
- data/standards/stig_zos_bmc_control-otss.json +65 -0
- data/standards/stig_zos_bmc_ioaacf2.json +53 -0
- data/standards/stig_zos_bmc_ioaracf.json +59 -0
- data/standards/stig_zos_bmc_ioatss.json +65 -0
- data/standards/stig_zos_bmc_mainviewzosacf2.json +47 -0
- data/standards/stig_zos_bmc_mainviewzosracf.json +53 -0
- data/standards/stig_zos_bmc_mainviewzostss.json +59 -0
- data/standards/stig_zos_ca_1_tape_managementacf2.json +65 -0
- data/standards/stig_zos_ca_1_tape_managementracf.json +77 -0
- data/standards/stig_zos_ca_1_tape_managementtss.json +77 -0
- data/standards/stig_zos_ca_auditoracf2.json +29 -0
- data/standards/stig_zos_ca_auditorracf.json +29 -0
- data/standards/stig_zos_ca_auditortss.json +29 -0
- data/standards/stig_zos_ca_common_servicesacf2.json +23 -0
- data/standards/stig_zos_ca_common_servicesracf.json +29 -0
- data/standards/stig_zos_ca_common_servicestss.json +29 -0
- data/standards/stig_zos_ca_micsacf2.json +23 -0
- data/standards/stig_zos_ca_micsracf.json +23 -0
- data/standards/stig_zos_ca_micstss.json +23 -0
- data/standards/stig_zos_ca_mimacf2.json +41 -0
- data/standards/stig_zos_ca_mimracf.json +47 -0
- data/standards/stig_zos_ca_mimtss.json +47 -0
- data/standards/stig_zos_ca_vtapeacf2.json +29 -0
- data/standards/stig_zos_ca_vtaperacf.json +35 -0
- data/standards/stig_zos_ca_vtapetss.json +35 -0
- data/standards/stig_zos_catalog_solutionsacf2.json +23 -0
- data/standards/stig_zos_catalog_solutionsracf.json +23 -0
- data/standards/stig_zos_catalog_solutionstss.json +23 -0
- data/standards/stig_zos_clsupersessionacf2.json +53 -0
- data/standards/stig_zos_clsupersessionracf.json +65 -0
- data/standards/stig_zos_clsupersessiontss.json +71 -0
- data/standards/stig_zos_compuware_abend-aidacf2.json +47 -0
- data/standards/stig_zos_compuware_abend-aidracf.json +53 -0
- data/standards/stig_zos_compuware_abend-aidtss.json +53 -0
- data/standards/stig_zos_cssmtpacf2.json +23 -0
- data/standards/stig_zos_cssmtpracf.json +29 -0
- data/standards/stig_zos_cssmtptss.json +29 -0
- data/standards/stig_zos_fdracf2.json +23 -0
- data/standards/stig_zos_fdrracf.json +23 -0
- data/standards/stig_zos_fdrtss.json +23 -0
- data/standards/stig_zos_hcdacf2.json +29 -0
- data/standards/stig_zos_hcdracf.json +29 -0
- data/standards/stig_zos_hcdtss.json +29 -0
- data/standards/stig_zos_ibm_cics_transaction_serveracf2.json +17 -0
- data/standards/stig_zos_ibm_cics_transaction_serverracf.json +17 -0
- data/standards/stig_zos_ibm_cics_transaction_servertss.json +17 -0
- data/standards/stig_zos_ibm_health_checkeracf2.json +23 -0
- data/standards/stig_zos_ibm_health_checkerracf.json +29 -0
- data/standards/stig_zos_ibm_health_checkertss.json +29 -0
- data/standards/stig_zos_ibm_system_display_and_search_facility_sdsfacf2.json +53 -0
- data/standards/stig_zos_ibm_system_display_and_search_facility_sdsfracf.json +59 -0
- data/standards/stig_zos_ibm_system_display_and_search_facility_sdsftss.json +53 -0
- data/standards/stig_zos_icsfacf2.json +29 -0
- data/standards/stig_zos_icsfracf.json +35 -0
- data/standards/stig_zos_icsftss.json +35 -0
- data/standards/stig_zos_netviewacf2.json +41 -0
- data/standards/stig_zos_netviewracf.json +47 -0
- data/standards/stig_zos_netviewtss.json +53 -0
- data/standards/stig_zos_quest_nc-passacf2.json +35 -0
- data/standards/stig_zos_quest_nc-passracf.json +41 -0
- data/standards/stig_zos_quest_nc-passtss.json +47 -0
- data/standards/stig_zos_racf.json +1415 -0
- data/standards/stig_zos_roscoeacf2.json +47 -0
- data/standards/stig_zos_roscoeracf.json +53 -0
- data/standards/stig_zos_roscoetss.json +59 -0
- data/standards/stig_zos_srrauditacf2.json +23 -0
- data/standards/stig_zos_srrauditracf.json +23 -0
- data/standards/stig_zos_srraudittss.json +23 -0
- data/standards/stig_zos_tadzacf2.json +29 -0
- data/standards/stig_zos_tadzracf.json +35 -0
- data/standards/stig_zos_tadztss.json +35 -0
- data/standards/stig_zos_tdmfacf2.json +23 -0
- data/standards/stig_zos_tdmfracf.json +23 -0
- data/standards/stig_zos_tdmftss.json +23 -0
- data/standards/stig_zos_tss.json +1523 -0
- data/standards/stig_zos_vssracf.json +29 -0
- metadata +691 -0
|
@@ -0,0 +1,149 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "stig_blackberry_enterprise_mobility_server_2.x",
|
|
3
|
+
"date": "2017-12-11",
|
|
4
|
+
"description": "This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.",
|
|
5
|
+
"title": "BlackBerry Enterprise Mobility Server 2.x Security Technical Implementation Guide",
|
|
6
|
+
"version": "1",
|
|
7
|
+
"item_syntax": "^\\w-\\d+$",
|
|
8
|
+
"section_separator": null,
|
|
9
|
+
"items": [
|
|
10
|
+
{
|
|
11
|
+
"id": "V-79003",
|
|
12
|
+
"title": "The BlackBerry Enterprise Mobility Server (BEMS) must protect log information from any type of unauthorized read access.",
|
|
13
|
+
"description": "If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to log records provides information an attacker could potentially use to his or her advantage.\n\nApplication servers contain admin interfaces that allow reading and manipulation of log records. Therefore, these interfaces should not allow unfettered access to those records. Application servers also write log data to log files which are stored on the OS, so appropriate file permissions must also be used to restrict access.\n\nLog information includes all information (e.g., log records, log settings, transaction logs, and log reports) needed to successfully log information system activity. Application servers must protect log information from unauthorized read access.",
|
|
14
|
+
"severity": "medium"
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"id": "V-79005",
|
|
18
|
+
"title": "The BlackBerry Enterprise Mobility Server (BEMS) must protect log information from unauthorized modification.",
|
|
19
|
+
"description": "If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to log records provides information an attacker could potentially use to his or her advantage.\n\nApplication servers contain admin interfaces that allow reading and manipulation of log records. Therefore, these interfaces should not allow unfettered access to those records. Application servers also write log data to log files which are stored on the OS, so appropriate file permissions must also be used to restrict access.\n\nLog information includes all information (e.g., log records, log settings, transaction logs and log reports) needed to successfully log information system activity. Application servers must protect log information from unauthorized modification.",
|
|
20
|
+
"severity": "medium"
|
|
21
|
+
},
|
|
22
|
+
{
|
|
23
|
+
"id": "V-79007",
|
|
24
|
+
"title": "The BlackBerry Enterprise Mobility Server (BEMS) must protect log information from unauthorized deletion.",
|
|
25
|
+
"description": "If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. \n\nApplication servers contain admin interfaces that allow reading and manipulation of log records. Therefore, these interfaces should not allow for unfettered access to those records. Application servers also write log data to log files which are stored on the OS, so appropriate file permissions must also be used to restrict access.\n\nLog information includes all information (e.g., log records, log settings, transaction logs, and log reports) needed to successfully log information system activity. Application servers must protect log information from unauthorized deletion.",
|
|
26
|
+
"severity": "medium"
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
"id": "V-79009",
|
|
30
|
+
"title": "The BlackBerry Enterprise Mobility Server (BEMS) platform must be protected by a DoD-approved firewall.",
|
|
31
|
+
"description": "Most information systems are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Unneeded services and processes provide additional threat vectors and avenues of attack to the information system. BEMS is a critical component of the mobility architecture and must be configured to enable only those ports, protocols, and services (PPS) necessary to support functionality. All others must be expressly disabled or removed. A DoD-approved firewall implements the required network restrictions. A host-based firewall is appropriate where BEMS runs on a standalone platform. Network firewalls or other architectures may be preferred where BEMS runs in a cloud or virtualized solution.",
|
|
32
|
+
"severity": "medium"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"id": "V-79011",
|
|
36
|
+
"title": "The firewall protecting the BlackBerry Enterprise Mobility Server (BEMS) must be configured to restrict all network traffic to and from all addresses with the exception of ports, protocols, and IP address ranges required to support BEMS functions.",
|
|
37
|
+
"description": "Most information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations. Since BEMS is a critical component of the mobility architecture and must be configured to enable only those ports, protocols, and services (PPS) necessary to support functionality, all others must be expressly disabled or removed. A firewall installed on BEMS provides a protection mechanism to ensure unwanted service requests do not reach BEMS and outbound traffic is limited to only BEMS functionality.",
|
|
38
|
+
"severity": "medium"
|
|
39
|
+
},
|
|
40
|
+
{
|
|
41
|
+
"id": "V-79013",
|
|
42
|
+
"title": "The firewall protecting the BlackBerry Enterprise Mobility Server (BEMS) must be configured so that only DoD-approved ports, protocols, and services are enabled. See the DoD Ports, Protocols, Services Management (PPSM) Category Assurance Levels (CAL) list for DoD-approved ports, protocols, and services.",
|
|
43
|
+
"description": "All ports, protocols, and services used on DoD networks must be approved and registered via the DoD PPSM process. This is to ensure that a risk assessment has been completed before a new port, protocol, or service is configured on a DoD network and has been approved by proper DoD authorities. Otherwise, the new port, protocol, or service could cause a vulnerability to the DoD network, which could be exploited by an adversary.",
|
|
44
|
+
"severity": "medium"
|
|
45
|
+
},
|
|
46
|
+
{
|
|
47
|
+
"id": "V-79015",
|
|
48
|
+
"title": "The BlackBerry Enterprise Mobility Server (BEMS) must protect the confidentiality and integrity of transmitted information through the use of an approved TLS version.",
|
|
49
|
+
"description": "Preventing the disclosure of transmitted information requires that the application server take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS).\n\nTransmission of data can take place between the application server and a large number of devices/applications external to the application server. Examples are a web client used by a user, a backend database, a log server, or other application servers in an application server cluster.\n\nIf data is transmitted unencrypted, the data then becomes vulnerable to disclosure. The disclosure may reveal user identifier/password combinations, website code revealing business logic, or other user personal information.\n\nFIPS 140-2 approved TLS versions include TLS V1.0 or greater.\n\nTLS must be enabled and non-FIPS-approved SSL versions must be disabled. NIST SP 800-52 specifies the preferred configurations for government systems.",
|
|
50
|
+
"severity": "medium"
|
|
51
|
+
},
|
|
52
|
+
{
|
|
53
|
+
"id": "V-79017",
|
|
54
|
+
"title": "The BlackBerry Enterprise Mobility Server (BEMS) must remove all export ciphers to protect the confidentiality and integrity of transmitted information.",
|
|
55
|
+
"description": "During the initial setup of a Transport Layer Security (TLS) connection to the application server, the client sends a list of supported cipher suites in order of preference. The application server will reply with the cipher suite it will use for communication from the client list. If an attacker can intercept the submission of cipher suites to the application server and place, as the preferred cipher suite, a weak export suite, the encryption used for the session becomes easy for the attacker to break, often within minutes to hours.",
|
|
56
|
+
"severity": "medium"
|
|
57
|
+
},
|
|
58
|
+
{
|
|
59
|
+
"id": "V-79019",
|
|
60
|
+
"title": "The BlackBerry Enterprise Mobility Server (BEMS) must be configured to have at least one user in the following Administrator roles: Server primary administrator, auditor.",
|
|
61
|
+
"description": "Having several administrative roles for the BEMS supports separation of duties. This allows administrator-level privileges to be granted granularly, such as giving application management privileges to one group and security policy privileges to another group. This helps prevent administrators from intentionally or inadvertently altering other settings and configurations they may not understand or approve of, which can weaken overall security and increase the risk of compromise.\n\n- Server primary administrator: Responsible for server installation, initial configuration, and maintenance functions. Responsible for the setup and maintenance of security configuration administrator and auditor accounts. \n- Auditor: Responsible for reviewing and maintaining server and mobile device audit logs.",
|
|
62
|
+
"severity": "medium"
|
|
63
|
+
},
|
|
64
|
+
{
|
|
65
|
+
"id": "V-79021",
|
|
66
|
+
"title": "The BlackBerry Enterprise Mobility Server (BEMS) must be configured to use Windows Authentication for the database connection.",
|
|
67
|
+
"description": "To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.",
|
|
68
|
+
"severity": "medium"
|
|
69
|
+
},
|
|
70
|
+
{
|
|
71
|
+
"id": "V-79023",
|
|
72
|
+
"title": "The BlackBerry Enterprise Mobility Server (BEMS) must be configured to use HTTPS.",
|
|
73
|
+
"description": "Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission to web applications. This is usually achieved through the use of HTTPS.",
|
|
74
|
+
"severity": "high"
|
|
75
|
+
},
|
|
76
|
+
{
|
|
77
|
+
"id": "V-79025",
|
|
78
|
+
"title": "The BlackBerry Enterprise Mobility Server (BEMS) must be configured to use DoD certificates for SSL.",
|
|
79
|
+
"description": "Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoD-approved CA, trust of this CA has not been established.",
|
|
80
|
+
"severity": "medium"
|
|
81
|
+
},
|
|
82
|
+
{
|
|
83
|
+
"id": "V-79027",
|
|
84
|
+
"title": "The BlackBerry Enterprise Mobility Server (BEMS) must be configured with an inactivity timeout of 15 minutes or less.",
|
|
85
|
+
"description": "A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their application session prior to vacating the vicinity, applications need to be able to identify when a user's application session has idled and take action to initiate the session lock.",
|
|
86
|
+
"severity": "medium"
|
|
87
|
+
},
|
|
88
|
+
{
|
|
89
|
+
"id": "V-79029",
|
|
90
|
+
"title": "If the Mail service (Push Notifications support for BlackBerry Work) is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to use Windows Authentication for the database connection.",
|
|
91
|
+
"description": "To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.",
|
|
92
|
+
"severity": "medium"
|
|
93
|
+
},
|
|
94
|
+
{
|
|
95
|
+
"id": "V-79031",
|
|
96
|
+
"title": "If the Mail service (Push Notifications support for BlackBerry Work) is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to use Windows Integrated Authentication for the Exchange connection.",
|
|
97
|
+
"description": "To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.",
|
|
98
|
+
"severity": "medium"
|
|
99
|
+
},
|
|
100
|
+
{
|
|
101
|
+
"id": "V-79033",
|
|
102
|
+
"title": "If the Mail service (Push Notifications support for BlackBerry Work) is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to Enable SSL LDAP when using LDAP Lookup for users.",
|
|
103
|
+
"description": "Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS) or SSL.",
|
|
104
|
+
"severity": "medium"
|
|
105
|
+
},
|
|
106
|
+
{
|
|
107
|
+
"id": "V-79035",
|
|
108
|
+
"title": "If the Mail service (Push Notifications support for BlackBerry Work) is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to Enable SSL LDAP for certificate directory lookup.",
|
|
109
|
+
"description": "Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS) or SSL.",
|
|
110
|
+
"severity": "medium"
|
|
111
|
+
},
|
|
112
|
+
{
|
|
113
|
+
"id": "V-79037",
|
|
114
|
+
"title": "If the BlackBerry Connect service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to use Windows Authentication for the database connection.",
|
|
115
|
+
"description": "To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.",
|
|
116
|
+
"severity": "medium"
|
|
117
|
+
},
|
|
118
|
+
{
|
|
119
|
+
"id": "V-79039",
|
|
120
|
+
"title": "If the BlackBerry Connect service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to enable SSL support for BlackBerry Proxy and use only DoD approved certificates.",
|
|
121
|
+
"description": "Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS) or SSL. Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoD-approved CA, trust of this CA has not been established.",
|
|
122
|
+
"severity": "medium"
|
|
123
|
+
},
|
|
124
|
+
{
|
|
125
|
+
"id": "V-79041",
|
|
126
|
+
"title": "If the BlackBerry Docs service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to use Windows Authentication for the database connection.",
|
|
127
|
+
"description": "To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.",
|
|
128
|
+
"severity": "medium"
|
|
129
|
+
},
|
|
130
|
+
{
|
|
131
|
+
"id": "V-79043",
|
|
132
|
+
"title": "If the BlackBerry Docs service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to use NTLM authentication.",
|
|
133
|
+
"description": "To assure accountability and prevent unauthorized access, organizational users must be identified and authenticated. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors, guest researchers, individuals from allied nations). Users (and any processes acting on behalf of users) are uniquely identified and authenticated for all accesses other than those accesses explicitly identified and documented by the organization, which outlines specific user actions that can be performed on the information system without identification or authentication.",
|
|
134
|
+
"severity": "medium"
|
|
135
|
+
},
|
|
136
|
+
{
|
|
137
|
+
"id": "V-79045",
|
|
138
|
+
"title": "If the BlackBerry Docs service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to use SSL for LDAP lookup to connect to the Office Web App Server (e.g., SharePoint).",
|
|
139
|
+
"description": "Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS) or SSL.",
|
|
140
|
+
"severity": "high"
|
|
141
|
+
},
|
|
142
|
+
{
|
|
143
|
+
"id": "V-79047",
|
|
144
|
+
"title": "If the BlackBerry Docs service is installed on the BlackBerry Enterprise Mobility Server (BEMS), it must be configured to enable audit logs.",
|
|
145
|
+
"description": "Logging must be used in order to track system activity, assist in diagnosing system issues, and provide evidence needed for forensic investigations post security incident.",
|
|
146
|
+
"severity": "medium"
|
|
147
|
+
}
|
|
148
|
+
]
|
|
149
|
+
}
|
|
@@ -0,0 +1,35 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "stig_blackberry_enterprise_server,_part_1",
|
|
3
|
+
"date": "2012-09-21",
|
|
4
|
+
"description": "BlackBerry Enterprise Server STIG, Part 1 in XCCDF format.\nPart 1: BES architecture and training requirements.\nPart 2: BES configuration requirements.\nPart 3: BES IT Policy configuration requirements.\n",
|
|
5
|
+
"title": "BlackBerry Enterprise Server, Part 1 Security Technical Implementation Guide",
|
|
6
|
+
"version": "2",
|
|
7
|
+
"item_syntax": "^\\w-\\d+$",
|
|
8
|
+
"section_separator": null,
|
|
9
|
+
"items": [
|
|
10
|
+
{
|
|
11
|
+
"id": "V-11870",
|
|
12
|
+
"title": "Onset Technologies METAmessage software must not be installed on DoD BlackBerry devices or on the BES.\n",
|
|
13
|
+
"description": "Onset Technologies METAmessage software is production software which may introduce a virus or other malicious code on the system. This software is not approved for use on DoD systems.",
|
|
14
|
+
"severity": "high"
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"id": "V-14021",
|
|
18
|
+
"title": "Only the BlackBerry Enterprise Server (BES) email solution is used. ",
|
|
19
|
+
"description": " If the required BlackBerry system is not used, DoD networks are at risk of being penetrated or DoD data could be exposed.",
|
|
20
|
+
"severity": "high"
|
|
21
|
+
},
|
|
22
|
+
{
|
|
23
|
+
"id": "V-14199",
|
|
24
|
+
"title": "The host server where the BlackBerry Enterprise Server (BES) is installed must be hardened in accordance with the appropriate SQL, Apache Web Server, and IIS STIGs when required. ",
|
|
25
|
+
"description": "Wireless email services are installed on a Windows Server. The server must be compliant with the Windows STIG, SQL STIG, Apache Web Server STIG, and IIS STIG to ensure the system is not vulnerable to attack resulting in a Denial of Service or compromise of the wireless email server.",
|
|
26
|
+
"severity": "medium"
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
"id": "V-19191",
|
|
30
|
+
"title": "Required version of the BlackBerry Enterprise Server (BES) must be installed.",
|
|
31
|
+
"description": "Earlier versions of the BES have security vulnerabilities. CYBERCOM IAVA directs all DoD installations upgrade to required version due to RIM ending support for version 4.1.6 and 4.1.7 as of 2 July 2011.",
|
|
32
|
+
"severity": "high"
|
|
33
|
+
}
|
|
34
|
+
]
|
|
35
|
+
}
|
|
@@ -0,0 +1,155 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "stig_blackberry_enterprise_server,_part_2",
|
|
3
|
+
"date": "2012-10-01",
|
|
4
|
+
"description": "BlackBerry Enterprise Server STIG, Part 2 in XCCDF format.\nPart 1: BES architecture and training requirements.\nPart 2: BES configuration requirements.\nPart 3: BES IT Policy configuration requirements.\n",
|
|
5
|
+
"title": "BlackBerry Enterprise Server, Part 2 Security Technical Implementation Guide",
|
|
6
|
+
"version": "2",
|
|
7
|
+
"item_syntax": "^\\w-\\d+$",
|
|
8
|
+
"section_separator": null,
|
|
9
|
+
"items": [
|
|
10
|
+
{
|
|
11
|
+
"id": "V-11877",
|
|
12
|
+
"title": "The Device Transport Key must be configured on the BES for AES encryption. ",
|
|
13
|
+
"description": "AES encryption provides a higher level of security for BlackBerry data.",
|
|
14
|
+
"severity": "low"
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"id": "V-14022",
|
|
18
|
+
"title": "The BlackBerry wireless email system must be set up with the required system components and software installed on the handheld device. ",
|
|
19
|
+
"description": "The wireless email server architecture must comply with the DoD environment because approval of the BES is contingent on installation with the correct settings. DoD enclaves could be at risk of penetration or DoD data could be compromised if BES is not installed as required.",
|
|
20
|
+
"severity": "high"
|
|
21
|
+
},
|
|
22
|
+
{
|
|
23
|
+
"id": "V-16341",
|
|
24
|
+
"title": "An Application White List software configuration must be assigned to all BES user accounts.",
|
|
25
|
+
"description": "The primary BlackBerry malware control is to set up one or more Application White List software configurations on the BES. Every user and group account must be assigned at least one Application White List software configuration. In an Application White List, the use of all non-core applications is denied unless an application is expressly allowed.",
|
|
26
|
+
"severity": "high"
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
"id": "V-16343",
|
|
30
|
+
"title": "The BES must be configured to disable the capability of the BES to proxy a user’s authentication to back-office application, web, and content servers. Users must authenticate directly to back-office servers using a USCYBERCOM CTO 07-15Rev1 authorized method.\n",
|
|
31
|
+
"description": "User authentication credentials should not be proxied by the BES, because the BES would then be saving DoD user authentication credentials in its database.",
|
|
32
|
+
"severity": "medium"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"id": "V-18394",
|
|
36
|
+
"title": "The BES must be configured to convert HTML and RTF formatted email into text format before sending to a BlackBerry smartphone and prevent the BES from sending email messages with inline images to BlackBerry smartphones. ",
|
|
37
|
+
"description": "HTML email and inline images in email can contain malware or links to web sites with malware.",
|
|
38
|
+
"severity": "low"
|
|
39
|
+
},
|
|
40
|
+
{
|
|
41
|
+
"id": "V-19192",
|
|
42
|
+
"title": "The BES host-based or appliance firewall must be configured as required.",
|
|
43
|
+
"description": "BlackBerry user could get access to unauthorized network resources (application and content servers, etc.) if the BES firewall is not set up as required.",
|
|
44
|
+
"severity": "high"
|
|
45
|
+
},
|
|
46
|
+
{
|
|
47
|
+
"id": "V-19201",
|
|
48
|
+
"title": "The BES must be configured to accept only trusted connections to back-office enclave application or web push servers. Push servers are set up to push content to BlackBerry users (e.g., Remedy ticket notification system).\t\n",
|
|
49
|
+
"description": "Only authorized servers should be able to push content to BlackBerry devices.",
|
|
50
|
+
"severity": "low"
|
|
51
|
+
},
|
|
52
|
+
{
|
|
53
|
+
"id": "V-19202",
|
|
54
|
+
"title": "Non-core applications used on the BlackBerry must be approved.",
|
|
55
|
+
"description": "Unapproved applications could include malware or introduce other vulnerabilities to the BlackBerry system and enclave.",
|
|
56
|
+
"severity": "low"
|
|
57
|
+
},
|
|
58
|
+
{
|
|
59
|
+
"id": "V-19203",
|
|
60
|
+
"title": "An Application Control Policy must be assigned to each application listed in any Application White List software configuration assigned to user accounts on the BES.\n\nNote: This check applies to BES 4.1.x only. On BES 5, an application control policy is automatically assigned when an application is selected for a software configuration. ",
|
|
61
|
+
"description": "Applications must only have access to BlackBerry resources (e.g., microphone, address book, browser, email messages, etc.) they need for their function; otherwise, sensitive data could be exposed to unauthorized users or the BlackBerry system could be compromised.",
|
|
62
|
+
"severity": "medium"
|
|
63
|
+
},
|
|
64
|
+
{
|
|
65
|
+
"id": "V-19206",
|
|
66
|
+
"title": "Security controls must be set up on the BES for connections to “back-office” servers.",
|
|
67
|
+
"description": "Strong access controls to back-office servers are required to ensure DoD data is not exposed to users of the BlackBerry system that are not authorized to access the server.",
|
|
68
|
+
"severity": "medium"
|
|
69
|
+
},
|
|
70
|
+
{
|
|
71
|
+
"id": "V-19215",
|
|
72
|
+
"title": "The BlackBerry Bluetooth Smart Card Reader (SCR) used with site PCs must be compliant with requirements.\n",
|
|
73
|
+
"description": "Insecure Bluetooth configuration on the PC could make it vulnerable to compromise via a Bluetooth attack.",
|
|
74
|
+
"severity": "medium"
|
|
75
|
+
},
|
|
76
|
+
{
|
|
77
|
+
"id": "V-19224",
|
|
78
|
+
"title": "Required security controls must be used when BlackBerry Wi-Fi is used by the site to connect to a DoD Wi-Fi network. Required security controls are in Table 2, BlackBerry STIG Configuration Tables. ",
|
|
79
|
+
"description": "If BlackBerry Wi-Fi controls are not implemented, DoD data can be compromised.",
|
|
80
|
+
"severity": "low"
|
|
81
|
+
},
|
|
82
|
+
{
|
|
83
|
+
"id": "V-19226",
|
|
84
|
+
"title": "BlackBerry accounts must not be assigned to the default IT policy on the BES or any other non-STIG compliant IT policy. Accounts will only be assigned a STIG compliant IT policy.",
|
|
85
|
+
"description": "The BlackBerry default policy on the BES does not include many DoD required security policies for data encryption, authentication, and access control. DoD enclaves are at risk of data exposure and hacker attack if users are assigned the default (or other non-STIG compliant) IT policy.",
|
|
86
|
+
"severity": "high"
|
|
87
|
+
},
|
|
88
|
+
{
|
|
89
|
+
"id": "V-22042",
|
|
90
|
+
"title": "Each Application White List software configuration assigned to each user account must be configured with top-level default “disallow” for all applications. Applications must be specifically allowed at a lower level.",
|
|
91
|
+
"description": "The primary BlackBerry malware control is to set up an Application White List where the use of all applications is denied unless an application is expressly allowed. Otherwise, malware could be installed on the BlackBerry.",
|
|
92
|
+
"severity": "high"
|
|
93
|
+
},
|
|
94
|
+
{
|
|
95
|
+
"id": "V-22055",
|
|
96
|
+
"title": "Application repositories must be located on a DoD-controlled server within a DoD enclave. If not set up, this check is Not Applicable.",
|
|
97
|
+
"description": "A DoD application repository must contain only authorized applications and only approved and unaltered versions of those applications. If DoD application repositories are not on DoD controlled servers inside DoD enclaves, the integrity of those applications could be compromised.",
|
|
98
|
+
"severity": "medium"
|
|
99
|
+
},
|
|
100
|
+
{
|
|
101
|
+
"id": "V-22056",
|
|
102
|
+
"title": "All user and or group accounts must have an Access Control Rule assigned to the account. \n\t\n",
|
|
103
|
+
"description": "The BES MDS Connection Service allows BlackBerry users to search the enclave for files and documents of interest to the user without any authentication requirements to the enclave. Access control requirements of the network can be bypassed.",
|
|
104
|
+
"severity": "medium"
|
|
105
|
+
},
|
|
106
|
+
{
|
|
107
|
+
"id": "V-22102",
|
|
108
|
+
"title": "The BlackBerry Administration Server (BAS) must be configured for Active Directory authentication with a CTO 07-15Rev1 compliant administrator password. ",
|
|
109
|
+
"description": "The BAS provides the administrator interface for the BES. CTO 07-15Rev1 requires administrator accounts use either CAC authentication or use complex passwords to ensure storing access control is enforced.",
|
|
110
|
+
"severity": "medium"
|
|
111
|
+
},
|
|
112
|
+
{
|
|
113
|
+
"id": "V-22164",
|
|
114
|
+
"title": "The key store password for the certificate that the BlackBerry Administration Service (BAS) and BlackBerry Web Desktop Manager (BWDM) use must be changed from the default. ",
|
|
115
|
+
"description": "The key store password protects the server digital authentication certificates from unauthorized use. ",
|
|
116
|
+
"severity": "low"
|
|
117
|
+
},
|
|
118
|
+
{
|
|
119
|
+
"id": "V-22165",
|
|
120
|
+
"title": "The BlackBerry Administration Service must be configured to disable a user from creating an activation password via BWDM. ",
|
|
121
|
+
"description": "The overall security posture of the BlackBerry system is dependent on strict configuration management controls, including ensuring only authorized BlackBerry devices are being used and authorized devices are provisioned as required. Users must be prohibited from performing the following administrative tasks using the BlackBerry Web Desktop Manager: \n-Specify an enterprise activation password for a BlackBerry device.\n-Specify a new device password and lock a device.\n-Delete all device data and deactivate a device.\n-Assign a new device to a user account.\n",
|
|
122
|
+
"severity": "low"
|
|
123
|
+
},
|
|
124
|
+
{
|
|
125
|
+
"id": "V-22703",
|
|
126
|
+
"title": "All Access Control Rules assigned to user and group accounts must be configured to deny access to all file shares. ",
|
|
127
|
+
"description": "The BES MDS Connection Service allows BlackBerry users to search the enclave for files and documents of interest to the user without any authentication requirements to the enclave. Access control requirements of the network can be bypassed.",
|
|
128
|
+
"severity": "medium"
|
|
129
|
+
},
|
|
130
|
+
{
|
|
131
|
+
"id": "V-25430",
|
|
132
|
+
"title": "BlackBerry Web Desktop Manager must be configured to disable a user’s capability to perform self-service tasks.",
|
|
133
|
+
"description": "The overall security posture of the BlackBerry system is dependent on strict configuration management controls, including ensuring only authorized BlackBerry devices are being used and authorized devices are provisioned as required. When this configuration is not set as required, users may have the capability to activate unauthorized BlackBerry devices.",
|
|
134
|
+
"severity": "medium"
|
|
135
|
+
},
|
|
136
|
+
{
|
|
137
|
+
"id": "V-25431",
|
|
138
|
+
"title": "BlackBerry Web Desktop Manager must be configured to permit users to activate new BlackBerry devices only. ",
|
|
139
|
+
"description": "The overall security posture of the BlackBerry system is dependent on strict configuration management controls, including ensuring only authorized BlackBerry devices are being used and authorized devices are provisioned as required. When this configuration is not set as required, users may have the capability to activate unauthorized BlackBerry devices.",
|
|
140
|
+
"severity": "medium"
|
|
141
|
+
},
|
|
142
|
+
{
|
|
143
|
+
"id": "V-25548",
|
|
144
|
+
"title": "The server PKI digital certificate installed on the BES to support BAS and BWDM authentication must be a DoD PKI issued certificate. A self signed certificate will not be used.",
|
|
145
|
+
"description": "When a self signed PKI certificate is used, a rogue BES can impersonate the DoD BES during SA connections to the BlackBerry Administration Service (BAS) or when a BlackBerry user uses BlackBerry Web Desktop Manager (BWDM) to connect to the BAS. In addition, DoDI 8520-02 requires PKI certificates come from a trusted DoD PKI.",
|
|
146
|
+
"severity": "low"
|
|
147
|
+
},
|
|
148
|
+
{
|
|
149
|
+
"id": "V-7078",
|
|
150
|
+
"title": "The BlackBerry MDS Integration Service must not be installed on a production BES.",
|
|
151
|
+
"description": "The BlackBerry Enterprise Service MDS Integration Service is a software development platform and should not be installed on a production BES. The service, if not properly configured, can allow unsecured connections between the BlackBerry and BES and between the BES and back-office run-time application servers.",
|
|
152
|
+
"severity": "medium"
|
|
153
|
+
}
|
|
154
|
+
]
|
|
155
|
+
}
|
|
@@ -0,0 +1,647 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "stig_blackberry_enterprise_server,_part_3",
|
|
3
|
+
"date": "2012-10-01",
|
|
4
|
+
"description": "BlackBerry Enterprise Server STIG, Part 3 in XCCDF format.\nPart 1: BES architecture and training requirements.\nPart 2: BES configuration requirements.\nPart 3: BES IT Policy configuration requirements.\n",
|
|
5
|
+
"title": "BlackBerry Enterprise Server, Part 3 Security Technical Implementation Guide",
|
|
6
|
+
"version": "2",
|
|
7
|
+
"item_syntax": "^\\w-\\d+$",
|
|
8
|
+
"section_separator": null,
|
|
9
|
+
"items": [
|
|
10
|
+
{
|
|
11
|
+
"id": "V-11876",
|
|
12
|
+
"title": "IT Policy rule “Maximum Security Timeout” (Device-Only policy group) must be set as required.",
|
|
13
|
+
"description": "Handheld may not lock after the specified period of inactivity and DoD data could be exposed.\n\n",
|
|
14
|
+
"severity": "medium"
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"id": "V-12164",
|
|
18
|
+
"title": "Data-at-Rest encryption (Content Protection) must be enabled on BlackBerry devices. IT Policy rule “Content Protection Strength” (Security policy group) must be set as required.\n",
|
|
19
|
+
"description": "DoD 8500 policy requires data-at-rest protection be enabled on all IT devices containing sensitive data in case the device is lost or stolen. This protection normally involves password or pin protected access.",
|
|
20
|
+
"severity": "medium"
|
|
21
|
+
},
|
|
22
|
+
{
|
|
23
|
+
"id": "V-14198",
|
|
24
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Disable Bluetooth” (Bluetooth policy group) must be set as required.",
|
|
25
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.",
|
|
26
|
+
"severity": "medium"
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
"id": "V-14478",
|
|
30
|
+
"title": "Wireless email device users must not install or remove applications and/or software on their handheld device unless under the direction and supervision of an authorized system administrator. IT Policy rule “Show Application Loader” (Desktop-Only policy group) must be is set as required. ",
|
|
31
|
+
"description": "The wireless email server can be configured to prevent users from installing or removing applications. These configuration settings must be set at the enterprise level to prevent users from downloading, using desktop software, unauthorized software, or harmful code.",
|
|
32
|
+
"severity": "medium"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"id": "V-16058",
|
|
36
|
+
"title": "IT Policy rule Disable Wi-Fi must be set as required. ",
|
|
37
|
+
"description": "Improperly configured WLAN systems can expose the BlackBerry device and DoD network to attack.",
|
|
38
|
+
"severity": "low"
|
|
39
|
+
},
|
|
40
|
+
{
|
|
41
|
+
"id": "V-19234",
|
|
42
|
+
"title": "BlackBerry devices must be protected by authenticated login procedures to unlock the device. Either CAC or Password authentication is required. IT Policy rule “Minimum Password Length” (Device Only policy group) must be set as required. ",
|
|
43
|
+
"description": "Authenticated device unlock is a key security control for the BlackBerry system to restrict access to\nDoD data by unauthorized individuals.\n",
|
|
44
|
+
"severity": "high"
|
|
45
|
+
},
|
|
46
|
+
{
|
|
47
|
+
"id": "V-19235",
|
|
48
|
+
"title": "BlackBerry devices must be protected by authenticated login procedures to unlock the device. IT Policy rule “User Can Disable Passwords” (Device Only policy group) must be set as required. ",
|
|
49
|
+
"description": "Authenticated device unlock is a key security control for the BlackBerry system to restrict access to\nDoD data by unauthorized individuals.\n",
|
|
50
|
+
"severity": "high"
|
|
51
|
+
},
|
|
52
|
+
{
|
|
53
|
+
"id": "V-19236",
|
|
54
|
+
"title": "BlackBerry devices must be protected by authenticated login procedures to unlock the device. IT Policy rule “Maximum Password Age” (Device Only policy group) must be set as required. ",
|
|
55
|
+
"description": "Authenticated device unlock is a key security control for the BlackBerry system to restrict access to\nDoD data by unauthorized individuals.\n",
|
|
56
|
+
"severity": "low"
|
|
57
|
+
},
|
|
58
|
+
{
|
|
59
|
+
"id": "V-19238",
|
|
60
|
+
"title": "BlackBerry devices must be protected by authenticated login procedures to unlock the device. IT Policy rule “Set Password Timeout” (Password policy group) must be set as required. ",
|
|
61
|
+
"description": "Authenticated device unlock is a key security control for the BlackBerry system to restrict access to\nDoD data by unauthorized individuals.\n",
|
|
62
|
+
"severity": "medium"
|
|
63
|
+
},
|
|
64
|
+
{
|
|
65
|
+
"id": "V-19239",
|
|
66
|
+
"title": "BlackBerry devices must be protected by authenticated login procedures to unlock the device. IT Policy rule “Set Maximum Password Attempts” (Password policy group) must be set as required. ",
|
|
67
|
+
"description": "Authenticated device unlock is a key security control for the BlackBerry system to restrict access to\nDoD data by unauthorized individuals.\n",
|
|
68
|
+
"severity": "high"
|
|
69
|
+
},
|
|
70
|
+
{
|
|
71
|
+
"id": "V-19240",
|
|
72
|
+
"title": "BlackBerry devices must be protected by authenticated login procedures to unlock the device. IT Policy rule “Suppress Password Echo” (Password policy group) must be set as required. ",
|
|
73
|
+
"description": "Authenticated device unlock is a key security control for the BlackBerry system to restrict access to\nDoD data by unauthorized individuals.\n",
|
|
74
|
+
"severity": "low"
|
|
75
|
+
},
|
|
76
|
+
{
|
|
77
|
+
"id": "V-19241",
|
|
78
|
+
"title": "BlackBerry devices must be protected by authenticated login procedures to unlock the device. IT Policy rule “Maximum Password History” (Password policy group) must be set as required. ",
|
|
79
|
+
"description": "Authenticated device unlock is a key security control for the BlackBerry system to restrict access to\nDoD data by unauthorized individuals.\n",
|
|
80
|
+
"severity": "low"
|
|
81
|
+
},
|
|
82
|
+
{
|
|
83
|
+
"id": "V-19242",
|
|
84
|
+
"title": "BlackBerry devices must be protected by authenticated login procedures to unlock the device. IT Policy rule “Forbidden Passwords” (Password policy group) must be set as required. ",
|
|
85
|
+
"description": "Authenticated device unlock is a key security control for the BlackBerry system to restrict access to\nDoD data by unauthorized individuals.\n",
|
|
86
|
+
"severity": "low"
|
|
87
|
+
},
|
|
88
|
+
{
|
|
89
|
+
"id": "V-19243",
|
|
90
|
+
"title": "BlackBerry devices must be protected by authenticated login procedures to unlock the device. IT Policy rule Reset to Factory Defaults on Wipe (Security policy group) must be set as required. ",
|
|
91
|
+
"description": "Authenticated device unlock is a key security control for the BlackBerry system to restrict access to\nDoD data by unauthorized individuals.\n",
|
|
92
|
+
"severity": "high"
|
|
93
|
+
},
|
|
94
|
+
{
|
|
95
|
+
"id": "V-19244",
|
|
96
|
+
"title": "All PDAs and smartphones must display the required banner during device unlock/logon. The IT Policy rule “Lock Owner Info” must be set as required.",
|
|
97
|
+
"description": "DoD CIO memo requires all PDAs, BlackBerrys, and smartphones to have a consent banner\ndisplayed during logon/device unlock to ensure user understands their responsibilities to safeguard DoD data.\n",
|
|
98
|
+
"severity": "medium"
|
|
99
|
+
},
|
|
100
|
+
{
|
|
101
|
+
"id": "V-19245",
|
|
102
|
+
"title": "All PDAs and smartphones must display the required banner during device unlock/ logon. The IT Policy rule “Set Owner Info” must be set as required.",
|
|
103
|
+
"description": "DoD CIO memo requires all PDAs, BlackBerrys, and smartphones to have a consent banner\ndisplayed during logon/device unlock to ensure users understand their responsibilities to safeguard DoD data.\n",
|
|
104
|
+
"severity": "medium"
|
|
105
|
+
},
|
|
106
|
+
{
|
|
107
|
+
"id": "V-19257",
|
|
108
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Disable Pairing” (Bluetooth Only policy group) must be set as required.",
|
|
109
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.",
|
|
110
|
+
"severity": "medium"
|
|
111
|
+
},
|
|
112
|
+
{
|
|
113
|
+
"id": "V-19258",
|
|
114
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Disable Headset Profile” (Bluetooth Only policy group) must be set as required.",
|
|
115
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.",
|
|
116
|
+
"severity": "medium"
|
|
117
|
+
},
|
|
118
|
+
{
|
|
119
|
+
"id": "V-19259",
|
|
120
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Disable Handsfree Profile” (Bluetooth Only policy group) must be set as required.",
|
|
121
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.\n\n",
|
|
122
|
+
"severity": "medium"
|
|
123
|
+
},
|
|
124
|
+
{
|
|
125
|
+
"id": "V-19260",
|
|
126
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Disable Serial Port Profile” (Bluetooth Only policy group) must be set as required.",
|
|
127
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.",
|
|
128
|
+
"severity": "medium"
|
|
129
|
+
},
|
|
130
|
+
{
|
|
131
|
+
"id": "V-19261",
|
|
132
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Disable Discoverable Mode” (Bluetooth Only policy group) must be set as required.",
|
|
133
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.\n\n",
|
|
134
|
+
"severity": "medium"
|
|
135
|
+
},
|
|
136
|
+
{
|
|
137
|
+
"id": "V-19263",
|
|
138
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Disable Address Book Transfer” (Bluetooth Only policy group) will be set as required. \n",
|
|
139
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.\n\n",
|
|
140
|
+
"severity": "low"
|
|
141
|
+
},
|
|
142
|
+
{
|
|
143
|
+
"id": "V-19264",
|
|
144
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Disable Desktop Connectivity” (Bluetooth Only policy group) must be set as required.",
|
|
145
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.\n\n",
|
|
146
|
+
"severity": "low"
|
|
147
|
+
},
|
|
148
|
+
{
|
|
149
|
+
"id": "V-19265",
|
|
150
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Disable Wireless Bypass” (Bluetooth Only policy group) must be set as required.",
|
|
151
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.\n\n",
|
|
152
|
+
"severity": "medium"
|
|
153
|
+
},
|
|
154
|
+
{
|
|
155
|
+
"id": "V-19266",
|
|
156
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Require Password for Enabling Bluetooth Support” (Bluetooth Only policy group) must be set as required.",
|
|
157
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.\n\n",
|
|
158
|
+
"severity": "low"
|
|
159
|
+
},
|
|
160
|
+
{
|
|
161
|
+
"id": "V-19267",
|
|
162
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Require Password for Discoverable Mode” (Bluetooth Only policy group) must be set as required.",
|
|
163
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.\n\n",
|
|
164
|
+
"severity": "low"
|
|
165
|
+
},
|
|
166
|
+
{
|
|
167
|
+
"id": "V-19268",
|
|
168
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Require Encryption” (Bluetooth Only policy group) must be set as required.",
|
|
169
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.\n\n",
|
|
170
|
+
"severity": "medium"
|
|
171
|
+
},
|
|
172
|
+
{
|
|
173
|
+
"id": "V-19269",
|
|
174
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Disable File Transfer” (Bluetooth Only policy group) must be set as required.",
|
|
175
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.\n\n",
|
|
176
|
+
"severity": "medium"
|
|
177
|
+
},
|
|
178
|
+
{
|
|
179
|
+
"id": "V-19270",
|
|
180
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Require LED Connection Indicator” (Bluetooth Only policy group) must be set as required.",
|
|
181
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.\n\n",
|
|
182
|
+
"severity": "low"
|
|
183
|
+
},
|
|
184
|
+
{
|
|
185
|
+
"id": "V-19271",
|
|
186
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Disable Dial-Up Networking” (Bluetooth Only policy group) must be set as required.",
|
|
187
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.",
|
|
188
|
+
"severity": "medium"
|
|
189
|
+
},
|
|
190
|
+
{
|
|
191
|
+
"id": "V-19272",
|
|
192
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Force CHAP Authentication Bluetooth Link” (Bluetooth Only policy group) must be set as required.",
|
|
193
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.\n\n",
|
|
194
|
+
"severity": "medium"
|
|
195
|
+
},
|
|
196
|
+
{
|
|
197
|
+
"id": "V-19273",
|
|
198
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Disable Advanced Audio Distribution Profile” (Bluetooth Only policy group) must be set as required.",
|
|
199
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.\n\n",
|
|
200
|
+
"severity": "medium"
|
|
201
|
+
},
|
|
202
|
+
{
|
|
203
|
+
"id": "V-19274",
|
|
204
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Disable Audio/Video Remote Control Profile” (Bluetooth Only policy group) must be set as required.",
|
|
205
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.\n\n",
|
|
206
|
+
"severity": "medium"
|
|
207
|
+
},
|
|
208
|
+
{
|
|
209
|
+
"id": "V-19276",
|
|
210
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Limit Discoverable Time” (Bluetooth Only policy group) must be set as required.",
|
|
211
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.\n\n",
|
|
212
|
+
"severity": "low"
|
|
213
|
+
},
|
|
214
|
+
{
|
|
215
|
+
"id": "V-19278",
|
|
216
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Disable SIM Access Profile” (Bluetooth Only policy group) must be set as required.",
|
|
217
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.\n\n",
|
|
218
|
+
"severity": "medium"
|
|
219
|
+
},
|
|
220
|
+
{
|
|
221
|
+
"id": "V-19282",
|
|
222
|
+
"title": "Site BlackBerry devices must be provisioned so users can digitally sign and encrypt e-mail notifications or any other message required by DoD policy. IT Policy rule “Disable Revoked Certificate Use” (Security policy group) must be set as required. \n\n",
|
|
223
|
+
"description": "S/MIME provides the capability for users to send and receive S/MIME email messages from wireless email devices. S/MIME and digital signatures provide assurance the message is authentic and is required by DoD policy.\n\n",
|
|
224
|
+
"severity": "low"
|
|
225
|
+
},
|
|
226
|
+
{
|
|
227
|
+
"id": "V-19283",
|
|
228
|
+
"title": "Site BlackBerry devices must be provisioned so users can digitally sign and encrypt e-mail notifications or any other email required by DoD policy. IT Policy rule “Disable Key Store Low Security” (Security policy group) must be set as required. \n",
|
|
229
|
+
"description": "S/MIME provides the capability for users to send and receive S/MIME email messages from wireless email devices. S/MIME and digital signatures provide assurance the message is authentic and is required by DoD policy.\n\n",
|
|
230
|
+
"severity": "low"
|
|
231
|
+
},
|
|
232
|
+
{
|
|
233
|
+
"id": "V-19284",
|
|
234
|
+
"title": "Site BlackBerry devices must be provisioned so users can digitally sign and encrypt e-mail notifications or any other email required by DoD policy. IT Policy rule “Certificate Status Cache Timeout” (Security policy group) must be set as required. \n",
|
|
235
|
+
"description": "S/MIME provides the capability for users to send and receive S/MIME email messages from wireless email devices. S/MIME and digital signatures provide assurance the message is authentic and is required by DoD policy.\n\n",
|
|
236
|
+
"severity": "low"
|
|
237
|
+
},
|
|
238
|
+
{
|
|
239
|
+
"id": "V-19285",
|
|
240
|
+
"title": "Site BlackBerry devices must be provisioned so users can digitally sign and encrypt e-mail notifications or any other email required by DoD policy. IT Policy rule “Disable Invalid Certificate Use” (Security policy group) must be set as required. \n",
|
|
241
|
+
"description": "S/MIME provides the capability for users to send and receive S/MIME email messages from wireless email devices. S/MIME and digital signatures provide assurance the message is authentic and is required by DoD policy.",
|
|
242
|
+
"severity": "low"
|
|
243
|
+
},
|
|
244
|
+
{
|
|
245
|
+
"id": "V-19286",
|
|
246
|
+
"title": "Site BlackBerry devices must be provisioned so users can digitally sign and encrypt e-mail notifications or any other email required by DoD policy. IT Policy rule “Disable Weak Certificate Use” (Security policy group) must be set as required. \n",
|
|
247
|
+
"description": "S/MIME provides the capability for users to send and receive S/MIME email messages from wireless email devices. S/MIME and digital signatures provide assurance the message is authentic and is required by DoD policy.\n\n",
|
|
248
|
+
"severity": "low"
|
|
249
|
+
},
|
|
250
|
+
{
|
|
251
|
+
"id": "V-19287",
|
|
252
|
+
"title": "Site BlackBerry devices must be provisioned so users can digitally sign and encrypt e-mail notifications or any other email required by DoD policy. IT Policy rule “Certificate Status Maximum Expiry Time” (Security policy group) must be set as required. \n",
|
|
253
|
+
"description": "S/MIME provides the capability for users to send and receive S/MIME email messages from wireless email devices. S/MIME and digital signatures provide assurance the message is authentic and is required by DoD policy.",
|
|
254
|
+
"severity": "low"
|
|
255
|
+
},
|
|
256
|
+
{
|
|
257
|
+
"id": "V-19288",
|
|
258
|
+
"title": "Site BlackBerry devices must be provisioned so users can digitally sign and encrypt e-mail notifications or any other email required by DoD policy. IT Policy rule “Disable Unverified CRLs” (Security policy group) must be set as required. \n",
|
|
259
|
+
"description": "S/MIME provides the capability for users to send and receive S/MIME email messages from wireless email devices. S/MIME and digital signatures provide assurance the message is authentic and is required by DoD policy.\n\n",
|
|
260
|
+
"severity": "low"
|
|
261
|
+
},
|
|
262
|
+
{
|
|
263
|
+
"id": "V-19289",
|
|
264
|
+
"title": "Site BlackBerry devices must be provisioned so users can digitally sign and encrypt e-mail notifications or any other email required by DoD policy. IT Policy rule “S/MIME Minimum Strong RSA Key Length” (S/MIME Application policy group) must be set as required. \n",
|
|
265
|
+
"description": "S/MIME provides the capability for users to send and receive S/MIME email messages from wireless email devices. S/MIME and digital signatures provide assurance the message is authentic and is required by DoD policy.\n\n",
|
|
266
|
+
"severity": "low"
|
|
267
|
+
},
|
|
268
|
+
{
|
|
269
|
+
"id": "V-19290",
|
|
270
|
+
"title": "Site BlackBerry devices must be provisioned so users can digitally sign and encrypt e-mail notifications or any other email required by DoD policy. IT Policy rule “S/MIME Minimum Strong DH Key Length” (S/MIME Application policy group) must be set as required. \n",
|
|
271
|
+
"description": "S/MIME provides the capability for users to send and receive S/MIME email messages from wireless email devices. S/MIME and digital signatures provide assurance the message is authentic and is required by DoD policy.\n\n",
|
|
272
|
+
"severity": "low"
|
|
273
|
+
},
|
|
274
|
+
{
|
|
275
|
+
"id": "V-19291",
|
|
276
|
+
"title": "Site BlackBerry devices must be provisioned so users can digitally sign and encrypt e-mail notifications or any other email required by DoD policy. IT Policy rule “S/MIME Minimum Strong ECC Key Length” (S/MIME Application policy group) must be to “163”.",
|
|
277
|
+
"description": "S/MIME provides the capability for users to send and receive S/MIME email messages from wireless email devices. S/MIME and digital signatures provide assurance the message is authentic and is required by DoD policy.\n\n",
|
|
278
|
+
"severity": "low"
|
|
279
|
+
},
|
|
280
|
+
{
|
|
281
|
+
"id": "V-19292",
|
|
282
|
+
"title": "Site BlackBerry devices must be provisioned so users can digitally sign and encrypt e-mail notifications or any other email required by DoD policy. IT Policy rule “S/MIME Allowed Content Ciphers” (S/MIME Application policy group) must be set as required.",
|
|
283
|
+
"description": "S/MIME provides the capability for users to send and receive S/MIME email messages from wireless email devices. S/MIME and digital signatures provide assurance the message is authentic and is required by DoD policy.\n\n",
|
|
284
|
+
"severity": "low"
|
|
285
|
+
},
|
|
286
|
+
{
|
|
287
|
+
"id": "V-19293",
|
|
288
|
+
"title": "Site BlackBerry devices must be provisioned so users can digitally sign and encrypt e-mail notifications or any other email required by DoD policy. IT Policy rule “S/MIME Minimum Strong DSA Key Length” (S/MIME Application policy group) must be set as required. \n",
|
|
289
|
+
"description": "S/MIME provides the capability for users to send and receive S/MIME email messages from wireless email devices. S/MIME and digital signatures provide assurance the message is authentic and is required by DoD policy.\n\n",
|
|
290
|
+
"severity": "low"
|
|
291
|
+
},
|
|
292
|
+
{
|
|
293
|
+
"id": "V-19294",
|
|
294
|
+
"title": "Site BlackBerry devices must be provisioned so users can digitally sign and encrypt e-mail notifications or any other email required by DoD policy. IT Policy rule “Entrust Messaging Server (EMS) Email Address” (S/MIME Application policy group) must be set as required. \n",
|
|
295
|
+
"description": "S/MIME provides the capability for users to send and receive S/MIME email messages from wireless email devices. S/MIME and digital signatures provide assurance the message is authentic and is required by DoD policy.\n\n",
|
|
296
|
+
"severity": "low"
|
|
297
|
+
},
|
|
298
|
+
{
|
|
299
|
+
"id": "V-19295",
|
|
300
|
+
"title": "Site BlackBerry devices must be provisioned so users can digitally sign and encrypt e-mail notifications or any other email required by DoD policy. IT Policy rule “S/MIME Allowed Encryption Types” (S/MIME Application policy group) must be set as required. \n",
|
|
301
|
+
"description": "S/MIME provides the capability for users to send and receive S/MIME email messages from wireless email devices. S/MIME and digital signatures provide assurance the message is authentic and is required by DoD policy.\n\n",
|
|
302
|
+
"severity": "low"
|
|
303
|
+
},
|
|
304
|
+
{
|
|
305
|
+
"id": "V-19304",
|
|
306
|
+
"title": "Security requirements for Instant Messaging (IM) must be followed. IT Policy rule “Allow Public Yahoo! Messenger Services” (Service Exclusivity policy group) must be set as required. ",
|
|
307
|
+
"description": "Non-DoD instant messaging servers can be located anywhere in the world and can expose the DoD BlackBerry system and enclave to malware and attack. ",
|
|
308
|
+
"severity": "low"
|
|
309
|
+
},
|
|
310
|
+
{
|
|
311
|
+
"id": "V-19305",
|
|
312
|
+
"title": "Security requirements for Instant Messaging (IM) must be followed. IT Policy rule “Allow Public AIM Services” (Service Exclusivity policy group) must be set as required. ",
|
|
313
|
+
"description": "Non-DoD instant messaging servers can be located anywhere in the world and can expose the DoD BlackBerry system and enclave to malware and attack. ",
|
|
314
|
+
"severity": "low"
|
|
315
|
+
},
|
|
316
|
+
{
|
|
317
|
+
"id": "V-19306",
|
|
318
|
+
"title": "Security requirements for Instant Messaging (IM) must be followed. IT Policy rule “Allow Public ICQ Services” (Service Exclusivity policy group) must be set as required. ",
|
|
319
|
+
"description": "Non-DoD instant messaging servers can be located anywhere in the world and can expose the DoD BlackBerry system and enclave to malware and attack. ",
|
|
320
|
+
"severity": "medium"
|
|
321
|
+
},
|
|
322
|
+
{
|
|
323
|
+
"id": "V-19307",
|
|
324
|
+
"title": "Security requirements for Instant Messaging (IM) must be followed. IT Policy rule “Allow Public IM Services” (Service Exclusivity policy group) must be set as required. ",
|
|
325
|
+
"description": "Non-DoD instant messaging servers can be located anywhere in the world and can expose the DoD BlackBerry system and enclave to malware and attack. ",
|
|
326
|
+
"severity": "medium"
|
|
327
|
+
},
|
|
328
|
+
{
|
|
329
|
+
"id": "V-19308",
|
|
330
|
+
"title": "Security requirements for Instant Messaging (IM) must be followed. IT Policy rule “Allow Public Google Talk Services” (Service Exclusivity policy group) must be set as required. ",
|
|
331
|
+
"description": "Non-DoD instant messaging servers can be located anywhere in the world and can expose the DoD BlackBerry system and enclave to malware and attack. ",
|
|
332
|
+
"severity": "low"
|
|
333
|
+
},
|
|
334
|
+
{
|
|
335
|
+
"id": "V-19309",
|
|
336
|
+
"title": "Security requirements for Instant Messaging (IM) must be followed. IT Policy rule “Allow Public WLM Services” (Service Exclusivity policy group) must be set as required. \n",
|
|
337
|
+
"description": "Non-DoD instant messaging servers can be located anywhere in the world and can expose the DoD BlackBerry system and enclave to malware and attack. ",
|
|
338
|
+
"severity": "low"
|
|
339
|
+
},
|
|
340
|
+
{
|
|
341
|
+
"id": "V-19315",
|
|
342
|
+
"title": "IT Policy rule “Maximum Bluetooth Range (BlackBerry Smart Card Reader policy group) must be set as required.",
|
|
343
|
+
"description": "Insecure Bluetooth SCR could make the BlackBerry vulnerable to compromise via a Bluetooth attack.",
|
|
344
|
+
"severity": "low"
|
|
345
|
+
},
|
|
346
|
+
{
|
|
347
|
+
"id": "V-19317",
|
|
348
|
+
"title": "IT Policy rule “Maximum PC Disconnect Timeout (BlackBerry Smart Card Reader policy group) must be set as required.",
|
|
349
|
+
"description": "Insecure Bluetooth configuration on the PC could make it vulnerable to compromise via a Bluetooth attack.",
|
|
350
|
+
"severity": "low"
|
|
351
|
+
},
|
|
352
|
+
{
|
|
353
|
+
"id": "V-19318",
|
|
354
|
+
"title": "IT Policy rule “Maximum Number of PC Pairings (BlackBerry Smart Card Reader policy group) must be set as required.",
|
|
355
|
+
"description": "Insecure Bluetooth configuration on the PC could make it vulnerable to compromise via a Bluetooth attack.",
|
|
356
|
+
"severity": "medium"
|
|
357
|
+
},
|
|
358
|
+
{
|
|
359
|
+
"id": "V-19337",
|
|
360
|
+
"title": "All Internet browsers must be disabled and removed from the BlackBerry\ndevice except for the BlackBerry internet browser. IT Policy rule “Allow IBS Browser” (Browser policy group) is set as required.\n",
|
|
361
|
+
"description": "The BlackBerry Browser forces all Internet browsing to go through the site Internet gateway, which provides additional security over the carrier's browser.\n\n",
|
|
362
|
+
"severity": "low"
|
|
363
|
+
},
|
|
364
|
+
{
|
|
365
|
+
"id": "V-19339",
|
|
366
|
+
"title": "All Internet browsers must be disabled and removed from the BlackBerry\ndevice except for the BlackBerry internet browser. IT Policy rule “Allow Hotspot Browser” (Browser policy group) is set as required.\n",
|
|
367
|
+
"description": "The BlackBerry Browser forces all Internet browsing to go through the site Internet gateway, which provides additional security over the carrier's browser.",
|
|
368
|
+
"severity": "low"
|
|
369
|
+
},
|
|
370
|
+
{
|
|
371
|
+
"id": "V-19343",
|
|
372
|
+
"title": "All Internet browsers must be disabled from the BlackBerry device except for the BlackBerry Internet browser. IT Policy rule “Allow Other Browser Services” (Services Exclusivity policy group) is set as required.\n\n",
|
|
373
|
+
"description": "Requiring the use of the BlackBerry browser forces all Internet browsing to go through the enclave web proxy. Therefore, all Internet use will be filtered and protected by enclave malware protection services. Otherwise, BlackBerry Internet browsing would make the BlackBerry handheld and the enclave more vulnerable to malware that could be downloaded from the Internet.",
|
|
374
|
+
"severity": "low"
|
|
375
|
+
},
|
|
376
|
+
{
|
|
377
|
+
"id": "V-19718",
|
|
378
|
+
"title": "IT Policy rule “Force Load Count” (Desktop-Only policy group) must be set as required. \n",
|
|
379
|
+
"description": "Required software update may not be installed, resulting in un-patched system.",
|
|
380
|
+
"severity": "low"
|
|
381
|
+
},
|
|
382
|
+
{
|
|
383
|
+
"id": "V-19719",
|
|
384
|
+
"title": "IT Policy rule “Force Load Message” (Desktop-Only policy group) must be set as required.",
|
|
385
|
+
"description": "Required software update may not be installed, resulting in un-patched system.",
|
|
386
|
+
"severity": "low"
|
|
387
|
+
},
|
|
388
|
+
{
|
|
389
|
+
"id": "V-19721",
|
|
390
|
+
"title": "IT Policy rule “Set Owner Name” (Common policy group) must be set as required.",
|
|
391
|
+
"description": "If not set correctly, BlackBerry may be identified as a DoD BlackBerry when found after being lost or stolen. This is an operational security issue.",
|
|
392
|
+
"severity": "low"
|
|
393
|
+
},
|
|
394
|
+
{
|
|
395
|
+
"id": "V-19723",
|
|
396
|
+
"title": "IT Policy rule “Keystore Password Maximum Timeout” (Security policy group) must be set as required.",
|
|
397
|
+
"description": "Encryption keys and certificates stored in the keystore may be exposed to compromise if the keystore is not locked after a set period of inactivity.",
|
|
398
|
+
"severity": "low"
|
|
399
|
+
},
|
|
400
|
+
{
|
|
401
|
+
"id": "V-19724",
|
|
402
|
+
"title": "IT Policy rule “Allow Split-Pipe connections” (Security policy group) must be set as required. \t\n",
|
|
403
|
+
"description": "BlackBerry could be at risk if an application is able to open an internal and external connection on the BlackBerry at the same time. The BlackBerry could be exposed to Malware.\n\n",
|
|
404
|
+
"severity": "medium"
|
|
405
|
+
},
|
|
406
|
+
{
|
|
407
|
+
"id": "V-19726",
|
|
408
|
+
"title": "IT Policy rule “Minimal Signing Key Store Security Level” (Security policy group) must be set as required. \t\n",
|
|
409
|
+
"description": "If not set correctly, the keystore, when encryption keys and digital certificates are stored, may not be encrypted with a strong encryption key.",
|
|
410
|
+
"severity": "low"
|
|
411
|
+
},
|
|
412
|
+
{
|
|
413
|
+
"id": "V-19727",
|
|
414
|
+
"title": "IT Policy rule “Minimal Encryption Key Store Security Level” (Security policy group) must be set as required. \n",
|
|
415
|
+
"description": "If not set correctly, the keystore, when encryption keys and digital certificates are stored, may not be encrypted with a strong encryption key.\n\n",
|
|
416
|
+
"severity": "low"
|
|
417
|
+
},
|
|
418
|
+
{
|
|
419
|
+
"id": "V-19728",
|
|
420
|
+
"title": "IT Policy rule “Force Content Protection of Master Keys” (Security policy group) must be set as required. \n",
|
|
421
|
+
"description": "Master keys (used for data encryption) will be stored on the BlackBerry in un-encrypted form and could be compromised. \n\n",
|
|
422
|
+
"severity": "medium"
|
|
423
|
+
},
|
|
424
|
+
{
|
|
425
|
+
"id": "V-19729",
|
|
426
|
+
"title": "IT Policy rule “Force LED Blinking When Microphone Is On” (Security policy group) must be set as required. \n",
|
|
427
|
+
"description": "User not aware that sensitive conversations are being recorded and/or transmitted.",
|
|
428
|
+
"severity": "low"
|
|
429
|
+
},
|
|
430
|
+
{
|
|
431
|
+
"id": "V-19731",
|
|
432
|
+
"title": "IT Policy rule “Password Required for Application Download” (Security policy group) must be set as required. \n",
|
|
433
|
+
"description": "Malware or unauthorized applications could be downloaded inadvertently by user if control not set.\n\n",
|
|
434
|
+
"severity": "low"
|
|
435
|
+
},
|
|
436
|
+
{
|
|
437
|
+
"id": "V-19733",
|
|
438
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Disable Public Photo Sharing Applications” (Security group policy) must be set as required.",
|
|
439
|
+
"description": "Public photo sharing web sites are known to be malware infested.\n\n",
|
|
440
|
+
"severity": "low"
|
|
441
|
+
},
|
|
442
|
+
{
|
|
443
|
+
"id": "V-19734",
|
|
444
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Security Transcoder Cod File Hashes” (Security policy group) must be set as required. \n",
|
|
445
|
+
"description": "Third party applications can act as transcoders and use the transcoder API and can impact the security posture of the BlackBerry. A transcoder is used to translate specific types of content into a format for transmission to a BlackBerry and can cause changes to normally secure connections between the BlackBerry and web sites. See http://blog.masabi.com/2009/01/how-do-transcoders-affect-https.html for more details.\n\n",
|
|
446
|
+
"severity": "low"
|
|
447
|
+
},
|
|
448
|
+
{
|
|
449
|
+
"id": "V-19735",
|
|
450
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Disable Public Social Networking Applications” (Security policy group) must be set as required. \n",
|
|
451
|
+
"description": "Public Social Networking Applications and sites are known to be infested with malware.",
|
|
452
|
+
"severity": "low"
|
|
453
|
+
},
|
|
454
|
+
{
|
|
455
|
+
"id": "V-19736",
|
|
456
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “TLS Restrict FIPS Ciphers” (TLS policy group) must be set as required. \n",
|
|
457
|
+
"description": "Only DoD FIPS encryption ciphers (e.g., AES) are authorized. Otherwise, the encrypted data in web connections may be susceptible to being analyzed by a hacker. \n\n",
|
|
458
|
+
"severity": "low"
|
|
459
|
+
},
|
|
460
|
+
{
|
|
461
|
+
"id": "V-19737",
|
|
462
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “WTLS Restrict FIPS Ciphers” (WTLS policy group) must be set as required. \n",
|
|
463
|
+
"description": "Only DoD FIPS encryption ciphers (e.g., AES) are authorized. Otherwise the encrypted data in web connections may be susceptible being analyzed by a hacker. ",
|
|
464
|
+
"severity": "low"
|
|
465
|
+
},
|
|
466
|
+
{
|
|
467
|
+
"id": "V-19738",
|
|
468
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Allow Application Download Services” (Browser policy group) must be set as required. ",
|
|
469
|
+
"description": "Disables and removes icons placed on the BlackBerry by carriers (e.g., Verizon Wireless, AT&T, etc.) that are used to connect to carriers’ web sites where applications are sold. Unapproved applications can cause security issues to the DoD BlackBerry system.\n\n",
|
|
470
|
+
"severity": "low"
|
|
471
|
+
},
|
|
472
|
+
{
|
|
473
|
+
"id": "V-19739",
|
|
474
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Verify BlackBerry MDS Integration Service Certificate” (BlackBerry MDS Integration Service policy group) must be set as required.",
|
|
475
|
+
"description": "Un-authenticated connection will be made between the BlackBerry and the BES MDS Integration Service, which could degrade security in the enclave.\n\n",
|
|
476
|
+
"severity": "medium"
|
|
477
|
+
},
|
|
478
|
+
{
|
|
479
|
+
"id": "V-19740",
|
|
480
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Disable Activation With Public BlackBerry MDS Integration Service” (BlackBerry MDS Integration Service policy group) must be set as required. \n",
|
|
481
|
+
"description": "User can connect to public BlackBerry MDS Integration Services to access public content, web, and application servers. These servers are not DoD approved and may contain malware that could be downloaded on a BlackBerry and transferred to the DoD enclave.",
|
|
482
|
+
"severity": "medium"
|
|
483
|
+
},
|
|
484
|
+
{
|
|
485
|
+
"id": "V-19745",
|
|
486
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Disable Application Center” (Application Center policy group) must be set as required. \n",
|
|
487
|
+
"description": "Application Center is the public BlackBerry application store where BlackBerry applications can be purchased and then downloaded on the BlackBerry. Most applications are not DoD approved and may contain malware that could be downloaded on a BlackBerry and transferred to the DoD enclave.\n\n",
|
|
488
|
+
"severity": "low"
|
|
489
|
+
},
|
|
490
|
+
{
|
|
491
|
+
"id": "V-19746",
|
|
492
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Disable Carrier Directory” (Application Center policy group) must be set as required. ",
|
|
493
|
+
"description": "Disables the carrier’s application center directory on a BlackBerry device. Application Center is the public BlackBerry application store where BlackBerry applications can be purchased and then downloaded on the BlackBerry. Most applications are not DoD approved and may contain malware that could be downloaded on a BlackBerry and transferred to the DoD enclave.\n\n",
|
|
494
|
+
"severity": "low"
|
|
495
|
+
},
|
|
496
|
+
{
|
|
497
|
+
"id": "V-19747",
|
|
498
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Desktop Allow Device Switch” (Desktop policy group) must be set as required.",
|
|
499
|
+
"description": "Stops a user from changing BlackBerry devices without the approval of the BlackBerry Administrator. BlackBerry security software (S/MIME, etc.) may not be installed correctly and other required provisioning steps may not be completed. BlackBerry device and system could be vulnerable to attack by hackers or malware.\n\n",
|
|
500
|
+
"severity": "medium"
|
|
501
|
+
},
|
|
502
|
+
{
|
|
503
|
+
"id": "V-19753",
|
|
504
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Disallow File Transfer Types” (Instant Messaging policy group) must be set as required. \n",
|
|
505
|
+
"description": "Insecure file types are transferred to BlackBerry via IM, increasing the risk of malware being downloaded on the BlackBerry and being transferred to the DoD enclave.\n\n",
|
|
506
|
+
"severity": "low"
|
|
507
|
+
},
|
|
508
|
+
{
|
|
509
|
+
"id": "V-19754",
|
|
510
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Disable BlackBerry Unite! Applications” (BlackBerry Unite! policy group) must be set as required. \n",
|
|
511
|
+
"description": "BlackBerry Unite! is a public data sharing service where groups of BlackBerry users can share photos, calendar information, and other data. This service allows other users to see sensitive DoD data stored on a DoD BlackBerry.\n\n",
|
|
512
|
+
"severity": "low"
|
|
513
|
+
},
|
|
514
|
+
{
|
|
515
|
+
"id": "V-19755",
|
|
516
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Disable Download Manager” (BlackBerry Unite! policy group) must be set as required. \n",
|
|
517
|
+
"description": "BlackBerry Unite! is a public data sharing service where groups of BlackBerry users can share photos, calendar information, and other data. This service allows other users to see sensitive DoD data stored on a DoD BlackBerry.\n\n",
|
|
518
|
+
"severity": "low"
|
|
519
|
+
},
|
|
520
|
+
{
|
|
521
|
+
"id": "V-19767",
|
|
522
|
+
"title": "BlackBerrys with removable memory cards (e.g., MicroSD) must be compliant with requirements. IT Policy rule \"External File System Encryption Level\" (Security policy group) must be set as required. ",
|
|
523
|
+
"description": "Malware could be downloaded from the memory card to the PC if not compliant. ",
|
|
524
|
+
"severity": "medium"
|
|
525
|
+
},
|
|
526
|
+
{
|
|
527
|
+
"id": "V-19775",
|
|
528
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Disable User Initiated Activation With Public BlackBerry MDS Integration Service” (BlackBerry MDS Integration Service policy group) must be set as required.",
|
|
529
|
+
"description": "Users can connect to public BlackBerry MDS Integration Services to access public content, web,\nand application servers. These servers are not DoD approved and may contain malware that\ncould be downloaded on a BlackBerry and transferred to the DoD enclave.",
|
|
530
|
+
"severity": "medium"
|
|
531
|
+
},
|
|
532
|
+
{
|
|
533
|
+
"id": "V-22047",
|
|
534
|
+
"title": "IT Policy rule “Allow BlackBerry Desktop Software Statistics” (Desktop policy group) must be set as required.",
|
|
535
|
+
"description": "This rule could allow software statistics on DoD BlackBerry devices to be automatically sent to the BlackBerry vendor, Research In Motion, which may expose OPSEC information.",
|
|
536
|
+
"severity": "low"
|
|
537
|
+
},
|
|
538
|
+
{
|
|
539
|
+
"id": "V-22048",
|
|
540
|
+
"title": "IT Policy rule “Allow Discovery by User” (MDS Integration Service policy group) must be set as required.",
|
|
541
|
+
"description": "This rule allows a user to search for and install BlackBerry MDS Runtime Applications on a BlackBerry device. This could lead to the installation of unapproved applications and possible malware.",
|
|
542
|
+
"severity": "medium"
|
|
543
|
+
},
|
|
544
|
+
{
|
|
545
|
+
"id": "V-22049",
|
|
546
|
+
"title": "IT Policy rule “Disable BlackBerry App World” (Security policy group) must be set as required.",
|
|
547
|
+
"description": "This rule allows the user to download unapproved applications from the BlackBerry application store. Some of these applications may have the capability to expose DoD sensitive information to unauthorized people or expose the BlackBerry to other attacks.",
|
|
548
|
+
"severity": "medium"
|
|
549
|
+
},
|
|
550
|
+
{
|
|
551
|
+
"id": "V-22050",
|
|
552
|
+
"title": "IT Policy rule “Encryption on On-Board Device Memory Media Files” (Security policy group) must be set as required.\n\n",
|
|
553
|
+
"description": "If a media card is inserted in the BlackBerry® device, this rule specifies whether the media files that are located in the media card are encrypted to the user password and the device-generated key. If data is not encrypted, sensitive DoD data could be exposed to unauthorized people.",
|
|
554
|
+
"severity": "medium"
|
|
555
|
+
},
|
|
556
|
+
{
|
|
557
|
+
"id": "V-22051",
|
|
558
|
+
"title": "IT Policy rule “Allow T-Mobile Mobile Backup Contact Sync” (Service Exclusivity policy group) must be set as required.",
|
|
559
|
+
"description": "This rule specifies whether T-Mobile® Mobile Backup can run on a BlackBerry® device, which permits a BlackBerry device user to synchronize only the contacts that are included in the user's MyFaves plan with the T-Mobile Mobile Backup. Use of this service may allow the storage of DoD sensitive data on a T-Mobile server and expose the data to non-DoD personnel. ",
|
|
560
|
+
"severity": "low"
|
|
561
|
+
},
|
|
562
|
+
{
|
|
563
|
+
"id": "V-22052",
|
|
564
|
+
"title": "IT Policy rule “Allow User Feedback” (User Feedback policy group) must be set as required.",
|
|
565
|
+
"description": "This rule specifies whether a user can provide feedback to Research In Motion via a system message. This capability may provide RIM OPSEC information about a DoD BlackBerry system or device.",
|
|
566
|
+
"severity": "low"
|
|
567
|
+
},
|
|
568
|
+
{
|
|
569
|
+
"id": "V-22053",
|
|
570
|
+
"title": "IT Policy rule “Disable organizer data access for social networking applications” (RIM Value-Added Applications policy group) must be set as required.",
|
|
571
|
+
"description": "This rule specifies whether a BlackBerry® device must prevent social networking applications from accessing organizer data. BlackBerry organizer (calendar, notes, and contacts) may contain sensitive DoD information that could be exposed to the public if social networking applications had access to it.",
|
|
572
|
+
"severity": "low"
|
|
573
|
+
},
|
|
574
|
+
{
|
|
575
|
+
"id": "V-25873",
|
|
576
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Disable Message Access Profile” (Bluetooth policy group) must be set as required.",
|
|
577
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.",
|
|
578
|
+
"severity": "low"
|
|
579
|
+
},
|
|
580
|
+
{
|
|
581
|
+
"id": "V-25874",
|
|
582
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Disable App World” (BlackBerry App World policy group) must be set as required. ",
|
|
583
|
+
"description": "BlackBerry App World is the public BlackBerry application store where BlackBerry applications can be purchased and then downloaded on the BlackBerry. Most applications are not DoD approved and may contain malware that could be downloaded on a BlackBerry and transferred to the DoD enclave.",
|
|
584
|
+
"severity": "medium"
|
|
585
|
+
},
|
|
586
|
+
{
|
|
587
|
+
"id": "V-25875",
|
|
588
|
+
"title": "BES IT Policy rule is configured as required. IT Policy rule “Application Restriction Rule” (BlackBerry App World policy group) will be set as required. ",
|
|
589
|
+
"description": "BlackBerry App World is the public BlackBerry application store where BlackBerry applications can be purchased and then downloaded on the BlackBerry. Most applications are not DoD approved and may contain malware that could be downloaded on a BlackBerry and transferred to the DoD enclave.",
|
|
590
|
+
"severity": "low"
|
|
591
|
+
},
|
|
592
|
+
{
|
|
593
|
+
"id": "V-25876",
|
|
594
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Category Restriction Rule” (BlackBerry App World policy group) must be set as required. ",
|
|
595
|
+
"description": "BlackBerry App World is the public BlackBerry application store where BlackBerry applications can be purchased and then downloaded on the BlackBerry. Most applications are not DoD approved and may contain malware that could be downloaded on a BlackBerry and transferred to the DoD enclave.\n\n",
|
|
596
|
+
"severity": "low"
|
|
597
|
+
},
|
|
598
|
+
{
|
|
599
|
+
"id": "V-25877",
|
|
600
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Disable Application Purchasing” (BlackBerry App World policy group) must be set as required. ",
|
|
601
|
+
"description": "BlackBerry App World is the public BlackBerry application store where BlackBerry applications can be purchased and then downloaded on the BlackBerry. Most applications are not DoD approved and may contain malware that could be downloaded on a BlackBerry and transferred to the DoD enclave.",
|
|
602
|
+
"severity": "low"
|
|
603
|
+
},
|
|
604
|
+
{
|
|
605
|
+
"id": "V-25878",
|
|
606
|
+
"title": "BES IT Policy rule must be configured as required. IT Policy rule “Content Protection Usage” (Security policy group) must be set as required.",
|
|
607
|
+
"description": "DoD 8500 policy requires data-at-rest protection be enabled on all IT devices containing sensitive data in case the device is lost or stolen. This protection normally involves password or pin protected access.",
|
|
608
|
+
"severity": "medium"
|
|
609
|
+
},
|
|
610
|
+
{
|
|
611
|
+
"id": "V-25879",
|
|
612
|
+
"title": "BES IT Policy rule is configured as required. IT Policy rule “Disable Browsing Of Remote Shared Folders” (Security policy group) must be set as required.",
|
|
613
|
+
"description": "When not configured properly, users can access data on the DoD network in shared folders without required CAC authentication to the network. ",
|
|
614
|
+
"severity": "medium"
|
|
615
|
+
},
|
|
616
|
+
{
|
|
617
|
+
"id": "V-25880",
|
|
618
|
+
"title": "BES IT Policy rule is configured as required. IT Policy rule “Disable Browsing Of Remote Shared Folders” (Security policy group) must be set as required.",
|
|
619
|
+
"description": "If not configured as specified, a user could download a non-DoD approved software update or application, which could adversely impact the security baseline of the BlackBerry system. ",
|
|
620
|
+
"severity": "low"
|
|
621
|
+
},
|
|
622
|
+
{
|
|
623
|
+
"id": "V-26507",
|
|
624
|
+
"title": "BES Bluetooth controls must be compliant with requirements. IT Policy rule “Minimum Encryption Key Length” (Bluetooth Only policy group) must be set as required.",
|
|
625
|
+
"description": "Bluetooth usage could provide an attack vector for a hacker to connect to a BlackBerry device without the knowledge of the user. DoD data would then be vulnerable.",
|
|
626
|
+
"severity": "medium"
|
|
627
|
+
},
|
|
628
|
+
{
|
|
629
|
+
"id": "V-30295",
|
|
630
|
+
"title": "BES IT Policy rule is configured as required. IT Policy rule “Application Restriction List” (BlackBerry App World policy group) must be set as required. ",
|
|
631
|
+
"description": "BlackBerry App World is the public BlackBerry application store where BlackBerry applications can be purchased and then downloaded on the BlackBerry. Most applications are not DoD approved and may contain malware that could be downloaded on a BlackBerry and transferred to the DoD enclave.",
|
|
632
|
+
"severity": "medium"
|
|
633
|
+
},
|
|
634
|
+
{
|
|
635
|
+
"id": "V-30767",
|
|
636
|
+
"title": "BES IT Policy rule is configured as required. IT Policy rule “BlackBerry Playbook Log Submission” (Companion Devices policy group) must be set as required. ",
|
|
637
|
+
"description": "Sensitive DoD information could be exposed if Playbook log information was sent to RIM.",
|
|
638
|
+
"severity": "medium"
|
|
639
|
+
},
|
|
640
|
+
{
|
|
641
|
+
"id": "V-3545",
|
|
642
|
+
"title": "BlackBerry devices must be protected by authenticated login procedures to unlock the device. Either CAC or Password authentication is required. IT Policy rule “Password Required” (Device Only policy group) must be set to “Yes” or “True”. ",
|
|
643
|
+
"description": "Authenticated device unlock is a key security control for the BlackBerry system to restrict access to DoD data by unauthorized individuals.",
|
|
644
|
+
"severity": "high"
|
|
645
|
+
}
|
|
646
|
+
]
|
|
647
|
+
}
|