From Microsoft Windows 10 Mobile Security Technical Implementation Guide
Part of PP-MDF-202028
Associated with: CCI-000366
It is common for mobile devices to connect directly to wireless networks that DoD does not manage, including direct Internet access through the cellular service provider. This condition leaves the device vulnerable to attacks from those networks. It also prevents DoD from monitoring or filtering network traffic to or from the mobile device. This makes it more likely that users or application processes will have the ability to perform unauthorized activities or do so without detection. For example, the enterprise may have a filtering mechanism to prevent users from accessing certain websites. Directing all device IP traffic (other than traffic needed to establish the VPN connection) through a VPN client enables the enterprise to route and handle traffic appropriately based on DoD policy and IA objectives. This requirement is also related to verifying VPN split-tunneling is not enabled.
Review Windows 10 Mobile configuration settings to determine if all IP traffic is enabled to flow through the IPsec VPN client or provide an interface to VPN applications for this purpose. This validation procedure is performed only on the MDM administration console. On the MDM administration console: Ask the MDM administrator to verify that the site-specific VPN policy on the MDM console has been configured to require the "LockDown" setting which provides an always on forced tunnel configuration. If the site-specific VPN profile on the MDM is not configured to require the VPN profile "LockDown" setting, this is a finding.
Configure the site-specific VPN profile on the MDM to require the VPN profile "LockDown". Note: A VPN profile using the LockDown configuration will become the authoritative VPN control as it mandates all traffic route through it. This overrides any other VPN profiles that are configured and only one Lockdown VPN profile should be configured.
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer