The Samsung Android 7 with Knox must be configured to enforce a Container application installation policy by specifying an application whitelist that restricts applications by the following characteristics list of digital signatures, names.

From Samsung Android OS 7 with Knox 2.x Security Technical Implementation Guide

Part of PP-MDF-301090

Associated with: CCI-000366 CCI-001806

SV-91331r1_rule The Samsung Android 7 with Knox must be configured to enforce a Container application installation policy by specifying an application whitelist that restricts applications by the following characteristics list of digital signatures, names.

Vulnerability discussion

The application whitelist, in addition to controlling the installation of applications on the MD, must control user access/execution of all core and preinstalled applications or the MD must provide an alternate method of restricting user access/execution to core and pre-installed applications. Core application - any application integrated into the operating system (OS) by the OS or mobile device (MD) vendors. Pre-installed application - additional non-core applications included in the OS build by the OS vendor, MD vendor, or wireless carrier.Requiring all authorized applications to be in an application whitelist prevents the execution of any applications (e.g., unauthorized, malicious) that are not part of the whitelist. Failure to configure an application whitelist properly could allow unauthorized and malicious applications to be downloaded, installed, and executed on the mobile device, causing a compromise of DoD data accessible by these applications.The application whitelist, in addition to controlling the installation of applications on the MD, must control user access/execution of all core applications (included in the operating system (OS) by the OS vendor) and pre-installed applications (provided by the MD vendor and wireless carrier), or the MD must provide an alternate method of restricting user access/execution to core and pre-installed applications.SFR ID: FMT_SMF_EXT.1.1 #8b

Check content

Not Applicable for the COBO use case. Review Samsung Android 7 with Knox configuration settings to determine if the mobile device has been configured to whitelist application installations into the container based on one of the following characteristics: - Digital signature - Package Name Verify all applications listed on the whitelist have been approved by the Approving Official (AO). This validation procedure is performed only on the MDM Administration Console. On the MDM console, do 1 & 2 or 3 & 4: 1. Ask the MDM administrator to display the "Package Name Whitelist" in the "Android Knox Container >> Container Applications" rule. 2. Verify the whitelist includes only package names that the Authorizing Official (AO) has approved. OR 3. Ask the MDM administrator to display the "Signature Whitelist" in the "Android Knox Container >> Container Applications" rule. 4. Verify the whitelist includes only digital signatures the Authorizing Official (AO) has approved. Note: Either list may be empty if the Authorizing Official (AO) has not approved any app. Note: Refer to the Supplemental document for additional information. If the MDM console "Package Name Whitelist" or "Signature Whitelist" contains non-AO approved entries, this is a finding.

Fix text

Configure the Samsung Android 7 with Knox to whitelist application installations into the container based on one of the following characteristics: - Digital signature - Package Name Both whitelists apply to user installable applications only, and do not control user access/execution of core and preinstalled applications. To restrict user access/execution to core and pre-installed applications, the MDM administrator must configure the "application disable list”. It is important to note that if the MDM administrator has not blacklisted an application characteristic (package name, digital signature) then it is implicitly whitelisted, as whitelists are exceptions to blacklists. If an application characteristic appears in both the blacklist and whitelist, the white list (as the exception to the blacklist) takes priority, and the User will be able to install the application. Therefore, the MDM administrator must configure the blacklists to include all package names or digital signatures for whitelisting to behave as intended. On the MDM console, do one of the following: 1. Add each AO-approved package name to the "Package Name Whitelist" in the "Android Knox Container >> Container Applications" rule. OR 2. Add each AO-approved digital signature to the "Signature Whitelist" in the "Android Knox Container >> Container Applications" rule. Note: Either list may be empty if the Authorizing Official (AO) has not approved any app. Note: Refer to the Supplemental document for additional information.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer