Develop policy that states CMD software updates must only originate from DoD approved sources.

From Mobile Policy Security Requirements Guide

Associated with: CCI-000083

SV-47297r1_rule Develop policy that states CMD software updates must only originate from DoD approved sources.

Vulnerability discussion

Users must not accept over-the-air (OTA) wireless software updates from the wireless carrier or other non-DoD sources unless the updates have been tested and DoD approved. Unauthorized/unapproved software updates could include malware or cause a degradation of the security posture of the CMD and DoD network infrastructure. All software updates should be reviewed and/or tested by the CMD system administrator and originate from an approved DoD source. Wireless software updates should be pushed from the CMD management server, when this feature is available.Otherwise, the site administrator should verify the non-DoD source of the update has been approved by IT management.

Check content

Review the site's procedure/policy on software updates for CMDs and ensure it includes a requirement for updates to be obtained from a DoD approved source. Verify the site CMD handheld administrator and the CMD management server administrator are aware of the requirement. Determine what procedures are used at the site for installing software updates on site-managed CMDs. If the site does not have procedures in place for users to down-load software updates from only a DoD approved source, this is a finding.

Fix text

Develop policy requiring CMD software updates originate from DoD approved sources.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.