← Back to Samsung Android OS 15 with Knox 3.x COPE Security Technical Implementation Guide

V-268981

CAT III (Low)

Samsung Android must not accept the certificate when it cannot establish a connection to determine the validity of a certificate.

Rule ID

SV-268981r1036039_rule

STIG

Samsung Android OS 15 with Knox 3.x COPE Security Technical Implementation Guide

Version

V1R3

CCIs

CCI-000185

Discussion

Certificate-based security controls depend on the ability of the system to verify the validity of a certificate. If the MOS were to accept an invalid certificate, it could take unauthorized actions, resulting in unanticipated outcomes. At the same time, if the MOS were to disable functionality when it could not determine the validity of the certificate, this could result in a denial of service. Therefore, the ability to provide exceptions is appropriate to balance the tradeoff between security and functionality. Always accepting certificates when they cannot be determined to be valid is the most extreme exception policy and is not appropriate in the DOD context. Involving an Administrator or user in the exception decision mitigates this risk to some degree. SFRID: FIA_X509_EXT.2.2

Check Content

Verify requirement KNOX-15-009300 (Common Criteria mode) has been implemented.

If "Common Criteria mode" has not been implemented, this is a finding.

Fix Text

Implement "Common Criteria mode". Refer to requirement KNOX-15-009300.