← Back to Samsung Android OS 14 with Knox 3.x COBO Security Technical Implementation Guide

V-258656

CAT II (Medium)

The Samsung Android device must be configured to enable Certificate Revocation List (CRL) status checking.

Rule ID

SV-258656r959010_rule

STIG

Samsung Android OS 14 with Knox 3.x COBO Security Technical Implementation Guide

Version

V2R4

CCIs

CCI-000366

Discussion

A CRL allows a certificate issuer to revoke a certificate for any reason, including improperly issued certificates and compromise of the private keys. Checking the revocation status of the certificate mitigates the risk associated with using a compromised certificate. For this reason, users must not be able to disable this configuration. SFR ID: FMT_MOF_EXT.1.2 #47

Check Content

Review the configuration to confirm that revocation checking is enabled. Verify the revocation checklist is set to "All Applications".
 
This procedure is performed on the management tool. 

On the management tool:
1. Open "Certificates Policy >> Revocation" section.
2. Select "Get CRL".
3. Verify Toast message "Get revocation check: true".

If on the management tool the revocation check is disabled, this is a finding.

Fix Text

Configure the Samsung Android devices to enable CRL revocation checks for all applications. These revocation checks must be enabled using the Knox KPE APIs.

On the management tool, in the Certificate Policy restrictions, enable "Revocation Checks" for "All Applications".