Google Android 13 BYOAD Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
PP-MDF-333080
Group -
Google Android 13 must be configured to not display the following (work profile) notifications when the device is locked: [selection: a. email notifications b. calendar appointments c. contact associated with phone call notification d. text message notification e. other application-based notifications f. all notifications].
Many mobile devices display notifications on the lock screen so that users can obtain relevant information in a timely manner without having to frequently unlock the phone to determine if there are...Rule Medium Severity -
PP-MDF-333110
Group -
Google Android 13 must be configured to disable trust agents.
Trust agents allow a user to unlock a mobile device without entering a passcode when the mobile device is, for example, connected to a user-selected Bluetooth device or in a user-selected location....Rule Medium Severity -
PP-MDF-333160
Group -
Google Android 13 must be configured to display the DOD advisory warning message at startup or each time the user unlocks the Work Profile.
Before granting access to the system, the mobile operating system is required to display the DOD-approved system use notification message or banner that provides privacy and security notices consis...Rule Low Severity -
PP-MDF-333250
Group -
The Google Android 13 must allow only the administrator (EMM) to install/remove DOD root and intermediate PKI certificates (work profile).
DOD root and intermediate PKI certificates are used to verify the authenticity of PKI certificates of users and web services. If the user is allowed to remove root and intermediate certificates, th...Rule Medium Severity -
PP-MDF-333280
Group -
PP-MDF-993300
Group -
Google Android 13 users must complete required training.
The security posture of Google devices requires the device user to configure several required policy rules on their device. User-Based Enforcement (UBE) is required for these controls. In addition,...Rule Medium Severity -
PP-MDF-993300
Group -
Google Android 13 must have the DOD root and intermediate PKI certificates installed (work profile only).
DOD root and intermediate PKI certificates are used to verify the authenticity of PKI certificates of users and web services. If the root and intermediate certificates are not available, an adversa...Rule Medium Severity -
PP-MDF-993300
Group -
The Google Android 13 work profile must be configured to prevent users from adding personal email accounts to the work email app.
If the user can add a personal email account (POP3, IMAP, EAS) to the work email app, it could be used to forward sensitive DOD data to unauthorized recipients. Restricting email account addition t...Rule Medium Severity -
PP-MDF-993300
Group -
PP-MDF-993300
Group -
Google Android 13 must be provisioned as a BYOAD device (Android work profile for employee-owned devices [BYOD]).
The Android work profile for employee-owned devices (BYOD) is the designated application group for the BYOAD use case. SFR ID: FMT_SMF_EXT.1.1 #47Rule Medium Severity -
PP-MDF-993300
Group -
The Google Android 13 work profile must be configured to disable automatic completion of workspace internet browser text input.
The autofill functionality in the web browser allows the user to complete a form that contains sensitive information, such as personally identifiable information (PII), without previous knowledge o...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.