The Samsung Android device must be configured to enable Certificate Revocation List (CRL) status checking.
An XCCDF Rule
Description
<VulnDiscussion>A CRL allows a certificate issuer to revoke a certificate for any reason, including improperly issued certificates and compromise of the private keys. Checking the revocation status of the certificate mitigates the risk associated with using a compromised certificate. For this reason, users must not be able to disable this configuration. Samsung Android can control CRL checking but only using Knox APIs. Alternatively, CRL checking is based on app development best practice. SFR ID: FMT_MOF_EXT.1.2 #47</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-260459r950956_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Configure the Samsung Android devices to enable CRL revocation checks for all applications. These revocation checks must be enabled using the Knox KPE APIs.
On the management tool, in the Certificate Policy restrictions, enable "Revocation Checks" for "All Applications".