Samsung Android must be configured to enable authentication of personal hotspot connections to the device using a preshared key. - Disallow config tethering.
An XCCDF Rule
Description
<VulnDiscussion>If no authentication is required to establish personal hotspot connections (Wi-Fi and Bluetooth), an adversary may be able to use that device to perform attacks on other devices or networks without detection. A sophisticated adversary may also be able to exploit unknown system vulnerabilities to access information and computing resources on the device. Requiring authentication to establish personal hotspot connections mitigates this risk. Application note: If hotspot functionality is permitted, it must be authenticated via a preshared key. There is no requirement to enable hotspot functionality, and it is recommended this functionality be disabled by default. SFR ID: FMT_SMF_EXT.1.1 #41</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-258641r958678_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Configure the Samsung Android devices to enable authentication of personal hotspot connections to the device using a preshared key.
On the management tool, in the device restrictions, set "Configure tethering" to "Disallow".
If the deployment requires the use of Mobile Hotspot and Tethering, Knox Platform for Enterprise (KPE) policy can be used to allow its use in a STIG-approved configuration. In this case, do not configure this policy and instead replace with KPE policy (innately by the management tool or via Knox Service Plugin [KSP]) "Allow open Wi-Fi connection" with value "Disable" and add Training Topic "Don't use Wi-Fi Sharing". (Refer to Supplemental document for additional information.)