AirWatch MDM STIG

Version: 1

Updated: 30 Nov 2018

Findings: 29

Findings

V-47299 - The AirWatch MDM Server must implement separation of administrator duties by requiring a specific role be assigned to each administrator account. (high)
V-47301 - If the AirWatch MDM Server includes a mobile email management capability, the email client must either block or convert all active content in email (HTML, RTF, etc.) to text before the email is forwarded to the mobile device. (low)
V-47303 - The AirWatch MDM Server must support the transfer of audit logs to remote log or management servers. (medium)
V-47307 - The AirWatch MDM Server must utilize the integration of audit review, analysis, and reporting processes by an organizations central audit management system to support organizational processes for investigation and response to suspicious activities. (low)
V-47309 - The AirWatch MDM Server must centralize the review and analysis of audit records from multiple components within the server. (medium)
V-47313 - The AirWatch MDM Server must automatically process audit records for events of interest based upon selectable, event criteria. (low)
V-47317 - The AirWatch MDM Server must be capable of scanning the hardware version of managed mobile devices and alert if unsupported versions are found. (medium)
V-47319 - The AirWatch MDM Server must configure the mobile device to prohibit the mobile device user from installing unapproved applications. (medium)
V-47321 - The AirWatch MDM Server must configure the mobile device to prohibit the mobile device user from installing unapproved applications. (medium)
V-47325 - The AirWatch MDM Server must configure the mobile device agent to prohibit the download of software from a DoD non-approved source (e.g., DoD operated mobile device application store or AirWatch MDM Server). (medium)
V-47327 - The AirWatch MDM Server must configure the mobile device agent to prohibit the download of software from a DoD non-approved source (e.g., DoD operated mobile device application store or AirWatch MDM Server). (medium)
V-47329 - The AirWatch MDM Server must configure the mobile device agent to prohibit the download of software from a DoD non-approved source (e.g., DoD operated mobile device application store or AirWatch MDM Server). (medium)
V-47331 - The AirWatch MDM Server must provide the administrative functionality to specify a list of approved applications that must be installed on the mobile device and cannot be removed by the user. (medium)
V-47333 - The AirWatch MDM Server must provide the administrative functionality to specify a list of approved applications that must be installed on the mobile device and cannot be removed by the user. (medium)
V-47335 - The AirWatch MDM Server must be able to detect if the security policy has been modified, disabled, or bypassed on managed mobile devices. (high)
V-47337 - The AirWatch MDM Server must employ automated mechanisms to respond to unauthorized changes to the security policy or AirWatch MDM Server agent on managed mobile devices. (medium)
V-47339 - The AirWatch MDM Server must uniquely identify mobile devices managed by the server prior to connecting to the device. (medium)
V-47341 - The AirWatch MDM Server device integrity validation component must employ automated mechanisms to detect the presence of unauthorized software on managed mobile devices and notify designated organizational officials in accordance with the organization-defined frequency. (medium)
V-47343 - The AirWatch MDM Server must terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity. (medium)
V-47345 - The AirWatch MDM Server must ensure authentication of both mobile device AirWatch MDM Server agent and server during the entire session. (medium)
V-47347 - The AirWatch MDM Server must notify when it detects unauthorized changes to security configuration of managed mobile devices. (medium)
V-47349 - The AirWatch MDM Server must perform required actions when a security related alert is received. (high)
V-47351 - The AirWatch MDM Server device integrity validation component must include the capability to notify an organization-defined list of response personnel who are identified by name and/or by role notifications of suspicious events. (medium)
V-47353 - The AirWatch MDM Server device integrity validation component must use automated mechanisms to alert security personnel when the device has been jailbroken or rooted. (high)
V-47355 - The AirWatch MDM Server device integrity validation component must identify the affected mobile device, severity of the finding, and provide a recommended mitigation. (high)
V-47357 - The AirWatch MDM Server device integrity validation component must base recommended mitigations for findings on the identified risk level of the finding. (medium)
V-47359 - The AirWatch MDM Server must back up audit records on an organization-defined frequency onto a different system or media than the system being audited. (medium)
V-48041 - The AirWatch MDM Server must record an event in the audit log each time the server makes a security relevant configuration change on a managed mobile device. (medium)
V-63317 - AirWatch MDM server versions that are no longer supported by the vendor for security updates must not be installed on a system. (high)