Detections
Analytics

GOOG-16-009950 - Google Android 16 must be configured to enforce a password for Wi-Fi and Bluetooth hotspot if approved for use by the authorizing official (AO). If not approved for use, Wi-Fi and Bluetooth hotspot must be disabled - AO. If not approved for use, Wi-Fi and Bluetooth hotspot must be disabled.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Wi-Fi and Bluetooth hotspot use may increase the risk for exposing sensitive DOD data for some use cases; therefore, it should be disabled unless approved by the AO. When a DOD mobile phone is used as a Wi-Fi or Bluetooth hotspot, a hotspot password must be enabled; otherwise, unauthorized devices could connect to the DOD hotspot, which may increase the risk of exposure of sensitive DOD data and/or a performance degradation of the DOD mobile phone.

SFR ID: FMT_SMF_EXT.1.1 / WLAN #3

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Disable hotspot functions on the DOD phone if not approved by the AO.

On the EMM console:

COBO:

1. Open 'Set user restrictions'.
2. Toggle 'Disallow config tethering' to 'ON'.

COPE:

1. Open 'Set user restrictions on parent'.
2. Toggle 'Disallow config tethering' to 'ON'.

If the AO has approved the use of Wi-Fi and Bluetooth hotspots, train the user to not change the default hotspot password (refer to GOOG-16-009800). By default, when Wi-Fi Hotspot is enabled, a 15-character complex password is automatically configured for the hotspot.

Configuration API: DISALLOW_CONFIG_TETHERING

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Google_Android_16_Y26M04_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000366, Rule-ID|SV-276771r1140105_rule, STIG-ID|GOOG-16-009950, Vuln-ID|V-276771

Plugin: MDM

Control ID: f57a767bad7422a41ce85b001d6256eca536e0791d390a2ed6430cc41a3ccef6