Detections
Analytics
GOOG-16-008700 - Google Android 16 must be configured to enable authentication of personal hotspot connections to the device using a preshared key.
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
If no authentication is required to establish personal hotspot connections (Wi-Fi and Bluetooth), an adversary may be able to use that device to perform attacks on other devices or networks without detection. A sophisticated adversary may also be able to exploit unknown system vulnerabilities to access information and computing resources on the device. Requiring authentication to establish personal hotspot connections mitigates this risk.Application note: If hotspot functionality is permitted, it must be authenticated via a preshared key. There is no requirement to enable hotspot functionality, and it is recommended this functionality be disabled by default.
SFR ID: FMT_SMF.1.1 #41
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
This is a UBE control.Train users to not change the default Wi-Fi hotspot security setting: 15-character complex Wi-Fi hotspot preshared key (password) ('WPA2/WPA3-Personal' or WPA3-Personal'). (GOOG-16-009800)
If the required preshared key is not set up, train users to use the following procedure to configure the required setting:
1. Go to Settings >> Network & Internet >> Hotspot & tethering.
2. Enable 'Wi-Fi hotspot'.
3. On the left of the slide, tap on 'Wi-Fi Hotspot' to bring up the configuration options.
4. Click on the 'Security' link and select either 'WPA2/WPA3-Personal' or 'WPA3-Personal'.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Google_Android_16_Y26M04_STIG.zip
Item Details
Audit Name: AirWatch - DISA Google Android 16 COPE STIG v1r2
References: CAT|II, CCI|CCI-001443, CCI|CCI-002314, Rule-ID|SV-276867r1140393_rule, STIG-ID|GOOG-16-008700, Vuln-ID|V-276867
Plugin: MDM
Control ID: 39bf80beca05a635da851230e007c3161bca45378c44b3fbde14451d9e8aa7ec