Security Configuration Benchmark

CIS Google Android 2.3 Benchmark

v1.1.0

Export Date 06-28-2012

The CIS Security Benchmarks division provides consensus-oriented information security products, services, tools, metrics, suggestions, and
recommendations (the “SB Products”) as a public service to Internet users worldwide. Downloading or using SB Products in any way signifies and
confirms your acceptance of and your binding agreement to these CIS Security Benchmarks Terms of Use.

CIS SECURITY BENCHMARKS TERMS OF USE

BOTH CIS SECURITY BENCHMARKS DIVISION MEMBERS AND NON-MEMBERS MAY:

Download, install, and use each of the SB Products on a single computer, and/or
Print one or more copies of any SB Product that is in a .txt, .pdf, .doc, .mcw, or .rtf format, but only if each such copy is printed
in its entirety and is kept intact, including without limitation the text of these CIS Security Benchmarks Terms of Use.

UNDER THE FOLLOWING TERMS AND CONDITIONS:

SB Products Provided As Is. CIS is providing the SB Products “as is” and “as available” without: (1) any representations, warranties, or
covenants of any kind whatsoever (including the absence of any warranty regarding: (a) the effect or lack of effect of any SB Product on the
operation or the security of any network, system, software, hardware, or any component of any of them, and (b) the accuracy, utility,
reliability, timeliness, or completeness of any SB Product); or (2) the responsibility to make or notify you of any corrections, updates,
upgrades, or fixes.
Intellectual Property and Rights Reserved. You are not acquiring any title or ownership rights in or to any SB Product, and full title and
all ownership rights to the SB Products remain the exclusive property of CIS. All rights to the SB Products not expressly granted in these
Terms of Use are hereby reserved.
Restrictions. You acknowledge and agree that you may not: (1) decompile, dis-assemble, alter, reverse engineer, or otherwise attempt
to derive the source code for any software SB Product that is not already in the form of source code; (2) distribute, redistribute, sell, rent,
lease, sublicense or otherwise transfer or exploit any rights to any SB Product in any way or for any purpose; (3) post any SB Product on any
website, bulletin board, ftp server, newsgroup, or other similar mechanism or device; (4) remove from or alter these CIS
Security Benchmarks Terms of Use on any SB Product; (5) remove or alter any proprietary notices on any SB Product; (6) use any SB
Product or any component of an SB Product with any derivative works based directly on an SB Product or any component of an SB Product;
(7) use any SB Product or any component of an SB Product with other products or applications that are directly and specifically dependent on
such SB Product or any component for any part of their functionality; (8) represent or claim a particular level of compliance or consistency
with any SB Product; or (9) facilitate or otherwise aid other individuals or entities in violating these CIS Security Benchmarks Terms of Use.
Your Responsibility to Evaluate Risks. You acknowledge and agree that: (1) no network, system, device, hardware, software, or
component can be made fully secure; (2) you have the sole responsibility to evaluate the risks and benefits of the SB Products to your
particular circumstances and requirements; and (3) CIS is not assuming any of the liabilities associated with your use of any or all of the SB
Products.
CIS Liability. You acknowledge and agree that neither CIS nor any of its employees, officers, directors, agents or other service providers
has or will have any liability to you whatsoever (whether based in contract, tort, strict liability or otherwise) for any direct, indirect,
incidental, consequential, or special damages that arise out of or are connected in any way with your use of any SB Product.
Indemnification. You agree to indemnify, defend, and hold CIS and all of CIS's employees, officers, directors, agents and other service
providers harmless from and against any liabilities, costs and expenses incurred by any of them in connection with your violation of these CIS
Security Benchmarks Terms of Use.
Jurisdiction. You acknowledge and agree that: (1) these CIS Security Benchmarks Terms of Use will be governed by and construed in
accordance with the laws of the State of Maryland; (2) any action at law or in equity arising out of or relating to these CIS Security
Benchmarks Terms of Use shall be filed only in the courts located in the State of Maryland; and (3) you hereby consent and submit to the
personal jurisdiction of such courts for the purposes of litigating any such action.
U.S. Export Control and Sanctions laws. Regarding your use of the SB Products with any non-U.S. entity or country, you acknowledge
that it is your responsibility to understand and abide by all U.S. sanctions and export control laws as set from time to time by the U.S. Bureau
of Industry and Security (BIS) and the U.S. Office of Foreign Assets Control (OFAC).

SPECIAL RULES FOR CIS MEMBER ORGANIZATIONS: CIS reserves the right to create special rules for: (1) CIS Members; and (2) Non-Member
organizations and individuals with which CIS has a written contractual relationship. CIS hereby grants to each CIS Member Organization in good
standing the right to distribute the SB Products within such Member’s own organization, whether by manual or electronic means. Each such

1|Page
Member Organization acknowledges and agrees that the foregoing grants in this paragraph are subject to the terms of such Member’s
membership arrangement with CIS and may, therefore, be modified or terminated by CIS at any time.

2|Page
Table of Contents
Overview .......................................................................................................................................................
4
Recommendations ........................................................................................................................................
8 1 Settings in the Android User Interface
................................................................................................... 8
1.1 System Settings ................................................................................................................................... 8
1.1.1 Update firmware to latest version (Not Scored) .........................................................................
8
1.1.2 Require Password on Device (Not Scored) ..................................................................................
9
1.1.3 Configure an alphanumeric value (Not Scored) ...........................................................................
9
1.1.4 Set Screen timeout (Not Scored) ..............................................................................................
10
1.1.5 Erase data upon excessive password failures (Not Scored) ......................................................
11
1.1.6 Forget Wi-Fi networks to prevent automatic rejoin (Not Scored) ............................................
11
1.1.7 Turn off Network Notification (Not Scored) .............................................................................
12
1.1.8 Turn off Auto-Join for all Wi-Fi networks (Not Scored) ............................................................
13
1.1.9 Turn off Wi-Fi when not needed (Not Scored)..........................................................................
13
1.1.10 Turn off VPN when not needed (Not Scored) ..........................................................................
14
1.1.11 Turn off Bluetooth when not needed (Not Scored) ................................................................
15
1.1.12 Turn off Location Services (Not Scored) ..................................................................................
15
1.1.13 Turn on Airplane Mode (Not Scored) ......................................................................................
17
1.1.14 Erase all data before return, recycle, reassignment, or other disposition (Not Scored) .........
18

3|Page
 1.1.15 Disable SMS preview when Android is locked (Not Scored) ...................................................
18
1.1.16 Set up SIM card lock (Not Scored) ..........................................................................................
19
1.1.17 Disable visible passwords (Not Scored) ..................................................................................
20
1.1.18 Encrypt credentials storage (Not Scored) ................................................................................
21
1.1.19 Disable development features (Not Scored) ...........................................................................
22
1.1.20 Disallow application installs from unknown source (Not Scored) ..........................................
23
1.2 Browser Settings ............................................................................................................................... 24
1.2.1 Disable JavaScript (Not Scored) .................................................................................................
24
1.2.2 Enable basic SSL checks for websites (Not Scored)...................................................................
25
1.2.3 Disable Remember Form Data (Not Scored) .............................................................................
26
2 Settings in Android’s Software Development Kit (SDK) ....................................................................... 27
3 Android Mobile Device Settings in MS Exchange ActiveSync Policy .................................................... 27
3.1 Password Settings .............................................................................................................................
28
3.1.1 Require password on device (Scored)
........................................................................................ 28
3.1.2 Require alphanumeric value (Scored)
....................................................................................... 30
3.1.3 Set minimum password length (Scored)
................................................................................... 32
3.1.4 Set a minimum number of complex characters (Scored)
......................................................... 34
3.1.5 Set auto-lock timeout (Scored)
................................................................................................. 34
3.1.6 Erase data upon excessive password failures
(Scored)............................................................. 36 4: Additional
Information........................................................................................................................ 39

4|Page
 4.1: References ......................................................................................................................................
39
4.2 Change History ..................................................................................................................................
39
4.3: Additional Security Notes ...............................................................................................................
39
4.3.1 Set maximum password age (Informational) (Not Scored) .......................................................
40
4.3.2 Set password history (Informational) (Not Scored) ...................................................................
40
4.3.3 General sync settings (Informational) (Not Scored) ..................................................................
40
4.4: Additional Information for Exchange ActiveSync Management ......................................................
41
4.4.1 General ActiveSync Settings...........................................................................................................
42
4.4.1.1 Disallow non-provisionable devices (Scored) ........................................................................
42 4.4.2 General Resources for Android Mobile Device ActiveSync Management
..................................... 44

Overview
This is the archive of the Google Android 2.3 Benchmark v1.1.0. CIS encourages you to
migrate to a more recent, supported version of this technology.
This document, CIS Google Android 2.3 Benchmark v1.1.0 provides prescriptive guidance for
establishing a secure configuration posture for the Android 2.3 OS. This guide was tested against
the Android 2.3 and the Android Virtual Device (AVD) contained in version 2.3.3 of the Android
Software Development Kit (SDK). This benchmark covers Android 2.3 and all hardware devices
on which this OS is supported. As of the publication of this guidance, mobile devices supported
by Android 2.3 include the following:

HTC: the Incredible S, Google Nexus 1, Sensation 4G

Motorola: Droid X, Droid 3, Galaxy S ii
Archos: 7C Home Tablet
Vizio: Tablet

5|Page
In determining recommendations, the current guidance treats all Android mobile device
platforms as having the same use cases and risk/threat scenarios. In all but a very few cases,
configuration steps, default settings, and benchmark recommended settings are identical
regardless of hardware platform. To obtain the latest version of this guide, please visit
http://cisecurity.org. If you have questions, comments, or have identified ways to improve this
guide, please write us at feedback@cisecurity.org.

Considerations

The settings recommended in this benchmark are those available through configuration of the
device either directly through its local interface, through manufacturer-provided external
configuration tools, and through configuration capabilities provided by Exchange ActiveSync
mailbox policies. In considering the recommendations made in this benchmark, the device was
considered both as a target itself and as a method of accessing other resources. These
benchmark settings provide certain protections from remote attacks against the device and
from unauthorized device access in the event the device is lost.

The recommendations do not assert sufficient protections against advanced local attacks to
gain device access or data recovery that may be possible in the event a device is lost. They also
do not discuss custom ROMs or 3rd-party features such as virus or root-kit detection. Loss of
Physical Custody of an Android and Compensating Controls

The combined “Set up screen lock,” “Set up SIM card lock,” and “Set a password for secure
credential storage “recommendations in the Level I and Level II Benchmark profiles provide a
basic level of protection against unauthorized device and data access in the event of a lost
device.

Certain non-configuration controls are available through 3rd-party tools and should be
considered.

A remote wipe feature can be activated as a compensating corrective control for Android 2.3
devices, available through the following mechanisms:
Exchange ActiveSync Mobile Administration Web Tool (MS Exchange Server 2003 and MS
Exchange Server 2007)
Exchange Management Console (MS Exchange Server 2007)
Third-party encryption apps are available to protect the confidentiality of data for advanced
applications and should be considered where advanced protections are required. User-level
configuration was introduced in Android 3.0 (Honeycomb).

Organizational policies and education/awareness programs to ensure device owners know to

notify the appropriate channels in a timely manner for incident response, including the

6|Page
activation of remote wipe and related actions, are important to effectively realize the benefits
the remote action features can provide.

For more information about Microsoft Exchange Information Services and security policies
supported by Android 2.3, see:
http://www.google.com/help/hc/pdfs/mobile/ExchangeAndAndroid2.2and2.3-003.pdf

Consensus Guidance
This benchmark was created using a consensus review process comprised of volunteer and
contract subject matter experts. Consensus participants provide perspective from a diverse set
of backgrounds including consulting, software development, audit and compliance, security
research, operations, government, and legal.

Each CIS benchmark undergoes two phases of consensus review. The first phase occurs during
initial benchmark development. During this phase, subject matter experts convene to discuss,
create, and test working drafts of the benchmark. This discussion occurs until consensus has
been reached on benchmark recommendations. The second phase begins after the benchmark
has been released to the public Internet. During this phase, all feedback provided by the
Internet community is reviewed by the consensus team for incorporation in the benchmark. If
you are interested in participating in the consensus review process, please send us a note to
feedback@cisecurity.org.

Typographical Conventions
The following typographical conventions are used throughout this guide:
Convention Meaning
Stylized Monospace font Used for blocks of code, command, and script examples. Text
should be interpreted exactly as presented.

Monospace font Used for inline code, commands, or examples. Text should be
interpreted exactly as presented.
<italic font in brackets> Italic texts set in angle brackets denote a variable requiring
substitution for a real value.
Italic font Used to denote the title of a book, article, or other
publication.
Note Additional information or caveats

7|Page
Scoring Information
A scoring status indicates whether compliance with the given recommendation impacts the
assessed target's benchmark score. The following scoring statuses are used in this benchmark:

Scored
Failure to comply with "Scored" recommendations will decrease the final benchmark score.
Compliance with "Scored" recommendations will increase the final benchmark score.

Not Scored
Failure to comply with "Not Scored" recommendations will not decrease the final benchmark
score. Compliance with "Not Scored" recommendations will not increase the final benchmark
score.

Profile Definitions
The following configuration profiles are defined by this Benchmark:

Level 1: Basic Recommendations

Level 2: Recommendations that provide security benefit, but may be problematic

Acknowledgements
This benchmark exemplifies the great things a community of users, vendors, and subject matter
experts can accomplish through consensus collaboration. The CIS community thanks the entire
consensus team with special recognition to the following individuals who contributed greatly to
the creation of this guide:

Author / Maintainer: Robert Fritz, CISSP CSSLP Contributors

and Reviewers:
Molly Maguire
Blake Frantz, Center for Internet Security
Steven Piliero, Center for Internet Security
Billy Glenn, Pacific Gas & Electric
Yves Desharnais
Fernando Trias, Athigo
John Fox, Athigo

8|Page
Recommendations
1 Settings in the Android User Interface
This section provides guidance on the secure configuration of Android 2.3 mobile devices using
the device user interface.

1.1 System Settings

This section provides guidance on the secure configuration of system settings.

Profile Applicability:

Level 1
Level 2

Description:

An Android 2.3 mobile device ships with whichever version of the firmware was current when it
was manufactured, but updates may have been released since then. It is recommended that the
device firmware remain current.

Rationale:

Firmware updates include not only new features and bug fixes but security fixes as well . Also,
the device must be running build version 2.3.3, with kernel version 2.6.29 for these benchmark
recommendations to apply; if a newer version of the firmware is available, some
recommendations may not apply.

Audit:

1. Press the Menu button.

2. Tap Settings.
3. Tap About Phone.
4. Confirm that Build number contains 2.3.3 or later, and Kernel version contains 2.6.29 or later.

Remediation:

Contact your telecommunications provider for their latest supported update.

Profile Applicability:
9|Page
 Level 1
Level 2

Description:

Android 2.3 can be configured to require a password before allowing usage via the touch
screen. By default, a password is not required to unlock the screen. It is recommended that a
password be set. This setting is the same as the setting in Section 3.1.1.

Rationale:

In the event of a physical security incident, a password will not guarantee data integrity, but it
will raise the bar of effort required to compromise the device.

Audit:

1. Press the Menu button.

2. Tap Settings.
3. Tap Location & Security.
4. Tap Change screen lock.
5. Verify that “Change screen lock” is an option under the “Screen unlock” section.

Remediation:

1. Press the Menu button.

2. Tap Settings.
3. Tap Location & Security.
4. Tap Set up screen lock.
5. Tap Password.
6. Tap in a complex password. (See reference below) 7. Tap in the same complex password.

Profile Applicability:

Level 2

Description:

See 1.1.2 above. Also note this setting can be enforced in setting in Section 3.1.2

10 | P a g e
Profile Applicability:

Level 1
Level 2

Description:

An Android2.3 device’s screen can be configured to timeout after a pre-defined inactivity

period. By default, if a password is defined, the device will automatically lock. It is
recommended that an inactivity timeout be set.

Rationale:

If the user has set a screen timeout interval of greater than two minutes, there is a greater risk
that the device will be in an unlocked state during a physical security breach.

Audit:

1. Press the Menu button.

2. Tap Settings.
3. Tap Display.
4. Tap Screen timeout.

4a. For typical use cases, confirm that Screen timeout is set to 2 minutes.

4b. For high-security use cases, confirm that Screen timeout is set to 1 minute.

Remediation:

1. Press the Menu button.

2. Tap Settings.
3. Tap Display.
4. Tap Screen timeout.

4a. For typical use cases, tap “2 Minutes”.

4b. For high-security use cases, tap “1 Minute”.

Profile Applicability:

Level 1
Level 2

Description:

11 | P a g e
This feature is not available in Android 2.3. This setting can be controlled using Exchange. See
3.1.6.

-
Profile Applicability:

Level 2

Description:

An Android 2.3 device can be configured to forget Wi-Fi networks that it has previously
associated with. By default, a device will remember and automatically join networks that it has
previously associated with. It is recommended that networks be forgotten after use in use cases
where security is paramount.

Rationale:

A trusted but unauthenticated Wi-Fi network may be spoofed and automatically joined if it is
not forgotten after last use. Additionally, if such a network has a common SSID, such as
“default” or “Linksys,” it is probable that the Android will encounter an untrusted instance of a
same-named Wi-Fi network and automatically join it. During test, a 2.1 device did not
automatically rejoin an unauthenticated network with the same SSID as a previously-stored
authenticated network. However, this behavior should not be assumed.

Audit:

1. Press the Menu button.

2. Tap Settings.
3. Tap Wireless & network settings.
4. Tap Wi-Fi settings.
5. Confirm that all deleted Wi-Fi networks are forgotten.

Remediation:

1. Press the Menu button.

2. Tap Settings.
3. Tap Wireless & network settings.
4. Tap Wi-Fi settings.

12 | P a g e
 5. In the Wi-Fi network section, locate the network SSID and tap and hold down the entry for the
network you wish to forget.
6. Tap “Forget” in the confirmation dialog.

Note: Wi-Fi must be turned onto see the list of available networks to configure. The Wi-Fi
network must be remembered or currently connected to “Forget” a network.

Profile Applicability:

Level 2

Description:

When the user is trying to access the Internet, by using the built-in browser for example, and
the user is not in range of a Wi-Fi network the user has previously used, this option tells the
device to look for another network. When selected and a new network is available, an icon will
appear on the status bar, which in turn makes available a list of available networks from which
the user can choose. If “Network notification” is turned off, the user must manually search for a
network to connect to the Internet when a previously used network or a cellular data network
is not available. It is recommended that this capability be disabled in environments where
security is paramount.

Rationale:

Requiring the user to manually configure and join a Wi-Fi network reduces the risk of
inadvertently joining a similarly named yet untrusted network (i.e. “default” vs. “defualt”).

Audit:

1. Press the Menu button.

2. Tap Settings.
3. Tap Wi-Fi Settings.
4. Confirm that “Network notification” is unchecked.

Remediation:

13 | P a g e
 1. Press the Menu button.
2. Tap Settings.
3. Tap Wi-Fi Settings.
4. Turn off “Network notification.”

Note: Wi-Fi must be turned on for the above Wi-Fi configuration option to appear.

- -
Profile Applicability:

Level 1
Level 2

Description:

Android 2.3 does not automatically join new networks. These settings are listed here for
completeness because they are included in the CIS Benchmark for iOS and may be covered in
future Android versions.

-
Profile Applicability:

Level 2

Description:

Android 2.3 devices can be configured to participate in Wi-Fi networks. It is recommended that
Wi-Fi be disabled when not needed or where security is paramount.

If Wi-Fi is turned off on a device with cellular data service, connections to the Internet will occur
via the cellular data network, when available. Applications such as the built-in Android browser,
Gmail, Google Voice, Maps, News & Weather, and the Android Market can be run over a cellular
data network connection, but there may be a limit on the maximum download size of items for
certain apps.

Rationale:
14 | P a g e
Disabling the Wi-Fi interface reduces the remote attack surface of the device. Additionally, at
present, the cellular data network is a more difficult medium to sniff than Wi-Fi.

Audit:

1. Press the Menu button.

2. Tap Settings.
3. Tap Wireless & networks.
4. Confirm that Wi-Fi is unchecked.

Remediation:

1. Press the Menu button.

2. Tap Settings.
3. Tap Wireless & networks.
4. Tap Wi-Fi if box is checked.

Profile Applicability:

Level 1
Level 2

Description:

Not applicable. Android 2.3 devices do not automatically connect to VPNs. These settings are
listed here for completeness because they are included in the CIS Benchmark for iOS and may
be covered in future Android versions.

Profile Applicability:

Level 1
Level 2

Description:

15 | P a g e
Bluetooth allows devices to connect wirelessly to headsets, car kits, and other accessories for
various Bluetooth profile functionality. It is recommended that Bluetooth be disabled when not
in use.

Rationale:

If the user does not need Bluetooth enabled, it should be disabled to prevent discovery of and
connection to supported Bluetooth services.

Audit:

1. Press the Menu button.

2. Tap Settings.
3. Tap Wireless & networks.
4. Confirm that Bluetooth is unchecked.

Remediation:

1. Press the Menu button.

2. Tap Settings.
3. Tap Wireless & networks.
4. Tap Bluetooth if option is checked.

Profile Applicability:

Level 2
Description:

Location Services allows applications such as Maps and Internet websitesto gather and use data
indicating the user’s location. The user’s approximate location is determined using available
information from cellular network data, local Wi-Fi networks (if the user has Wi-Fi turned on),
and GPS as available. If the user turns off Location Services, the user will be prompted to turn it
back on again the next time an application tries to use this feature. It is recommended that
location services be disabled in environments where security is paramount.

16 | P a g e
Rationale:

Android 2.3 enables the user to enable or deny Internet websites to access to location services.
In addition, any application in Android 2.3 may send location data if location data is available to
the phone itself.

Audit:

1. Tap the globe Browser icon.

2. Press the Menu button.
3. Tap More.
4. Tap Settings.
5. Confirm that “Enable location” is unchecked.
6. Tap Home.
7. Press the Menu button.
8. Tap Location & security.
9. Scroll down to “Security Settings.”
10. Confirm that "Use wireless networks" and "Use GPS satellites" are unchecked.

Remediation:

1. Tap the globe Browser icon.

2. Press the Menu button.
3. Tap More.
4. Tap Settings.
5. Scroll down and uncheck “Enable location.” 6. Tap Home.
7. Press the Menu button.
8. Tap Location & security.
9. Scroll down to “Security Settings.”
10. Uncheck “Use wireless networks” and “Use GPS satellites.”

Profile Applicability:

Level 2

Description:

17 | P a g e
Mobile devices running Android 2.3 can be configured to disable all receivers and transceivers.
This option is called Airplane Mode ("Flight Mode" on some phones). When Airplane Mode is
on, no phone, GPS, radio, Wi-Fi, or Bluetooth signals are emitted from or received by the
device. It is recommended that Airplane Mode be enabled when these capabilities are
unneeded or where security is paramount.

Rationale:

If the user enters an environment where no signal transmission or reception is intended,

Airplane Mode can be turned on to ensure that the device does not initiate or respond to any
signals. This reduces the remote attack surface.

Audit:

1. Press the Menu button.

2. Tap Settings.
3. Tap Wireless & networks.
4. Confirm that Airplane Mode is unchecked.

Remediation:

1. Press the Menu button.

2. Tap Settings.
3. Tap Wireless & networks.
4. Uncheck Airplane Mode.

Profile Applicability:

Level 1
Level 2

Description:

In normal operations, Android 2.3 devices do not use a secure delete function to erase data
from the disk, allowing it to persist in a recoverable state. Therefore, the device’s storage,
18 | P a g e
including the SD card, should be deleted via “Factory data reset” before the device is out of the
user’s control.

Rationale:

Overwriting the device’s storage before it is out of the user’s control will reduce an attacker’s
ability to recover sensitive information from the device.

Audit:

To verify that the Android device’s storage has been overwritten, it is necessary to install a forensics
recovery toolkit that is not within the scope of this document. Please review the references for more
information.

Remediation:

1. Press the Menu button.

2. Tap Settings.
3. Tap Privacy.
4. Tap Factory data reset.
5. Check “Erase SD card.”

Profile Applicability:

Level 2

Description:

If the Android 2.3 device is password locked and receiving SMS messages, the messages are still
previewed briefly on the display. It is recommended that SMS previews be disabled in
environments where security is paramount.

Rationale:

19 | P a g e
Parties who do not know the password lock should not be able to view the Android device’s
SMS traffic.

Audit:

1. Tap Messaging.
2. Press the Menu button.
3. Tap Settings.
4. Confirm that the “Notifications” setting is unchecked.

Remediation:

1. Tap Messaging.
2. Press the Menu button.
3. Tap Settings.
4. Uncheck the “Notifications” setting.

Profile Applicability:

Level 1
Level 2

Description:

On applicable phones, SIM cards often contain contact and other personal information. This
setting will lock the SIM card so that it requires a PIN to access.

Rationale:

Parties who do not know the SIM PIN should not be able to view the SIM card’s contents, nor
use the SIM card in another mobile device.

Audit:

1. Press the Menu button.

2. Tap Location and security.
20 | P a g e
 3. Tap Set up SIM card lock.
4. Ensure Lock SIM card is checked.

Remediation:

1. Press the Menu button.

2. Tap Location and security.
3. Tap Set up SIM card lock.
4. Check Lock SIM card.
5. Type in new SIM PIN on Lock SIM card dialog.

Profile Applicability:

Level 1
Level 2

Description:

Android has the ability to display passwords as they’re typed, to minimize entry errors.

Rationale:

Password feedback, even if provided only one character at a time, can enable an individual
watching the device to learn the password. It is recommended that this feature be disabled.

Audit:

1. Press the Menu button.

2. Tap Settings.
3. Tap Location and security.
4. Verify Visible passwords is unchecked.

Remediation:

1. Press the Menu button.

2. Tap Settings.
3. Tap Location and security.
4. Uncheck Visible passwords.

21 | P a g e
Profile Applicability:

Level 2

Description:

Mobile devices not only contain information, they also contain passwords and other credentials
that can enable an attacker to retrieve confidential data from other sources the device may
interact with.

Rationale:

Encrypting the credential store and removing application access to secure credentials limits the
exposure of personal data to solely that which is on the device. Using these settings together
protects against both local attack, application attack, and some forms of remote attack.

Audit:

1. Press the Menu button.

2. Tap Settings.
3. Tap Location and security.
4. Scroll down to “Credential storage” section.
5. Confirm that Use secure credentials option is not grayed-out and is unchecked.

Remediation:

1. Press the Menu button.

2. Tap Settings.
3. Tap Location and security.
4. Scroll down to “Credential storage” section.
5. Tap Set password.
6. Type and confirm new password in dialog box.
22 | P a g e
 7. Tap OK.
8. Uncheck Use secure credentials.

Profile Applicability:

Level 1
Level 2

Description:

The Android operating system allows developers to change phone behavior, interact with the
device, issue commands, and read storage. Since the same port is used to charge the phone,
combined with the common availability in airports and other public places for phone charging,
it is important to ensure that charging the phone does not open an attack vector.

Rationale:

Disabling command and data functions dramatically reduces the attack surface of the device.

Audit:

1. Press the Menu button.

2. Tap Settings.
3. Tap Applications.
4. Tap Development.
5. Confirm that USB debugging is unchecked.
6. Confirm that Stay awake is unchecked.
7. Confirm that Mock locations is unchecked.

Remediation:

1. Press the Menu button.

2. Tap Settings.
3. Tap Applications.
4. Tap Development.
5. Uncheck USB debugging.
6. Uncheck Stay awake.
7. Uncheck Mock locations.
23 | P a g e
Profile Applicability:

Level 1
Level 2

Description:

By default, Android requires application developers to sign their applications and distribute
them through the Android market.

Rationale:

Disabling installation from untrusted distribution channels increases the chance that the
applications sought are the applications actually downloaded.

Audit:

1. Press the Menu button.

2. Tap Settings.
3. Tap Applications.
4. Confirm Unknown sources is unchecked.

Remediation:

1. Press the Menu button.

2. Tap Settings.
3. Tap Applications.
4. Uncheck Unknown sources.

1.2 Browser Settings

24 | P a g e
This section provides guidance on the secure configuration of settings related to the built-in
browser on Android 2.3 mobile devices.

Profile Applicability:

Level 2

Description:

JavaScript lets web programmers control elements of the page, for example: a page that uses
JavaScript might display the current date and time or cause a linked page to appear in a new
pop-up page. It is recommended that JavaScript and plug-ins be disabled in environments
where security is paramount.

Rationale:

JavaScript should only be enabled before browsing trusted sites.

Audit:

1. Tap the globe Browser icon.

2. Tap Settings.
3. Scroll down to Enable Java Script.
4. Confirm that JavaScript is unchecked.
5. Tap Enable plug-ins.
6. Confirm that “Off” is checked.

Remediation:

1. Tap the globe Browser icon.

2. Tap Settings.
3. Scroll down to Enable Java Script.
4. Uncheck JavaScript.
5. Tap Enable plug-ins.
6. Select “Off.”

25 | P a g e
Profile Applicability:

Level 1
Level 2

Description:

Although the built-in browser does not provide website black-list checking, it will provide
common security checks, such as SSL certificate expiration and domain match.

Rationale:

Ensuring that standard security checks are enabled, can help warn in cases of some simple
security issues.

Audit:

1. Tap the globe Browser icon.

2. Tap Settings.
3. Scroll to Security settings.
4. Ensure “Show security warnings” is checked.

Remediation:

1. Tap the globe Browser icon.

2. Tap Settings.
3. Scroll to Security settings.
4. Check “Show security warnings.”

Profile Applicability:

Level 2

26 | P a g e
Description:

The browser has a feature to remember information entered into common forms in order to
automate the completion of later forms. Information auto-filled can include personal
information, including names and passwords. It is recommended that Remember Form Data is
disabled.

Rationale:

Disabling Remember Form Data and Remember Passwords can help avoid the storage of
credentials locally on the device, as well as reduces the likelihood of automated unauthorized
access to a site in the event unauthorized access is gained to the device.

Audit:

1. Tap the globe Browser icon.

2. Press the Menu button.
3. Tap More.
4. Tap Settings.
5. Scroll to “Privacy Settings.”
6. Confirm Remember Form Data is unchecked. 7. Scroll to “Security Settings.”
8. Confirm Remember passwords is unchecked.

Remediation:

1. Tap the globe Browser icon.

2. Press the Menu button.
3. Tap More.
4. Tap Settings.
5. Scroll to “Privacy Settings.”
6. Tap Clear form data, and tap “OK” on the confirmation dialog.
7. Uncheck Remember form data.
8. Scroll to “Security Settings.”
9. Tap Clear passwords and tap “OK” on the confirmation dialog.
10. Uncheck Remember passwords.

27 | P a g e
2 Settings in Android’s Software Development Kit (SDK)
The Android Software Development Kit (SDK) and associated development tools create a rich
environment for application development and some facility for configuration if the device’s
storage is mounted read-write, which is not normally the case. Discussing Android scripting and
Application Programming Interface (API) usage is beyond the scope of this document, but
further information is available at: http://developer.android.com/sdk/android-2.3.4.html

3 Android Mobile Device Settings in MS Exchange ActiveSync

Policy
This section provides guidance on the configuration of certain policies on Android mobile
devices using Microsoft Exchange ActiveSync versions 2.5 and later. This guidance was
developed and tested specifically with Exchange ActiveSync version 3.5 with the Client Access
server role on Microsoft Exchange Server 2010, and updated to reflect the relevant
configurations for this benchmark.

All remediation and audit steps specified in this section apply to settings within an Exchange
ActiveSync Mailbox policy, which are configured in the properties of the policy, accessed either
via the Exchange Management Console (EMC) or the Exchange Management Shell.

To access the policy properties using the Exchange Management Console, follow the below
steps:

1. Open the Exchange Management Console.

2. In the console tree, click on “Exchange ActiveSync” and then “Client Access” to open
the Client Configuration work area.

3. Click on the “Exchange ActiveSync Mailbox Policies” tab.

4. Select the mailbox policy to modify.

5. Click on “Properties.”

The remediation steps and the audit steps specified in this manual for the EMC apply to the
"Properties" configuration window available once the above steps are completed.

28 | P a g e
For more information on using the Exchange Management Console (EMC) and the Exchange
Management Shell, please refer to the additional information and resources provided in
Appendix D.

Please note Android 2.3 phone can add accounts and sync information from multiple Exchange
servers; they can also add multiple Google accounts and other kinds of accounts. Each of these
accounts may have security policies that are enforced by Android. If accounts have conflicting
security policies, Android enforces the strictest rules set by any account for each kind of policy;
in other words, no account policy can relax the degree of security set by another account policy.

For more information about Microsoft Exchange Information Services and security policies
supported by Android 2.3,
see: http://static.googleusercontent.com/external_content/untrusted_dlcp/www.google.com/
en//help/hc/pdfs/mobile/ExchangeAndAndroid2.2and2.3-003.pdf

3.1 Password Settings

This section provides guidance on the secure configuration of password settings.

Profile Applicability:

Level 1
Level 2

Description:

The device can be configured to require a password before allowing access through the
touchpad. By default, Android devices do not require a password to unlock the device after a
period of inactivity, and the default Exchange ActiveSync policy setting applied for users not
assigned to a mailbox policy does not require a password. It is recommended that a password
be set. This setting is the same as the setting in Section 1.1.2.

Rationale:

Requiring a password to unlock the device increases the effort required to compromise the
features and data of the Android device in the event of a physical security breach.

29 | P a g e
Audit:

Using the Exchange Management Console (EMC): In

the “Properties” configuration window,

1. Click on the “Password” tab.

2. Observe if the “Require password” checkbox is selected.

3. Click “Cancel”.

Using the Exchange Management Shell:

At the Exchange Management Shell command prompt,

1. Enter the following command (all one line):

Get-ActiveSyncMailboxPolicy -Identity "<PolicyName>"

where<PolicyName> is the name of the Exchange ActiveSync mailbox policy for which the
audit validation should be made (replace brackets and text with appropriate policy name).

2. Search the outputted policy setting list for the "DevicePasswordEnabled :" configuration
item.

3. Observe if the value following the colon is "True" as shown below:

DevicePasswordEnabled : True

4. Exit the Exchange Management Shell.

Remediation:

Using the Exchange Management Console (EMC): In

the “Properties” configuration window,

1. Click on the “Password” tab.

2. Click on the “Require password” checkbox

3. Click “OK”.

30 | P a g e
Using the Exchange Management Shell:

At the Exchange Management Shell command prompt,

1. Enter the following command (all one line):

Set-ActiveSyncMailboxPolicy -Identity "<PolicyName>" -DevicePasswordEnabled: $true where

<PolicyName> is the name of the Exchange ActiveSync mailbox policy for which the
configuration should be made (replace brackets and text with appropriate policy name).

Profile Applicability:

Level 2

Description:

The device can be configured to require that the password be comprised of both numeric and
alphabetic values. By default, Android devices do not enforce a password complexity policy, and
the default Exchange ActiveSync policy setting applied for users not assigned to a mailbox policy
does not require an alphanumeric password. It is recommended that both numeric and
alphabetic values comprise the password. This setting is the same as the setting in Section
1.1.3, though automated enforcement is only available via Exchange policy.

Rationale:

Requiring a mix of alphabetical and numerical characters increases the complexity of the
password an attacker may attempt to brute-force in order to gain access to the device.

Audit:

Using the Exchange Management Console (EMC):

In the “Properties” configuration window,

1. Click on the “Password” tab.

2. Observe if the “Require alphanumeric password” checkbox is selected.

3. Click “Cancel”.

31 | P a g e
Using the Exchange Management Shell:

At the Exchange Management Shell command prompt,

1. Enter the following command (all one line):

Get-ActiveSyncMailboxPolicy -Identity "<PolicyName>"

where<PolicyName> is the name of the Exchange ActiveSync mailbox policy for

which the audit validation should be made (replace brackets and text with
appropriate policy name).

2. Search the outputted policy setting list for the

"AlphanumericDevicePasswordRequired :" configuration item.

3. Observe if the value following the colon is "True" as shown below:

AlphanumericDevicePasswordRequired :True

4. Exit the Exchange Management Shell.

Remediation:

Using the Exchange Management Console (EMC):

In the “Properties” configuration window,

1. Click on the “Password” tab.

2. Click on the “Require alphanumeric password” checkbox

3. Click “OK”.

Using the Exchange Management Shell:

At the Exchange Management Shell command prompt,

1. Enter the following command (all one line):

Set-ActiveSyncMailboxPolicy -Identity "<PolicyName>" -AlphanumericDevicePasswordRequired :$true

where<PolicyName> is the name of the Exchange ActiveSync mailbox policy for which the
configuration should be made (replace brackets and text with appropriate policy name).

32 | P a g e
Profile Applicability:

Level 1
Level 2

Description:

The device can be configured to require that the password be at least a pre-determined length.
By default, the minimum password length is only four characters, and this is the default
Exchange ActiveSync policy value applied for users not assigned to a mailbox policy if minimum
password length checking is enabled. It is recommended that password length be at least five
(5) characters.

Rationale:

Requiring at least five characters increases the complexity of the password an attacker may
attempt to brute-force in order to gain access to the device. Additionally, requiring at least five
characters prevents a user from selecting typically weak values, such as a year, date, or last four
digits of a phone number, for their password. Android 2.3 supports passwords of up to 16
characters.

Audit:

Using the Exchange Management Console (EMC):

In the “Properties” configuration window,

1. Click on the “Password” tab.

2. Observe if the “Minimum password length” checkbox is selected.

3. Observe if the minimum password length value is set to 5.

4. Click “Cancel”.

Using the Exchange Management Shell:

At the Exchange Management Shell command prompt,

1. Enter the following command (all one line):

Get-ActiveSyncMailboxPolicy -Identity "<PolicyName>"

33 | P a g e
 where<PolicyName> is the name of the Exchange ActiveSync mailbox policy for
which the audit validation should be made (replace brackets and text with
appropriate policy name).

2. Search the outputted policy setting list for the "MinDevicePasswordLength :"
configuration item.

3. Observe if there is a value following the colon and that the value is set to 5 as
shown below:

MinDevicePasswordLength : 5

4. Exit the Exchange Management Shell.

Remediation:

Using the Exchange Management Console (EMC):

In the “Properties” configuration window,

1. Click on the “Password” tab.

2. Click on the “Minimum password length” checkbox.

3. Enter the number 5 in the box on the right hand side.

4. Click “OK”.

Using the Exchange Management Shell:

At the Exchange Management Shell command prompt,

1. Enter the following command (all one line):

Set-ActiveSyncMailboxPolicy -Identity "<PolicyName>" -MinDevicePasswordLength5

where<PolicyName> is the name of the Exchange ActiveSync mailbox policy for

which the configuration should be made (replace brackets and text with
appropriate policy name).

Profile Applicability:

Level 2

34 | P a g e
Description:

This Exchange policy is not supported by Android 2.3.

Rationale:

Audit:

Remediation:

-
Profile Applicability:

Level 1
Level 2

Description:

The device can be configured to auto-lock after a pre-defined inactivity period. By default, if a
password is defined, an Android device will automatically lock after one minute of inactivity,
and the default Exchange ActiveSync policy setting applied for users not assigned to a mailbox
policy sets an inactivity lock at 15 minutes. It is recommended that an inactivity timeout of no
more than five (5) minutes be set for typical use cases, and one (1) or two (2) minutes
depending on device capability for high-security use cases.

Rationale:

Preventing the user from setting a long inactivity period reduces the risk that the Android
device will be unlocked in the event of a physical security breach.

Audit:

35 | P a g e
Using the Exchange Management Console (EMC):

In the “Properties” configuration window,

1. Click on the “Password” tab.

2. Observe if the “Time without user input before password must be re-entered (in
minutes)” checkbox is selected.

3. Observe if the auto-lock timeout value is set to 5 or 1 according to use case.

4. Click “Cancel”.

Using the Exchange Management Shell:

At the Exchange Management Shell command prompt,

1. Enter the following command (all one line):

Get-ActiveSyncMailboxPolicy -Identity "<PolicyName>"

where<PolicyName> is the name of the Exchange ActiveSync mailbox policy for

which the audit validation should be made (replace brackets and text with
appropriate policy name).

2. Search the outputted policy setting list for the "MaxInactivityTimeDeviceLock

:”configuration item.

3. Observe if there is a value following the colon and that the value is set to 5 or
1according to use case as shown below:

MaxInactivityTimeDeviceLock :5

4. Exit the Exchange Management Shell.

Remediation:

Using the Exchange Management Console (EMC): In

the “Properties” configuration window,

1. Click on the “Password” tab.

36 | P a g e
 2. Click on the “Time without user input before password must be re-entered (in
minutes)” checkbox. When this checkbox is checked, you may enter the time in
minutes for the auto-lock timeout in the box on the right hand side.

3a. For typical use case, enter the number 5 in the box on the right hand side.

3b. For high-security use cases, enter the number 1.

4. Click “OK”.

Using the Exchange Management Shell:

At the Exchange Management Shell command prompt,

1. Enter the following command (all one line):

Set-ActiveSyncMailboxPolicy -Identity "<PolicyName>"-MaxInactivityTimeDeviceLock: 00:05:00

where <PolicyName> is the name of the Exchange ActiveSync mailbox policy for
which the configuration should be made (replace brackets and text with
appropriate policy name) and specifying the time in minutes as appropriate
according to use case and device as described for the EMC above.

Profile Applicability:

Level 1
Level 2

Description:

The device can be configured to reset itself to factory defaults (a local wipe) after excessive
password failures. Android 2.3 supports a maximum of 31 password failures. The default
Exchange ActiveSync policy setting applied for users not assigned to a mailbox policy configures
the device to erase data after four (4) failed password attempts, if a password is configured on
the device. It is recommended that this feature be enabled at six (6) failed password attempts.

Rationale:

Excessive password failures typically indicate that the device is out of physical control of its
owner. Upon such an event, erasing data on the phone will ensure the confidentiality of
information stored on the device is protected when facing a novice attacker.

37 | P a g e
Audit:

Using the Exchange Management Console (EMC):

In the “Properties” configuration window,

1. Click on the “Password” tab.

2. Observe if the “Number of failed attempts allowed:” checkbox is selected.

3. Observe if the failed attempts value is set to 6.

4. Click “Cancel”.

Using the Exchange Management Shell:

At the Exchange Management Shell command prompt,

1. Enter the following command (all one line): Get-ActiveSyncMailboxPolicy -Identity

"<PolicyName>"

where<PolicyName> is the name of the Exchange ActiveSync mailbox policy for

which the audit validation should be made (replace brackets and text with
appropriate policy name).

2. Search the outputted policy setting list for the

"MaxDevicePasswordFailedAttempts”configuration item.

3. Observe if there is a value following the colon and that the value is set to 6 as
shown below:

MaxDevicePasswordFailedAttempts : 6

4. Exit the Exchange Management Shell.

Remediation:

Using the Exchange Management Console (EMC): In

the “Properties” configuration window,

38 | P a g e
 1. Click on the “Password” tab.

2. Click on the “Number of failed attempts allowed:” checkbox. When this checkbox
is checked, you may enter the maximum number of failed attempts in the box on
the right hand side.

3. Enter the number 6 in the box on the right hand side.

4. Click “OK”.

Using the Exchange Management Shell:

At the Exchange Management Shell command prompt,

1. Enter the following command (all one line):

Set-ActiveSyncMailboxPolicy -Identity "<PolicyName>"-MaxDevicePasswordFailedAttempts :6

where<PolicyName> is the name of the Exchange ActiveSync mailbox policy for

which the configuration should be made (replace brackets and text with
appropriate policy name).

4: Additional Information
4.1: References
1. Android 2.3 User Guide: http://www.google.com/googlephone/AndroidUsersGuide-2.3.pdf
2. The Simplest Security: A Guide To Better Password Practices
http://www.symantec.com/connect/articles/simplest-security-guide-better-password-practices
3. Android Forensics: http://www.syngress.com/digital-forensics/Android-Forensics/
4. Security policies supported by Android 2.3 in Microsoft Exchange Information Services:
http://static.googleusercontent.com/external_content/untrusted_dlcp/www.google.com/en//h
elp/hc/pdfs/mobile/ExchangeAndAndroid2.2and2.3-003.pdf
5. Android Software Development Kit (SDK)
Documentation: http://developer.android.com/sdk/android-2.3.4.html
6. National Institute of Standards and Technology. (2006). NIST Special Publication 800-63:
Electronic Authentication Guideline. Available:
http://csrc.nist.gov/publications/nistpubs/80063/SP800-63V1_0_2.pdf . Last accessed 24 August
2010.
7. National Institute of Standards and Technology. (2008). NIST Special Publication 800-124:
Guidelines on Cell Phone and PDA Security. Available:
http://csrc.nist.gov/publications/nistpubs/800-124/SP800-124.pdf . Last accessed 24 August
2010.

39 | P a g e
4.2 Change History
Date Version Changes for this version
18 September 2011 0.1 Draft adopted from iOS benchmark document
version 1.3.0.
25 September 2011 0.2 Added Bluetooth default
23 October 2011 0.3 Incorporated community comments.
29 October 2011 1.0 Incorporated community feedback
25 June 2012 1.1 Updated Guide with Additional Post-Release
Feedback
4.3: Additional Security Notes
The items in this section are security configuration settings that are available within the Android
2.3 operating system, but have been determined to provide relatively little incremental security
benefit, either due to other settings in the benchmark document or inherent applicability or
effectiveness as a control.

These settings may be required to meet compliance requirements or in a unique situation may
provide a security benefits that outweighs the administrative cost of performing them, as
determined by an organization's own risk analysis. These settings are purely optional and may
be applied or not at the discretion of local site administrators.

This configuration setting is not available in Android 2.3.

This configuration setting is not available in Android 2.3.

Description:

Android operating system allows applications to manage and synchronize data automatically. If
the mobile phone user utilizes applications like email, this can be useful to avoid having to wait
for the application to download while the user is using the application. If the user does not use
applications like this, then there is no reason to allow applications to control dataflow
asynchronously.

Rationale:

40 | P a g e
Limiting the access applications have to the network and your data minimizes perform activities
that are not directly relevant to user requests.

Audit:

1. Press the Menu button.

2. Tap Settings.
3. Tap Accounts & sync.
4. Confirm that Auto-sync and Background data are unchecked.

Remediation:

1. Press the Menu button.

2. Tap Settings.
3. Tap Accounts & sync.
4. Uncheck Auto-sync.
5. Uncheck Background data.
6. Tap OK.

4.4: Additional Information for Exchange ActiveSync

Management
Microsoft Exchange ActiveSync is a Microsoft Exchange mobile device communication and
synchronization protocol based on HTTP and XML that allows mobile devices to access
information on a Microsoft Exchange server. Exchange ActiveSync enables mobile phone users
to access e-mail, calendar, contacts, and tasks and provides access to certain features that allow
for the enforcement of security policies on mobile devices. Multiple policies can be created as
needed to reflect organizational groups, device types, or combinations as desired; however, the
policies are applied to users/user mailboxes and not devices specifically, and a user can belong
to only one Exchange ActiveSync mailbox policy at a time.

Security configuration items that can be applied include the initiation of a remote wipe of a
managed device and the enforcement of five password configuration policies (specifically:
requiring a password, setting a minimum password length, requiring an alphanumeric
password, requiring a complex password, and setting an inactivity time lockout) through the
creation and application of an Exchange ActiveSync mailbox policy for a user. These ActiveSync
configuration items can be applied through one or more of the following management
interfaces: the MS Exchange Management Console (EMC), the MS Exchange Management
Shell, the Microsoft Exchange Server ActiveSync Web Administration Tool, and the Outlook Web
Access Mobile Device Management interface.

41 | P a g e
The instructions in this section have the following prerequisites:

The Client Access server role has been installed on the Exchange Server.

The appropriate Client Access Permissions have been assigned to permit the indicated
configurations.

Exchange ActiveSync is enabled for the user.

The device ID for the mobile device has not been specifically removed from the
ActiveSyncAllowedDeviceIDs parameter list

An Exchange ActiveSync mailbox policy to be configured has already been created.

Additional information on MS EAS and its setup, configuration, and management is available
from Microsoft, including the TechNet Library Article Understanding Exchange
ActiveSyncavailable at:http://technet.microsoft.com/en-us/library/aa998357.aspx

4.4.1 General ActiveSync Settings

This section provides guidance on the configuration of general ActiveSync settings.

-
Profile Applicability:

Description:

For a given mailbox policy, Microsoft Exchange ActiveSync classifies a mobile device attempting
to connect as one of two types—a provisionable device or a non-provisionable device—based
on the device’s ability to comply with the policy. Provisionable devices are devices that are
capable of fully applying and enforcing a specified policy. Non-provisionable devices are devices
that are capable of applying and enforcing only a subset of a policy, or even none of a policy.

This ActiveSync policy setting specifies whether a mobile device that cannot support the
application of all policy settings can connect to MS Exchange through Exchange ActiveSync. By
42 | P a g e
default, Exchange ActiveSync allows non-provisionable devices to connect through Exchange
ActiveSync. To ensure that mobile devices connect only when the full policy can be assured,
non-provisionable devices must be disallowed.

Rationale:

Restricting the devices which can connect to MS Exchange through ActiveSync to only those
which can fully support the policy specified is the only way that Exchange ActiveSync can assure
that an Android device is configured fully according to the specified policy. If a device that does
not meet any or all of the policy configuration items can continue to connect to Exchange
ActiveSync and access the resources provided through the ActiveSync connection, the initial
and continued enforcement of policy controls cannot be assured and intended device security is
highly reduced.

Audit:

Using the Exchange Management Console (EMC):

1. Open the Exchange Management Console.

2. In the console tree, click on “Exchange ActiveSync” and then “Client Access to open the
Client Configuration work area.
3. Click on the “Exchange ActiveSync Mailbox Policies” tab.
4. Select the mailbox policy to modify.
5. Click on “Properties.”
6. Click on the “General” tab.

7. Observe if the “Allow non-provisionable devices” checkbox is unchecked.

8. Click “Cancel”.

Using the Exchange Management Shell:

1. Open the Exchange Management Shell.

2. Enter the following command (all one line):

Get-ActiveSyncMailboxPolicy -Identity "<PolicyName>"

where<PolicyName> is the name of the Exchange ActiveSync mailbox policy for which the
audit validation should be made (replace brackets and text with appropriate policy name).

3. Search the outputted policy setting list for the "AllowNonProvisionableDevices :"
configuration item.
43 | P a g e
 4. Observe if the value following the colon is "False" as shown below:

AllowNonProvisionableDevices : False

5. Exit the Exchange Management Shell.

Remediation:

Using the Exchange Management Console (EMC):

1. Open the Exchange Management Console.

2. In the console tree, click on “Exchange ActiveSync” and then “Client Access to open the
Client Configuration work area.
3. Click on the “Exchange ActiveSync Mailbox Policies” tab.
4. Select the mailbox policy to modify.
5. Click on “Properties.”

6. Click on the “General” tab.

7. Click on the “Allow non-provisionable devices” checkbox to remove any check mark.

8. Click “OK”.

Using the Exchange Management Shell:

1. Open the Exchange Management Shell.

2. Enter the following command (all one line):

Set-ActiveSyncMailboxPolicy -Identity "<PolicyName>"-AllownonProvisionableDevices $true

where<PolicyName> is the name of the Exchange ActiveSync mailbox policy for which the
configuration should be made (replace brackets and text with appropriate policy name).

4.4.2 General Resources for Android Mobile Device ActiveSync

Management
This section provides references to general resources supporting the use and management of
Android mobile devices using Microsoft Exchange ActiveSync.

44 | P a g e
 1. Microsoft Technet Library Article: Exchange 2010 Client Access Cmdlet
SetActiveSyncMailboxPolicy Parameter Information:
http://technet.microsoft.com/enus/library/bb123756.aspx
2. Microsoft Technet Library Article:Exchange 2010 Client Access Cmdlet
GetActiveSyncMailboxPolicy Parameter Information:
http://technet.microsoft.com/enus/library/bb124900.aspx
3. New User's Guide to the Exchange Management Console:
http://technet.microsoft.com/enus/library/bb245702%28EXCHG.80%29.aspx
4. A Primer on the Exchange Management Shell:
http://technet.microsoft.com/enus/library/bb245704%28EXCHG.80%29.aspx
5. Exchange Management Shell in Exchange 2010:
http://technet.microsoft.com/enus/library/dd795097.aspx
6. Exchange Management Console (MS Exchange 2010):
http://technet.microsoft.com/enus/library/bb123762.aspx
7. Exchange Management Shell (MS Exchange 2010):
http://technet.microsoft.com/enus/library/bb123778.aspx
http://cisecurity.org. If you have questions, comments, or have identified ways to improve this
guide, please write us at feedback@cisecurity.org.

45 | P a g e
46 | P a g e