← Back to BlackBerry PlayBook OS V2.1 Security Technical Implementation Guide

V-38741

CAT II (Medium)

BlackBerry PlayBook OSs Wi-Fi module must use EAP-TLS authentication when authenticating to DoD WLAN authentication servers.

Rule ID

SV-50546r1_rule

STIG

BlackBerry PlayBook OS V2.1 Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-000780

Discussion

Without strong mutual authentication a mobile device may connect to an unauthorized network. In many cases, the user may falsely believe that the device is connected to an authorized network and then provide authentication credentials and other sensitive information. EAP-TLS is strong mutual authentication leveraging a public key infrastructure. Its use greatly mitigates risk associated with authentication transactions.

Check Content

Navigate to "Options -> Wi-Fi -> Saved Networks" and select a Wi-Fi profile used to connect to DoD WLAN. Ensure "Security Type" is set to "WPA Enterprise" or "WPA2 Enterprise" and "Security Sub Type" (EAP security method) is set to "TLS". These options should be greyed out. Otherwise, this is a finding.

Fix Text

On BlackBerry Device Service:
Select the affected Wi-Fi Profile, and set "Security Type" to "WPA Enterprise" or "WPA2 Enterprise" and "Security Sub Type" to "TLS".