V-276539

Discussion

If no authentication is required to establish personal hotspot connections (Wi-Fi and Bluetooth), an adversary may be able to use that device to perform attacks on other devices or networks without detection. A sophisticated adversary may also be able to exploit unknown system vulnerabilities to access information and computing resources on the device. Requiring authentication to establish personal hotspot connections mitigates this risk. Application note: If hotspot functionality is permitted, it must be authenticated via a preshared key. There is no requirement to enable hotspot functionality, and it is recommended this functionality be disabled by default. SFR ID: FMT_SMF.1.1 #41

Check Content

This is a "User-Based Enforcement (UBE)" control.

Check a sample of Samsung phones at the site and verify the Wi-Fi hotspot preshared key (password) is set to "WPA2/WPA3-Personal" or "WPA3-Personal".

- Go to Settings >> Connections >> Mobile Hotspot and Tethering >> Mobile Hotspot.
- Select Network name >> Password >> Band.
- Click the "Security" link, and verify either "WPA2/WPA3-Personal" or "WPA3-Personal" have been selected.

If the Wi-Fi hotspot security is not set to "WPA2/WPA3-Personal" or "WPA3-Personal", this is a finding.