Samsung Android must be configured to enable authentication of personal hotspot connections to the device using a pre-shared key.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-268952	PP-MDF-333260	KNOX-15-007700	SV-268952r1036367_rule	2024-12-10	1

Description
If no authentication is required to establish personal hotspot connections (Wi-Fi and Bluetooth), an adversary may be able to use that device to perform attacks on other devices or networks without detection. A sophisticated adversary may also be able to exploit unknown system vulnerabilities to access information and computing resources on the device. Requiring authentication to establish personal hotspot connections mitigates this risk. Application note: If hotspot functionality is permitted, it must be authenticated via a preshared key. There is no requirement to enable hotspot functionality, and it is recommended this functionality be disabled by default. SFRID: FMT_SMF.1.1 #41

Description

If no authentication is required to establish personal hotspot connections (Wi-Fi and Bluetooth), an adversary may be able to use that device to perform attacks on other devices or networks without detection. A sophisticated adversary may also be able to exploit unknown system vulnerabilities to access information and computing resources on the device. Requiring authentication to establish personal hotspot connections mitigates this risk. Application note: If hotspot functionality is permitted, it must be authenticated via a preshared key. There is no requirement to enable hotspot functionality, and it is recommended this functionality be disabled by default. SFRID: FMT_SMF.1.1 #41

ℹ️ Check
This is a "User-Based Enforcement (UBE)" control. Check a sample of Samsung phones at the site and verify the Wi-Fi hotspot preshared key (password) is set to "WPA2/WPA3-Personal" or "WPA3-Personal". 1. Click Settings >> Connections >> Mobile Hotspot and Tethering >> Mobile Hotspot. 2. Select Network name >> Password >> Band. 3. Click on the "Security" link and verify either "WPA2/WPA3-Personal" or "WPA3-Personal" have been selected. If the Wi-Fi hotspot security is not set to "WPA2/WPA3-Personal" or "WPA3-Personal", this is a finding.

ℹ️ Check

This is a "User-Based Enforcement (UBE)" control. Check a sample of Samsung phones at the site and verify the Wi-Fi hotspot preshared key (password) is set to "WPA2/WPA3-Personal" or "WPA3-Personal". 1. Click Settings >> Connections >> Mobile Hotspot and Tethering >> Mobile Hotspot. 2. Select Network name >> Password >> Band. 3. Click on the "Security" link and verify either "WPA2/WPA3-Personal" or "WPA3-Personal" have been selected. If the Wi-Fi hotspot security is not set to "WPA2/WPA3-Personal" or "WPA3-Personal", this is a finding.

✔️ Fix
This is a "User-Based Enforcement (UBE)" control. Train users to not change the default Wi-Fi hotspot security setting: 15-character complex Wi-Fi hotspot preshared key (password) ("WPA2/WPA3-Personal" or WPA3-Personal"). (KNOX-15-009400). If the required preshared key is not set up, train users to use the following procedure to set up the required setting: 1. Click Settings >> Network & Internet >> Hotspot & tethering. 2. Enable "WiFi hotspot". 3. Tap on the words to the left of the slide called "Wi-Fi Hotspot", to bring up the configuration options. 4. Click the "Security" link and select "WPA2/WPA3-Personal" or "WPA3-Personal".

✔️ Fix

This is a "User-Based Enforcement (UBE)" control. Train users to not change the default Wi-Fi hotspot security setting: 15-character complex Wi-Fi hotspot preshared key (password) ("WPA2/WPA3-Personal" or WPA3-Personal"). (KNOX-15-009400). If the required preshared key is not set up, train users to use the following procedure to set up the required setting: 1. Click Settings >> Network & Internet >> Hotspot & tethering. 2. Enable "WiFi hotspot". 3. Tap on the words to the left of the slide called "Wi-Fi Hotspot", to bring up the configuration options. 4. Click the "Security" link and select "WPA2/WPA3-Personal" or "WPA3-Personal".