The UEM Agent must not install policies if the policy-signing certificate is deemed invalid.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-234239	SRG-APP-000175-UEM-100008	SV-234239r617354_rule		Medium

Description

It is critical that the UEM agent only use validated certificates for policy updates. Otherwise, there is no assurance that a malicious actor has not inserted itself in the process of packaging the code or policy. Satisfies: FMT_POL_EXT.2.2

STIG	Date
Unified Endpoint Management Agent Security Requirements Guide	2020-12-14

Details

Check Text (C-37424r612023_chk)

Verify the UEM Agent does not install policies if the policy-signing certificate is deemed invalid.

If the UEM Agent installs policies when the policy-signing certificate is deemed invalid, this is a finding.

Fix Text (F-37389r612024_fix)

Configure the UEM Agent to not install policies if the policy-signing certificate is deemed invalid.