CIS Samsung Knox Benchmark

This recommendation verifies that devices are enrolled via Knox Mobile Enrollment on the Samsung Knox enterprise mobile security platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Samsung Knox enterprise mobile security platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Knox enrollment status via Knox Suite:
# Knox Suite portal > Devices > Check enrollment status
# Or via Knox Manage API:
curl -s -H "Authorization: Bearer $KNOX_TOKEN" \
  https://eu-kme-api.samsungknox.com/kcs/v1/api/devices | \
  python3 -c 'import sys,json; d=json.load(sys.stdin); [print(i["deviceId"],i["enrollStatus"]) for i in d.get("deviceList",[])]'

# Configure Knox Mobile Enrollment (KME):
# Samsung Knox Portal > Knox Mobile Enrollment
# Upload devices via CSV or reseller auto-enrollment
# Assign MDM profile:
#   MDM Agent APK: Upload from your MDM
#   MDM Server URI: https://mdm.company.com/enrollment
#   Force enrollment: Enable
#   Skip Setup Wizard: As needed

This recommendation verifies that enrollment profiles have factory reset protection on the Samsung Knox enterprise mobile security platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Samsung Knox enterprise mobile security platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check device profiles:
# Knox Manage > Profiles > List active profiles
curl -s -H "Authorization: Bearer $KNOX_TOKEN" \
  https://eu-kme-api.samsungknox.com/kcs/v1/api/profiles | \
  python3 -c 'import sys,json; d=json.load(sys.stdin); [print(p["profileName"],p["profileType"]) for p in d.get("profileList",[])]'

# Create device enrollment profile:
# Knox Manage > Profiles > Create Profile
# Profile Type: Knox Platform for Enterprise (KPE)
# Settings:
#   Device admin: Knox Manage
#   Work profile: Enable
#   Factory reset protection: Enable
#   Unenrollment protection: Block

# Assign profile to device group:
# Knox Manage > Devices > Select Group > Assign Profile

This recommendation ensures that strong password policy is enforced on the Samsung Knox enterprise mobile security platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Samsung Knox enterprise mobile security platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check password policy via Knox Manage:
# Knox Manage > Policies > Password Policy
# Or via Knox API:
curl -s -H "Authorization: Bearer $KNOX_TOKEN" \
  https://eu-kme-api.samsungknox.com/kcs/v1/api/policies/password

# Configure strong password policy:
# Knox Manage > Policies > Create > Password
# Minimum Length: 8 characters
# Complexity: Alphanumeric + Special characters
# Maximum Failed Attempts: 10 (then wipe)
# Password Expiry: 90 days
# Password History: 5 previous passwords
# Auto-lock Timeout: 5 minutes

# Via Knox Platform for Enterprise API:
# EnterpriseDeviceManager.setPasswordMinimumLength(8)
# EnterpriseDeviceManager.setPasswordQuality(PASSWORD_QUALITY_COMPLEX)

This recommendation verifies that biometric authentication is properly configured on the Samsung Knox enterprise mobile security platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Samsung Knox enterprise mobile security platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check biometric settings:
# Knox Manage > Policies > Lock Screen
# Review: Biometric enrollment requirements

# Configure biometric authentication:
# Knox Manage > Policies > Lock Screen
# Allow Fingerprint: Yes
# Allow Face Recognition: Optional (less secure)
# Require PIN/Password fallback: Yes
# Biometric timeout: 72 hours (require password after)
#
# KPE API:
# BiometricPolicy.setFingerprintEnabled(true)
# BiometricPolicy.setFaceRecognitionEnabled(false)

This recommendation verifies that Always-On VPN is configured for work traffic on the Samsung Knox enterprise mobile security platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Samsung Knox enterprise mobile security platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check VPN configuration:
# Knox Manage > Policies > VPN
# Review per-app VPN and always-on settings

# Configure Always-On VPN:
# Knox Manage > Policies > VPN
# VPN Type: Always-on
# VPN Provider: Configure (GlobalProtect/AnyConnect/etc.)
# Per-App VPN: Enable for work apps
# Block non-VPN traffic: Enable (lockdown mode)
#
# KPE API:
# VpnPolicy.setAlwaysOnVpnPackage(packageName, true)

This setting ensures that WiFi is restricted to secure networks on the Samsung Knox enterprise mobile security platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Samsung Knox enterprise mobile security platform is essential for defense in depth.

# Check WiFi restrictions:
# Knox Manage > Policies > WiFi
# Review: allowed networks, restrictions

# Configure WiFi security:
# Knox Manage > Policies > WiFi
# Allowed WiFi: Enterprise WPA2/WPA3-Enterprise only
# Block: Open WiFi networks
# Block: WEP networks
# Push enterprise WiFi profiles with certificates
#
# KPE API:
# WifiPolicy.setWifiEnabled(true)
# WifiPolicy.setWifiStateChangeAllowed(false)

This recommendation verifies that Bluetooth file transfer is disabled on the Samsung Knox enterprise mobile security platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Samsung Knox enterprise mobile security platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check Bluetooth restrictions:
# Knox Manage > Policies > Connectivity
# Review Bluetooth settings and profiles

# Restrict Bluetooth:
# Knox Manage > Policies > Connectivity > Bluetooth
# Bluetooth: Allow (for headsets)
# File Transfer via BT: Block
# Bluetooth Tethering: Block
# Discoverable Mode: Block
#
# KPE API:
# BluetoothPolicy.setBluetoothDataTransferEnabled(false)
# BluetoothPolicy.setBluetoothDiscoverableEnabled(false)

This setting ensures that app installation is restricted to managed sources on the Samsung Knox enterprise mobile security platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Samsung Knox enterprise mobile security platform is essential for defense in depth.

# Check app installation policy:
# Knox Manage > Applications > App policies
# Review: play store restrictions, sideloading

# Restrict app installation:
# Knox Manage > Policies > Applications
# Allow installation from: Managed Google Play only
# Block sideloading (Unknown Sources): Yes
# App blacklist: Configure blocked apps
# App whitelist: Only approved apps
#
# KPE API:
# ApplicationPolicy.setApplicationInstallationEnabled(false)
# ApplicationPolicy.addAppPackageNameToBlackList(packageName)

This recommendation verifies that work profile separates corporate and personal apps on the Samsung Knox enterprise mobile security platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Samsung Knox enterprise mobile security platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check work profile apps:
# Knox Manage > Applications > Work Profile > Managed Apps
# List approved work apps

# Configure work profile app management:
# Knox Manage > Applications > Add Managed App
# Source: Managed Google Play
# Auto-install: Enable for required apps
# Managed Configuration: Push app configs
# App updates: Auto-update over WiFi

# Separate work and personal data:
# Knox Workspace container isolates work apps
# Knox Manage > Policies > Knox Workspace > Enable

This recommendation ensures that device and SD card encryption is enforced on the Samsung Knox enterprise mobile security platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Samsung Knox enterprise mobile security platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check encryption status:
# Knox Manage > Devices > Select device > Security Info
# Review: Storage encryption, SD card encryption

# Enforce device encryption:
# Knox Manage > Policies > Security > Encryption
# Internal Storage: Encrypted (required)
# SD Card: Encrypted (required)
# Knox Workspace Container: Separate encryption
#
# KPE API:
# SecurityPolicy.setStorageEncryption(true)
# SecurityPolicy.setExternalStorageEncryption(true)

This setting ensures that data sharing between containers is restricted on the Samsung Knox enterprise mobile security platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Samsung Knox enterprise mobile security platform is essential for defense in depth.

# Check data sharing restrictions:
# Knox Manage > Policies > Data Sharing
# Review: clipboard, copy-paste between containers

# Restrict data sharing between work and personal:
# Knox Manage > Policies > Knox Workspace
# Copy/Paste from Work to Personal: Block
# Share via from Work to Personal: Block
# Capture Screen in Work: Block
# USB file transfer from Work: Block
#
# KPE API:
# ExchangePolicy.setCopyPasteFromWorkToPersonal(false)
# RestrictionPolicy.setScreenCaptureEnabled(false)

This setting ensures that work data backup to cloud is restricted on the Samsung Knox enterprise mobile security platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Samsung Knox enterprise mobile security platform is essential for defense in depth.

# Check backup restrictions:
# Knox Manage > Policies > Data > Backup
# Review cloud backup settings

# Configure backup restrictions:
# Knox Manage > Policies > Data
# Google Backup: Work data - Block
# Samsung Cloud Backup: Work data - Block
# USB Debugging Backup: Block
# Allow backup of personal data: Yes
#
# KPE API:
# SecurityPolicy.setBackupEnabled(false)

This recommendation verifies that remote lock and wipe capabilities are enabled on the Samsung Knox enterprise mobile security platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Samsung Knox enterprise mobile security platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check remote wipe capabilities:
# Knox Manage > Devices > Select Device > Actions
# Review available remote actions

# Configure remote management:
# Knox Manage > Policies > Security
# Remote Lock: Enable
# Remote Wipe: Enable
# Remote Password Reset: Enable
# Factory Reset Protection: Enable (tied to admin Google account)
# Location Tracking: Enable for lost devices

# Execute remote wipe:
# Knox Manage > Devices > Select > Actions > Factory Reset

This recommendation verifies that compliance rules with automated actions are configured on the Samsung Knox enterprise mobile security platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Samsung Knox enterprise mobile security platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check compliance rules:
# Knox Manage > Compliance > Rules
# Review active compliance policies

# Configure compliance rules:
# Knox Manage > Compliance > Create Rule
# Condition: Device not checked in > 7 days → Lock device
# Condition: OS version < minimum → Notify, then block
# Condition: Rooted device detected → Wipe work container
# Condition: SIM change detected → Lock and notify
# Condition: Blacklisted app installed → Block work access

This recommendation verifies that E-FOTA firmware management is configured on the Samsung Knox enterprise mobile security platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Samsung Knox enterprise mobile security platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Enterprise Firmware Over-The-Air (E-FOTA):
# Knox E-FOTA > Dashboard > Firmware versions
curl -s -H "Authorization: Bearer $KNOX_TOKEN" \
  https://eu-kme-api.samsungknox.com/kcs/v1/api/efota/firmware

# Configure E-FOTA firmware management:
# Knox Suite > E-FOTA > Firmware Policies
# Forced Update: Enable
# Target Version: Set to latest approved build
# Schedule: Outside business hours
# WiFi Only: Enable
#
# Pin firmware version to prevent premature updates:
# Knox E-FOTA > Device Group > Set Target Firmware

This recommendation ensures that minimum security patch level is enforced on the Samsung Knox enterprise mobile security platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Samsung Knox enterprise mobile security platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check security patch level:
# Knox Manage > Devices > Select > Details
# Review: Android Security Patch Level
# Or via API check compliance rules for patch level

# Enforce minimum security patch level:
# Knox Manage > Compliance > Create Rule
# Condition: Security Patch Level older than 90 days
# Action: Notify user → 7 days → Block work access
#
# Regular audit:
# Knox Manage > Reports > Security Patch Report
# Export and review devices below compliance threshold