TMA-ANDROID-ENCRYPTION

Ensure device storage encryption is active

높음레벨 1자동android

설명

Android 10+ devices ship with file-based encryption enabled by default; older or modified devices can be unencrypted. ro.crypto.state reports encrypted when FBE/FDE is active. The audit uses adb against the single attached device (set ANDROID_SERIAL when several are connected) and FAILS when adb is missing or no authorised device is connected. adb requires USB debugging, so disable Developer options again after the audit.

점검 방법

감사 방식: 셸 명령

shell

out=$(adb shell getprop ro.crypto.state 2>/dev/null) || exit 1
state=$(printf '%s' "$out" | tr -d '\r[:space:]')
if [ "$state" = encrypted ]; then echo compliant; else echo "ro.crypto.state=${state:-unset}"; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Devices shipping Android 10+ are encrypted by default; if ro.crypto.state is not 'encrypted' (custom ROM, unlocked bootloader or legacy device) back up, relock the bootloader / reflash stock firmware or retire the device. Legacy devices: Settings > Security > Encrypt phone. EMM: Android Management API policy encryptionPolicy=ENABLED_WITH_PASSWORD.

속성

운영 체제: 모두
태그: androidencryptiondata-at-rest
참고 자료: CIS Google Android Benchmark - Encryption (verify section number for your release)

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target android