Google Android
TMA-ANDROID-ENCRYPTION
Ensure device storage encryption is active
Descrição
Android 10+ devices ship with file-based encryption enabled by default; older or modified devices can be unencrypted. ro.crypto.state reports encrypted when FBE/FDE is active. The audit uses adb against the single attached device (set ANDROID_SERIAL when several are connected) and FAILS when adb is missing or no authorised device is connected. adb requires USB debugging, so disable Developer options again after the audit.
Como é verificado
Método de auditoria: Comando shell
out=$(adb shell getprop ro.crypto.state 2>/dev/null) || exit 1
state=$(printf '%s' "$out" | tr -d '\r[:space:]')
if [ "$state" = encrypted ]; then echo compliant; else echo "ro.crypto.state=${state:-unset}"; fi- Saída esperada
compliant
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
Devices shipping Android 10+ are encrypted by default; if ro.crypto.state is not 'encrypted' (custom ROM, unlocked bootloader or legacy device) back up, relock the bootloader / reflash stock firmware or retire the device. Legacy devices: Settings > Security > Encrypt phone. EMM: Android Management API policy encryptionPolicy=ENABLED_WITH_PASSWORD.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- androidencryptiondata-at-rest
- Referência
- CIS Google Android Benchmark - Encryption (verify section number for your release)
Verificar este host
Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.
tmaegis scan --target android