Security notice regarding storage and search behavior for PII

Environment

• Samsung Knox solutions and services

Overview

In the Knox cloud service 23.12 release, the Samsung Knox Team is implementing a critical update to the security of how personally identifiable information (PII) is stored at rest on Knox infrastructure. PII data will receive an additional layer of encryption in compliance with internal security policies at Samsung, which dictate a higher security standard than those required by legislation across our various global markets. With this new encryption layer, the attack surface of your business and end user PII is further minimized.

Starting with the 23.12 release, the corresponding changes to the back end will have immediate impacts on all Knox cloud services for search on the central Administrators & Roles page, and individual services’ User, Group, Device, History, and Activity log pages.

Impact

The following database fields, which are treated as containing PII, are affected:

• Personal name
• Email
• Phone number

All other fields are unaffected.

The impacts are as follows:

1. To search for any of these fields, you must enter the entire identifier. In other words, partial searching is no longer supported. Partial searching means searching for incomplete segments, or sub-strings, of a field. For example, before you could search for all admins with the term Al to retrieve all first names that started with those two letters, such as Ali, Alex, and Alexandra. For another example, if prior to 23.12 you searched by email domain to return all accounts of a particular division, such as @support.example.com to return both alex@support.example.com and ali@support.example.com, you must now search by their complete addresses instead.
2. Sorting the search results for these fields is no longer supported.

Per-service search behavior limitations

Consult the following table for a breakdown of the search behavior for PII across Knox services.

The Samsung Knox team plans to implement additional modifications to search behavior in other interfaces and Knox services in 2024. The table below will be updated to reflect these changes as they are deployed.

Affected service	Affected areas	Search behavior
Knox Admin Portal	Administrators & Roles > Administrators	Searching for partial email addresses and partial personal names is unsupported. Sorting by personal names is unsupported.
Knox Manage	Device User Group > Add Group > All Users/Devices History > Email & SMS History Setting > Android > Limited Enrollment	The first and last name are a single joined string. To search for a name, you must search for the full name, including the space between first and last names. Searching for email addresses and personal names is case-sensitive. Searching for partial email addresses, partial personal names, and partial phone numbers is unsupported.
Knox Remote Support	Devices History Activity log	Searching for partial email addresses and partial phone numbers is unsupported.
Knox Configure	Activity log	Searching for partial email addresses is unsupported. Sorting by personal names is unsupported.
Knox Guard	Administrators and Roles > Administrators	The first and last name are a single joined string. To search for a name, you must search for the full name, including the space between first and last names. Searching for partial email addresses and partial personal names is unsupported. Sorting by personal names is unsupported.
Knox Reseller Portal	Administrators & Roles > Administrators Activity log	The first and last name are a single joined string. To search for a name, you must search for the full name, including the space between first and last names. Searching for partial email addresses and partial personal names is unsupported. Sorting by personal names is unsupported.
Knox MSP Portal	Administrators Activity log	The first and last name are a single joined string. To search for a name, you must search for the full name, including the space between first and last names. Searching for partial email addresses and partial personal names is unsupported. Sorting by personal names is unsupported.

Ongoing support

If your enterprise needs help with these changes to functionality, please submit a support ticket.

If you’re participating in UAT, follow these instructions:

• Submit a ticket as an admin for UAT
• Submit a ticket as a partner for UAT

If you’re a regular customer, follow these instructions instead:

• Submit a ticket as an admin
• Submit a ticket as a partner

Back to KBAs