03.01.16 Wireless Access

Statement

• a. Establish usage restrictions, configuration requirements, and connection requirements for each type of wireless access to the system.

• b. Authorize each type of wireless access to the system prior to establishing such connections.

• c. Disable, when not intended for use, wireless networking capabilities prior to issuance and deployment.

• d. Protect wireless access to the system using authentication and encryption.

Guidance

Wireless networking capabilities represent a significant potential vulnerability that can be exploited by adversaries. Establishing usage restrictions, configuration requirements, and connection requirements for wireless access to the system provides criteria to support access authorization decisions. These restrictions and requirements reduce susceptibility to unauthorized system access through wireless technologies. Wireless networks use authentication protocols that provide credential protection and mutual authentication. Organizations authenticate individuals and devices to protect wireless access to the system. Special attention is given to the variety of devices with potential wireless access to the system, including small form factor mobile devices (e.g., smart phones, tablets, smart watches). Wireless networking capabilities that are embedded within system components represent a potential vulnerability that can be exploited by adversaries. Strong authentication of users and devices, strong encryption, and disabling wireless capabilities that are not needed for essential mission or business functions can reduce susceptibility to threats by adversaries involving wireless technologies.

Assessment objective

each type of wireless access to the system is defined.

Assessment objective

usage restrictions are established for each type of wireless access to the system.

Assessment objective

configuration requirements are established for each type of wireless access to the system.

Assessment objective

connection requirements are established for each type of wireless access to the system.

Assessment objective

each type of wireless access to the system is authorized prior to establishing such connections.

Assessment objective

wireless networking capabilities not intended for use are disabled prior to issuance and deployment.

Assessment objective

wireless access to the system is protected using authentication.

Assessment objective

wireless access to the system is protected using encryption.

Assessment method

• access control policy and procedures procedures for wireless system access wireless system access configuration and connection requirements configuration management plan system configuration settings wireless access authorizations system audit records system design documentation system security plan other relevant documents or records

Assessment method

• personnel with responsibilities for managing wireless access connections personnel with information security responsibilities system developers system administrators

Assessment method

• wireless access management capability for the system mechanisms for implementing wireless access protections to the system mechanisms for managing the disabling of wireless networking capabilities

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final