+AC-18 Wireless Access
---+AC-18(01) Authentication and Encryption
---+AC-18(03) Disable Wireless Networking
---+AC-18(04) Restrict Configurations by Users
---+AC-18(05) Antennas and Transmission Power Levels

AC-18 Wireless Access

Control

Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and
Authorize each type of wireless access to the system prior to allowing such connections.

Discussion

Wireless technologies include microwave, packet radio (ultra-high frequency or very high frequency), 802.11x, and Bluetooth. Wireless networks use authentication protocols that provide authenticator protection and mutual authentication.

Assessment Objective

1. configuration requirements are established for each type of wireless access;
2. connection requirements are established for each type of wireless access;
3. implementation guidance is established for each type of wireless access;
each type of wireless access to the system is authorized prior to allowing such connections.

Assessment Method

Examine

Access control policy procedures addressing wireless access implementation and usage (including restrictions) configuration management plan system design documentation system configuration settings and associated documentation wireless access authorizations system audit records system security plan other relevant documents or records

Interview

Organizational personnel with responsibilities for managing wireless access connections organizational personnel with information security responsibilities

1. Ülevaade

Pealkiri	Standard
AC-18(01) Authentication and Encryption	Control Protect wireless access to the system using authentication of [Selection(one-or-more): users; devices] and encryption. Discussion Wireless networking capabilities represent a significant potential vulnerability that can be exploited by adversaries. To protect systems with wireless access points, strong authentication of users and devices along with strong encryption can reduce susceptibility to threats by adversaries involving wireless technologies. Assessment Objective wireless access to the system is protected using authentication of [Selection(one-or-more): users; devices]; wireless access to the system is protected using encryption. Assessment Method Examine Access control policy procedures addressing wireless implementation and usage (including restrictions) system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developers
AC-18(03) Disable Wireless Networking	Control Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment. Discussion Wireless networking capabilities that are embedded within system components represent a significant potential vulnerability that can be exploited by adversaries. Disabling wireless capabilities when not needed for essential organizational missions or functions can reduce susceptibility to threats by adversaries involving wireless technologies. Assessment Objective when not intended for use, wireless networking capabilities embedded within system components are disabled prior to issuance and deployment. Assessment Method Examine Access control policy procedures addressing wireless implementation and usage (including restrictions) system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities
AC-18(04) Restrict Configurations by Users	Control Identify and explicitly authorize users allowed to independently configure wireless networking capabilities. Discussion Organizational authorizations to allow selected users to configure wireless networking capabilities are enforced, in part, by the access enforcement mechanisms employed within organizational systems. Assessment Objective users allowed to independently configure wireless networking capabilities are identified; users allowed to independently configure wireless networking capabilities are explicitly authorized. Assessment Method Examine Access control policy procedures addressing wireless implementation and usage (including restrictions) system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities
AC-18(05) Antennas and Transmission Power Levels	Control Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries. Discussion Actions that may be taken to limit unauthorized use of wireless communications outside of organization-controlled boundaries include reducing the power of wireless transmissions so that the transmissions are less likely to emit a signal that can be captured outside of the physical perimeters of the organization, employing measures such as emissions security to control wireless emanations, and using directional or beamforming antennas that reduce the likelihood that unintended receivers will be able to intercept signals. Prior to taking such mitigating actions, organizations can conduct periodic wireless surveys to understand the radio frequency profile of organizational systems as well as other systems that may be operating in the area. Assessment Objective radio antennas are selected to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries; transmission power levels are calibrated to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries. Assessment Method Examine Access control policy procedures addressing wireless implementation and usage (including restrictions) system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities

1.1 Viited

1.2 Tuvastatud nõuded

1.3 Seotud regulatsioonid

2. Tuvastatud nõuded

Nõuded
Allikas	Nõue

3. Seotud regulatsioonid

Regulatsioonid
Allikas	Regulatsioon

Lingitud teemad

Lingid
Lingi tüüp	Teema
is blocked by	AC-18 Wireless Access – Assessment Procedure
is blocked by	Wireless Access Authentication & Encryption
is blocked by	Wireless Networking

NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.