NET.2.1 WLAN Operation

Before WLANs are used in an organisation, the organisation's general strategy for communication through WLANs MUST be specified. In particular, the organisational units in which WLANs will be used, the applications and purposes they will be used for, and the information that may be transmitted MUST be clarified and defined. The WLAN coverage area MUST also be determined.

Furthermore, it MUST be defined right from the planning phase who will be responsible for the administration of the various WLAN components, which interfaces will be in place between the persons in charge who are involved in WLAN operations, and when specific information must be exchanged among the persons in charge.

Within the framework of WLAN planning, there MUST be an initial determination of which of the devices operated by the organisation in question (e.g. microwave ovens, Bluetooth devices) radiate into the ISM band at 2.4 GHz and into the 5 GHz band.

In addition, the security mechanisms available in the individual WLAN standards MUST be compared. In general, it MUST be ensured that only authentication and encryption methods that are generally considered secure will be used. The organisation MUST document its reasons for choosing a particular WLAN standard.

Devices that need to fall back on insecure methods from recognised secure methods MUST NOT be considered during planning.

Communication via the air interface MUST be completely secure in cryptographic terms. Cryptographic methods that are less secure than WPA2 MUST NOT be used.

If WPA2 is used with pre-shared keys (WPA2-PSK), a complex key with a minimum length of 20 characters MUST be used.

Access points MUST be mounted such that they cannot be accessed or stolen. If they are set up, the required areas MUST be adequately covered. Furthermore, it MUST be ensured to the greatest extent possible that the radio waves are not emitted into areas not designated for WLAN coverage. Outside installations MUST be protected appropriately against weather and electrical discharges.

Access points MUST NOT be used in their default configuration. Pre-set SSIDs (service set identifiers), passwords, and cryptographic keys MUST be changed prior to productive use. In addition, insecure administration access MUST be disabled. Access points MUST ONLY be administered via a suitably encrypted connection.

It MUST be ensured that WLAN communication is not used to couple security zones or bypass established protection safeguards.

Before a wired distribution system is established, a basic decision MUST be made as to whether separation will be performed physically or logically through VLANs on the access switches of the wired LAN in question.

If a security incident occurs, the IT Operation Department MUST initiate appropriate countermeasures:

• At the point where WLAN communication enters the internal LAN in question, communication SHOULD be blocked selectively for every SSID and access point—or even for the entire WLAN infrastructure—in the event of an attack.
• If access points have been stolen, defined security safeguards MUST be implemented to prevent any misuse of the access points or the information stored on them.
• If WLAN clients have been stolen and central certificate-based authentication is being used, the client certificates MUST be blocked.

The possibility of using stolen devices without authorisation in order to access the network of a given organisation MUST be ruled out.

If WLANs are connected to a LAN, the transition between the WLANs and the LAN SHOULD be protected—for example, with the help of a packet filter. The access point SHOULD be integrated in line with the requirements of NET.2.1.A7 Setting Up a Distribution System.

Based on the general security policy of the organisation in question, essential core aspects SHOULD be specified for the secure use of WLANs. The policy SHOULD be known to all persons in charge who are involved in establishing and operating WLANs. It SHOULD form the basis of their work. The implementation of the policy's requirements SHOULD be checked at regular intervals. If the contents of the policy are not implemented, there MUST be a suitable response. The results SHOULD be documented appropriately.

Based on the results of the planning phase, a requirements list SHOULD be drawn up that can be used to help evaluate the products available on the market. When procuring WLAN components, data protection and the intercompatibility of the components SHOULD be taken into account along with security.

A central management solution SHOULD be used. The functional range of the solution used SHOULD be in accordance with the requirements of the WLAN strategy at hand.

WLANs SHOULD be checked regularly for security vulnerabilities. In addition, the WLANs provided SHOULD be searched regularly for access points that have been installed without authorisation. Their performance and coverage SHOULD also be measured. The results of security checks SHOULD be documented transparently and compared against the target condition. Deviations SHOULD be investigated.

All components of WLAN infrastructure SHOULD be checked regularly to ensure that all the specified security safeguards have been implemented and all the components have been configured correctly. Access points mounted in public areas SHOULD be checked randomly at regular intervals to determine whether there have been attempts to open or manipulate them by force. The audit results SHOULD be documented transparently and compared against the target condition. Deviations SHOULD be investigated.

A VPN SHOULD be used to achieve additional protection of WLAN communications.

If a WLAN infrastructure is connected to a LAN, the transition between WLANs and the LAN SHOULD be secured in line with the applicable increased protection needs.

Communication between access points via the wireless interface and the LAN SHOULD be encrypted.

Wireless intrusion detection or prevention systems SHOULD be used.