NET.2.2 WLAN Usage

The essential core aspects of secure WLAN usage MUST be specified in a WLAN user policy based on the general security policy of the organisation in question. This user policy MUST describe the particularities of WLAN usage, such as whether, how, and with what devices hotspots may be used.

The policy MUST contain information on which data may be used and transmitted over a WLAN and which may not.

It MUST describe how to handle client-side security solutions. The user policy MUST contain a clearly stated ban on connecting unauthorised access points to the network of the respective organisation. Moreover, the policy MUST state that WLAN interfaces must be disabled if they are not used for a longer period.

There MUST be regular checks to ensure that the policy's requirements have been implemented correctly. If this is not the case, there MUST be an appropriate response. The results SHOULD be appropriately documented.

The users of WLAN components (mainly WLAN clients) MUST be made aware of and trained on the safeguards stated in the corresponding user policy. Suitable training MUST be identified and established for this purpose. What WLAN-specific security settings mean and why they are important MUST be explained in detail to users. In addition, users MUST be informed of the threats that result from bypassing or disabling these security settings.

The training content in question MUST always be adapted to the respective operational scenarios. In addition to training on WLAN security mechanisms, users MUST be given a copy of their organisation's WLAN security policy and made aware of the measures it contains. Users MUST also be made aware of the possible dangers posed by unfamiliar WLANs.

If the use of external hotspots is permitted, the following MUST be implemented:

• Every user of a hotspot MUST know the security requirements and then decide if and under which conditions hotspot usage is allowed.
• If hotspots are used, it SHOULD be ensured that the connection between the hotspot access point and the user’s IT system is cryptographically secured according to the state of the art.
• WLANs that are only used sporadically SHOULD be deleted from users' histories.
• The option to log into WLANs automatically SHOULD be disabled.
• If possible, separate user accounts with a secure basic configuration and restrictive authorisations SHOULD be used.
• It SHOULD be ensured that users with administrator authorisations can never log into external WLANs from their clients.
• In order to transmit sensitive data, all the necessary security safeguards (especially appropriate encryption) MUST be activated on the clients involved.
• If a WLAN interface is not used over an extended period of time, it MUST be disabled.
• When using publicly available WLANs, users MUST use a virtual private network (VPN) to access internal resources of their organisation.

In case of WLAN security incidents, users SHOULD act as follows:

• Users SHOULD save their work.
• They should terminate their WLAN connection and disable the WLAN interface on their client.
• Users SHOULD document any error messages and deviations as precisely as possible. Users SHOULD also document what they were doing before and during the security incident.
• Users SHOULD notify the IT Operation Department via a suitable escalation level (e.g. the user help desk). If the WLAN interface in question is not used for a longer period of time, it MUST be disabled.
• When using publicly available WLANs, users MUST use a virtual private network (VPN) to access internal resources of their organisation.