UCF STIG Viewer Logo

The IDPS must authenticate devices before establishing wireless network connections using bidirectional authentication between cryptographically based devices.


Overview

Finding ID Version Rule ID IA Controls Severity
V-34644 SRG-NET-000150-IDPS-00109 SV-45519r1_rule Medium
Description
This requirement is for device to device authentication between wireless network devices and the IDPS components. Without authentication, an unauthorized device may connect to the IDPS and intercept monitored traffic, make configuration changes, or initiate man-in-the-middle attacks. Hence, it is imperative that authentication is bi-directional (mutual authentication) using cryptography to ensure a high level of trust and authenticity. Device authentication requires unique identification and authentication that may be defined by type, by specific device, or by a combination of type and device as deemed appropriate by the organization. The devices typically use either shared known information (e.g., Media Access Control [MAC] or Transmission Control Protocol/Internet Protocol [TCP/IP] addresses) for identification or an organizational authentication solution (e.g., IEEE 802.1x and Extensible Authentication Protocol [EAP], Radius server with EAP Transport Layer Security [TLS] authentication, Kerberos) to identify and authenticate devices on local area networks.
STIG Date
Intrusion Detection and Prevention Systems (IDPS) Security Requirements Guide 2012-11-19

Details

Check Text ( C-42868r1_chk )
If the IDPS devices do not have the capability to communicate directly with wireless devices, this is not a finding.

Verify direct IDPS communications with wireless network devices (e.g., wireless sensors or wireless management consoles) are configured to establish bidirectional authentication before establishing communications.
Verify the bidirectional authentication is between cryptographically based devices.

If communication between the IDPS and wireless network devices does not use bidirectional authentication, this is a finding.
If authentication is not established between cryptographically based devices, this is a finding.
Fix Text (F-38916r1_fix)
Configure the IDPS to require bidirectional authentication when communicating with wireless network devices.
Use cryptographically based devices to perform the bidirectional authentication.