The organization must remove the wireless interface on computers with an embedded wireless system before the computer is used to transfer, receive, store, or process classified information.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35933	SRG-MPOL-015	SV-47249r2_rule		High

Description
The majority of consumer based laptops have wireless network interface cards (NICs) integrated with the computer's motherboard. Although the system administrator may disable these embedded NICs, the user may purposely or accidentally enable the device. These devices may also inadvertently transmit ambient sound or electronic signals. Therefore, simply disabling the transmit capability is not an adequate solution for computers processing classified information. In addition, embedded wireless cards do not meet DoD security requirements for classified wireless usage.

Description

The majority of consumer based laptops have wireless network interface cards (NICs) integrated with the computer's motherboard. Although the system administrator may disable these embedded NICs, the user may purposely or accidentally enable the device. These devices may also inadvertently transmit ambient sound or electronic signals. Therefore, simply disabling the transmit capability is not an adequate solution for computers processing classified information. In addition, embedded wireless cards do not meet DoD security requirements for classified wireless usage.

STIG	Date
Mobile Policy Security Requirements Guide	2013-07-03

Details

Check Text ( C-44170r2_chk )
Review the organization's policy to ensure wireless NICs are required to be removed prior to use in a classified environment. Verify the site has procedures in place to ensure laptops with wireless NICs are not used for classified data processing. Inquire about laptops/PCs used to process classified information that have embedded wireless NICs. No embedded wireless NICs are allowed, including WLAN, Bluetooth, WMAN, cellular, etc. Ensure the NIC is physically removed. Using methods such as tape or software disabling are not acceptable. Determine if the site either purchased laptops without wireless NICs (Wi-Fi, Bluetooth, WiMax, etc.) or physically removed the NICs from laptops. If the site is using embedded wireless NICs in a classified environment, this is a finding. Recommend to the DAA this is a critical finding requiring immediate action. Note: Does not apply to Communication Systems for Classified (CSfC) Wi-Fi systems.

Check Text ( C-44170r2_chk )

Review the organization's policy to ensure wireless NICs are required to be removed prior to use in a classified environment. Verify the site has procedures in place to ensure laptops with wireless NICs are not used for classified data processing.

Inquire about laptops/PCs used to process classified information that have embedded wireless NICs. No embedded wireless NICs are allowed, including WLAN, Bluetooth, WMAN, cellular, etc.

Ensure the NIC is physically removed. Using methods such as tape or software disabling are not acceptable.

Determine if the site either purchased laptops without wireless NICs (Wi-Fi, Bluetooth, WiMax, etc.) or physically removed the NICs from laptops.

If the site is using embedded wireless NICs in a classified environment, this is a finding. Recommend to the DAA this is a critical finding requiring immediate action.

Note: Does not apply to Communication Systems for Classified (CSfC) Wi-Fi systems.

Fix Text (F-40457r1_fix)
Remove computers with embedded wireless interfaces that cannot be removed from all classified use; these computers must not transfer, receive, store, or process classified information.