The organization must authorize wireless access to the information system prior to connection.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-35946	SRG-MPOL-028	SV-47262r1_rule		Medium

Description
Wireless technologies include, but are not limited to, microwave, satellite, packet radio (UHF/VHF), Wi-Fi, and Bluetooth. Wireless networks present similar security risks to those of a wired network, and since the open airwaves are the communications medium for wireless technology, an entirely new set of risks are introduced. Implementing wireless computing and networking capabilities in accordance with the organization defined wireless policy, and allowing only authorized and qualified personnel to configure wireless services, greatly reduces vulnerabilities. For example, wireless networks use authentication protocols (e.g., EAP/TLS, PEAP), which provide credential protection and mutual authentication.

Description

Wireless technologies include, but are not limited to, microwave, satellite, packet radio (UHF/VHF), Wi-Fi, and Bluetooth. Wireless networks present similar security risks to those of a wired network, and since the open airwaves are the communications medium for wireless technology, an entirely new set of risks are introduced. Implementing wireless computing and networking capabilities in accordance with the organization defined wireless policy, and allowing only authorized and qualified personnel to configure wireless services, greatly reduces vulnerabilities. For example, wireless networks use authentication protocols (e.g., EAP/TLS, PEAP), which provide credential protection and mutual authentication.

STIG	Date
Mobile Policy Security Requirements Guide	2013-07-03

Details

Check Text ( C-44183r1_chk )
Review the organization's access control and security policy, procedures addressing wireless implementation, information system configuration settings, restrictions, and any other associated documentation. The objective is to ensure the organization's wireless security policy requires all wireless systems be authorized prior to connection. If wireless access is not authorized prior to connection, this is a finding.

Check Text ( C-44183r1_chk )

Review the organization's access control and security policy, procedures addressing wireless implementation, information system configuration settings, restrictions, and any other associated documentation. The objective is to ensure the organization's wireless security policy requires all wireless systems be authorized prior to connection. If wireless access is not authorized prior to connection, this is a finding.

Fix Text (F-40471r1_fix)
Establish a wireless access control and security policy to define the administrative procedures and technical requirements to be met prior to being authorized to connect to an organization's information system(s).