UCF STIG Viewer Logo

WMAN Access Point Security Technical Implementation Guide (STIG)



Findings (MAC III - Administrative Sensitive)

Finding ID Severity Title
V-4582 High The network device must require authentication for console access.
V-3056 High Group accounts must not be configured for use on the network device.
V-15434 High The emergency administration account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online.
V-3012 High Network devices must be password protected.
V-3210 High The network device must not use the default or well-known SNMP community strings public and private.
V-3143 High Network devices must not have any default manufacturer passwords.
V-18604 High A WMAN system transmitting classified data must implement required data encryption controls.
V-3175 High The network device must require authentication prior to establishing a management connection for administrative access.
V-3196 High The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device.
V-14207 Medium WMAN systems must require strong authentication from the user or WMAN subscriber device to WMAN network.
V-3069 Medium Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.
V-14671 Medium Network devices must authenticate all NTP messages received from NTP servers and peers.
V-19903 Medium Site WMAN systems must implement strong authentication from the user or WMAN subscriber device to WMAN network.
V-3043 Medium The network device must use different SNMP community names or groups for various levels of read and write access.
V-14717 Medium The network device must not allow SSH Version 1 to be used for administrative access.
V-19904 Medium Site WMAN systems must implement strong authentication from the user or WMAN subscriber device to WMAN network.
V-3057 Medium Authorized accounts must be assigned the least privilege level necessary to perform assigned duties.
V-3160 Medium Network devices must be running a current and supported operating system with all IAVMs addressed.
V-15432 Medium Network devices must use two or more authentication servers for the purpose of granting administrative access.
V-3013 Medium Network devices must display the DoD-approved logon banner warning.
V-3058 Medium Unauthorized accounts must not be configured for access to the network device.
V-14886 Medium Wireless access points and bridges must be placed in dedicated subnets outside the enclave’s perimeter.
V-3969 Medium Network devices must only allow SNMP read-only access.
V-28784 Medium A service or feature that calls home to the vendor must be disabled.
V-3967 Medium The network devices must time out access to the console port at 10 minutes or less of inactivity.
V-3966 Medium In the event the authentication server is unavailable, the network device must have a single local account of last resort defined.
V-17821 Medium The network devices OOBM interface must be configured with an OOBM network address.
V-17822 Medium The network devices management interface must be configured with both an ingress and egress ACL.
V-18605 Medium The WMAN site must perform periodic wireless IDS screening in all areas where WMAN coverage exists to prevent unauthorized access, jamming, or electromagnetic interference.
V-18603 Medium Site WMAN systems that transmit unclassified data must implement required data encryption controls.
V-18602 Medium When a WMAN system is implemented, the network enclave must enforce strong authentication from user to DoD enclave (wired network). For “User to Enclave” authentication, the enclave must enforce network authentication requirements found in USCYBERCOM CTO 07-15Rev1 (or subsequent updates) (e.g. CAC authentication). Note: User authentication to the enclave must be a separate process from authentication to the WMAN system. If the WMAN vendor implements CAC authentication for the User or WMAN subscriber device to WMAN network, the user may only need to enter their PIN once to authenticate to both the WMAN system and the enclave.
V-5613 Medium The network device must be configured for a maximum number of unsuccessful SSH logon attempts set at 3 before resetting the interface.
V-5611 Medium The network devices must only allow management connections for administrative access from hosts residing in the management network.
V-3014 Medium The network devices must timeout management connections for administrative access after 10 minutes or less of inactivity.
V-23747 Low Network devices must use at least two NTP servers to synchronize time.
V-18598 Low The WMAN system must not operate in the 3.30-3.65 GHz frequency band.
V-18617 Low A site must use a WMAN system in compliance with Committee on National Security Systems Policy (CNSSP) 300: the Department or Agency Certified TEMPEST Technical Authority (CTTA) has evaluated the system to determine its TEMPEST vulnerability and provided this information to the DAA.
V-7011 Low The auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.
V-3070 Low Network devices must log all attempts to establish a management connection for administrative access.
V-18606 Low The WMAN site must implement required procedures for reporting the results of WMAN intrusion scans.
V-18601 Low An appropriate WMAN coverage area must be reasonably sized and constrained to the areas intended for WMAN signals.
V-18600 Low If the WMAN system is a tactical system or a commercial system operated in a tactical environment, the site WMAN system DIACAP must include a Transmission Security (TRANSEC) vulnerability analysis.