AC-18 Wireless Access
Review AC-18
1. Set its parameters
No parameters to set for AC-18.
2. Record its status
a.Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and
b.Authorize each type of wireless access to the system prior to allowing such connections.
Discussion
Wireless technologies include microwave, packet radio (ultra-high frequency or very high frequency), 802.11x, and Bluetooth. Wireless networks use authentication protocols that provide authenticator protection and mutual authentication.
Enhancements
Review AC-18(1)
1. Set its parameters
No parameters to set for AC-18(1).
2. Record its status
Protect wireless access to the system using authentication of [Selection (one-or-more): users; devices] and encryption.
Discussion
Wireless networking capabilities represent a significant potential vulnerability that can be exploited by adversaries. To protect systems with wireless access points, strong authentication of users and devices along with strong encryption can reduce susceptibility to threats by adversaries involving wireless technologies.
Review AC-18(3)
1. Set its parameters
No parameters to set for AC-18(3).
2. Record its status
Disable, when not intended for use, wireless networking capabilities embedded within system components prior to issuance and deployment.
Discussion
Wireless networking capabilities that are embedded within system components represent a significant potential vulnerability that can be exploited by adversaries. Disabling wireless capabilities when not needed for essential organizational missions or functions can reduce susceptibility to threats by adversaries involving wireless technologies.
Review AC-18(4)
1. Set its parameters
No parameters to set for AC-18(4).
2. Record its status
Identify and explicitly authorize users allowed to independently configure wireless networking capabilities.
Discussion
Organizational authorizations to allow selected users to configure wireless networking capabilities are enforced, in part, by the access enforcement mechanisms employed within organizational systems.
Review AC-18(5)
1. Set its parameters
No parameters to set for AC-18(5).
2. Record its status
Select radio antennas and calibrate transmission power levels to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.
Discussion
Actions that may be taken to limit unauthorized use of wireless communications outside of organization-controlled boundaries include reducing the power of wireless transmissions so that the transmissions are less likely to emit a signal that can be captured outside of the physical perimeters of the organization, employing measures such as emissions security to control wireless emanations, and using directional or beamforming antennas that reduce the likelihood that unintended receivers will be able to intercept signals. Prior to taking such mitigating actions, organizations can conduct periodic wireless surveys to understand the radio frequency profile of organizational systems as well as other systems that may be operating in the area.
No Enhancements match this Baseline.