STIGQter: STIG Summary: Network WLAN AP-IG Platform Security Technical Implementation Guide Version: 7 Release: 3 Benchmark Date: 27 Apr 2023:

WLAN signals must not be intercepted outside areas authorized for WLAN access.

DISA Rule

SV-243211r856608_rule

Vulnerability Number

V-243211

Group Title

SRG-NET-000384

Rule Version

WLAN-NW-000800

Severity

CAT III

CCI(s)

• CCI-002683 - Detect network services that have not been authorized or approved by the organization-defined authorization or approval processes.

Weight

10

Fix Recommendation

Move access points to areas in which signals do not emanate in a way that makes them usable outside the areas authorized for WLAN access.

Alternatively, replace omni-directional antennae with directional antennae if this will solve the problem.

If these solutions are not effective, adjust the transmission power settings on the access point to reduce the usability of signals in unauthorized areas.

If the WLAN equipment does not allow the transmission power to be adjusted, and the access points are placed in a location where the ISSO determines there is significant risk that an adversary could be present where signals may be intercepted, the site should procure WLAN equipment that permits power adjustment.

Check Contents

Review documentation and inspect access point locations.

1. Review documentation showing signal strength analysis from site survey activities, if available.
2. Use testing equipment or WLAN clients to determine if the signal strength is, in the reviewer's judgment, excessively outside the required area (e.g., strong signal in the parking area, public areas, or uncontrolled spaces).
3. Lower-end access points will not have this setting available. In this case, verify the access points are located away from exterior walls to achieve compliance with this requirement.

If any of the following is found, this is a finding:
- Visual inspection of equipment shows obvious improper placement of access points where they will emanate into uncontrolled spaces (e.g., next to external walls, windows, or doors; uncontrolled areas; or public areas).
- Building walk-through testing shows signals of sufficient quality and strength to allow wireless access to exist in areas not authorized for WLAN access.

Vulnerability Number

V-243211

Documentable

False

Rule Version

WLAN-NW-000800

Severity Override Guidance

Review documentation and inspect access point locations.

1. Review documentation showing signal strength analysis from site survey activities, if available.
2. Use testing equipment or WLAN clients to determine if the signal strength is, in the reviewer's judgment, excessively outside the required area (e.g., strong signal in the parking area, public areas, or uncontrolled spaces).
3. Lower-end access points will not have this setting available. In this case, verify the access points are located away from exterior walls to achieve compliance with this requirement.

If any of the following is found, this is a finding:
- Visual inspection of equipment shows obvious improper placement of access points where they will emanate into uncontrolled spaces (e.g., next to external walls, windows, or doors; uncontrolled areas; or public areas).
- Building walk-through testing shows signals of sufficient quality and strength to allow wireless access to exist in areas not authorized for WLAN access.

Check Content Reference

M

Target Key

5395