WLAN Access Point (Enclave-NIPRNet Connected) Security Technical Implementation Guide (STIG)

This STIG contains the technical security controls for the operation of a WLAN access point (Enclave-NIPRNet Connected role) in the DoD environment.

Details

Version / Release: V6R16

Published: 2019-10-02

Updated At: 2019-11-11 10:47:54

Compare/View Releases

Select any two versions of this STIG to compare the individual requirements

Select any old version/release of this STIG to view the previous requirements

Actions

Download

Filter


Findings
Severity Open Not Reviewed Not Applicable Not a Finding
Overall 0 0 0 0
Low 0 0 0 0
Medium 0 0 0 0
High 0 0 0 0
Drop CKL or SCAP (XCCDF) results here.

    Vuln Rule Version CCI Severity Title Description Status Finding Details Comments
    SV-3012r4_rule NET0230 HIGH Network devices must be password protected. Network access control mechanisms interoperate to prevent unauthorized access and to enforce the organization's security policy. Access to the network must be categorized as administrator, user, or guest so the appropriate authorization can be assigned to
    SV-3013r5_rule NET0340 MEDIUM Network devices must display the DoD-approved logon banner warning. All network devices must present a DoD-approved warning banner prior to a system administrator logging on. The banner should warn any unauthorized user not to proceed. It also should provide clear and unequivocal notice to both authorized and unauthorized
    SV-3014r4_rule NET1639 MEDIUM The network devices must timeout management connections for administrative access after 10 minutes or less of inactivity. Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled between the managed network device and a PC or terminal server when the later has been left
    SV-3043r4_rule NET1675 MEDIUM The network device must use different SNMP community names or groups for various levels of read and write access. Numerous vulnerabilities exist with SNMP; therefore, without unique SNMP community names, the risk of compromise is dramatically increased. This is especially true with vendors default community names which are widely known by hackers and other networking
    SV-3056r7_rule NET0460 HIGH Group accounts must not be configured for use on the network device. Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the
    SV-3057r6_rule NET0465 MEDIUM Authorized accounts must be assigned the least privilege level necessary to perform assigned duties. By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personnel are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mis
    SV-3058r5_rule NET0470 MEDIUM Unauthorized accounts must not be configured for access to the network device. A malicious user attempting to gain access to the network device may compromise an account that may be unauthorized for use. The unauthorized account may be a temporary or inactive account that is no longer needed to access the device. Denial of Service
    SV-3069r5_rule NET1638 MEDIUM Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules. Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted
    SV-3070r4_rule NET1640 LOW Network devices must log all attempts to establish a management connection for administrative access. Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. Wit
    SV-3143r4_rule NET0240 HIGH Network devices must not have any default manufacturer passwords. Network devices not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well-known; hence, not
    SV-3160r4_rule NET0700 MEDIUM Network devices must be running a current and supported operating system with all IAVMs addressed. Network devices not running the latest tested and approved versions of software are vulnerable to network attacks. Running the most current, approved version of system and device software helps the site maintain a stable base of security fixes and patches
    SV-3175r5_rule NET1636 HIGH The network device must require authentication prior to establishing a management connection for administrative access. Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network ou
    SV-3196r4_rule NET1660 HIGH The network device must use SNMP Version 3 Security Model with FIPS 140-2 validated cryptography for any SNMP agent configured on the device. SNMP Versions 1 and 2 are not considered secure. Without the strong authentication and privacy that is provided by the SNMP Version 3 User-based Security Model (USM), an unauthorized user can gain access to network management information used to launch an
    SV-3210r4_rule NET1665 HIGH The network device must not use the default or well-known SNMP community strings public and private. Network devices may be distributed by the vendor pre-configured with an SNMP agent using the well-known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network device usi
    SV-3692r3_rule WIR0115-01 MEDIUM WLAN must use EAP-TLS. EAP-TLS provides strong cryptographic mutual authentication and key distribution services not found in other EAP methods, and thus provides significantly more protection against attacks than other methods. Additionally, EAP-TLS supports two-factor user au
    SV-3966r6_rule NET0440 MEDIUM In the event the authentication server is unavailable, the network device must have a single local account of last resort defined. Authentication for administrative access to the device is required at all times. A single account of last resort can be created on the device's local database for use in an emergency such as when the authentication server is down or connectivity between t
    SV-3967r4_rule NET1624 MEDIUM The network devices must time out access to the console port at 10 minutes or less of inactivity. Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminati
    SV-3969r5_rule NET0894 MEDIUM Network devices must only allow SNMP read-only access. Enabling write access to the device via SNMP provides a mechanism that can be exploited by an attacker to set configuration variables that can disrupt network operations.Information Assurance Officer
    SV-4582r5_rule NET1623 HIGH The network device must require authentication for console access. Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Inform
    SV-5611r5_rule NET1637 MEDIUM The network devices must only allow management connections for administrative access from hosts residing in the management network. Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and c
    SV-5612r4_rule NET1645 MEDIUM The network devices must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions. An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and negotiating the SSH session reduces the window of opportunity for
    SV-5613r4_rule NET1646 MEDIUM The network device must be configured for a maximum number of unsuccessful SSH logon attempts set at 3 before resetting the interface. An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.Information Assurance Officer
    SV-7365r4_rule NET1629 LOW The auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication. The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the de
    SV-15327r6_rule NET0813 MEDIUM Network devices must authenticate all NTP messages received from NTP servers and peers. Since NTP is used to ensure accurate log file time stamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted
    SV-15459r4_rule NET1647 MEDIUM The network device must not allow SSH Version 1 to be used for administrative access. SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to attacks, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly
    SV-15614r1_rule WIR0105 LOW WLAN SSIDs must be changed from the manufacturer’s default to a pseudo random word that does not identify the unit, base, organization, etc. An SSID identifying the unit, site or purpose of the WLAN or is set to the manufacturer default may cause an OPSEC vulnerability.System Administrator
    SV-15654r2_rule WIR0135 MEDIUM Wireless access points and bridges must be placed in dedicated subnets outside the enclave’s perimeter. If an adversary is able to compromise an access point or controller that is directly connected to an enclave network, then the adversary can easily surveil and attack other devices from that beachhead. A defense-in-depth approach requires an additional la
    SV-15656r1_rule WIR0110 MEDIUM The WLAN inactive session timeout must be set for 30 minutes or less. A WLAN session that never terminates due to inactivity may allow an opening for an adversary to highjack the session to obtain access to the network. System Administrator
    SV-15657r1_rule WIR0120 LOW WLAN signals must not be intercepted outside areas authorized for WLAN access. Vulnerability Discussion: Most commercially-available WLAN equipment is pre-configured for signal power appropriate to most applications of the WLAN equipment. In some cases, this may permit the signals to be received outside the physical areas for which
    SV-16259r4_rule NET0433 MEDIUM Network devices must use two or more authentication servers for the purpose of granting administrative access. The use of Authentication, Authorization, and Accounting (AAA) affords the best methods for controlling user access, authorization levels, and activity logging. By enabling AAA on the routers in conjunction with an authentication server such as TACACS+ o
    SV-16261r5_rule NET0441 HIGH The emergency administration account must be set to an appropriate authorization level to perform necessary administrative functions when the authentication server is not online. The emergency administration account is to be configured as a local account on the network devices. It is to be used only when the authentication server is offline or not reachable via the network. The emergency account must be set to an appropriate autho
    SV-19075r4_rule NET0991 MEDIUM The network devices OOBM interface must be configured with an OOBM network address. The OOBM access switch will connect to the management interface of the managed network device. The management interface of the managed network device will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; there
    SV-19076r4_rule NET0992 MEDIUM The network devices management interface must be configured with both an ingress and egress ACL. The OOBM access switch will connect to the management interface of the managed network device. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface
    SV-28651r4_rule NET0812 LOW Network devices must use at least two NTP servers to synchronize time. Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If logs cannot be successfully compared between each of the routers, switches, and firewalls, it will be very difficult to determine the ex
    SV-36774r5_rule NET0405 MEDIUM A service or feature that calls home to the vendor must be disabled. Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that transmission of sensitive data sent to unauthorized persons could
    SV-39895r3_rule WIR0116 MEDIUM WLAN EAP-TLS implementation must use certificate-based PKI authentication to connect to DoD networks. DoD certificate-based PKI authentication is strong, two-factor authentication that relies on carefully evaluated cryptographic modules. Implementations of EAP-TLS that are not integrated with certificate-based PKI could have security vulnerabilities. For
    SV-102339r1_rule WIR0115-3 MEDIUM WLAN components must be FIPS 140-2 certified. If the DoD WLAN components (WLAN AP, controller, or client) are not NIST FIPS 140-2 (Cryptographic Module Validation Program – CMVP) certified, the WLAN system may not adequately protect sensitive unclassified DoD data from compromise during transmissio
    SV-102341r1_rule WIR0114-1 MEDIUM WLAN components must be Wi-Fi Alliance certified with WPA2 or WPA3.
    SV-106521r1_rule NET-WIDS-010 CCI-001673 MEDIUM The site must conduct continuous wireless Intrusion Detection System (IDS) scanning. DoD networks are at risk and DoD data could be compromised if wireless scanning is not conducted to identify unauthorized WLAN clients and access points connected to or attempting to connect to the network.