Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

WMAN Access Point Security Technical Implementation Guide (STIG)

V6R7 · · · Released 25 Apr 2014 · 33 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

This STIG contains the technical security controls for the operation of a WMAN Access Point in the DoD environment.
Digest of Updates vs. V6R7 · 25 Apr 2014 No substantive changes

Comparison against the immediately-prior release (V6R7). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.

No substantive changes detected against the previous release. 33 rules matched cleanly.

Sort by
b
The network element must timeout management connections for administrative access after 10 minutes or less of inactivity.
Medium - V-3014 - SV-3014r2_rule
RMF Control
Severity
M
CCI
Version
NET1639
Vuln IDs
  • V-3014
Rule IDs
  • SV-3014r2_rule
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled between the managed network element and a PC or terminal server when the later has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network element as well as reduce the risk of a management session from being hijacked. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.Information Assurance OfficerECSC-1
Checks: C-3540r4_chk

Review the management connection for administrative access and verify the network element is configured to time-out the connection after 10 minutes or less of inactivity.

Fix: F-3039r4_fix

Configure the network element to ensure the timeout for unattended administrative access connections is no longer than 10 minutes.

c
Group accounts must not be configured for use on the network device.
High - V-3056 - SV-3056r5_rule
RMF Control
Severity
H
CCI
Version
NET0460
Vuln IDs
  • V-3056
Rule IDs
  • SV-3056r5_rule
Group accounts configured for use on a network device do not allow for accountability or repudiation of individuals using the shared account. If group accounts are not changed when someone leaves the group, that person could possibly gain control of the network device. Having group accounts does not allow for proper auditing of who is accessing or changing the network.Information Assurance OfficerIAIA-1, IAIA-2
Checks: C-3503r9_chk

Review the network device configuration and validate there are no group accounts configured for access.

Fix: F-3081r9_fix

Configure individual user accounts for each authorized person then remove any group accounts.

b
Authorized accounts must be assigned the least privilege level necessary to perform assigned duties.
Medium - V-3057 - SV-3057r3_rule
RMF Control
Severity
M
CCI
Version
NET0465
Vuln IDs
  • V-3057
Rule IDs
  • SV-3057r3_rule
By not restricting authorized accounts to their proper privilege level, access to restricted functions may be allowed before authorized personell are trained or experienced enough to use those functions. Network disruptions or outages may occur due to mistakes made by inexperienced persons using accounts with greater privileges than necessary.Information Assurance OfficerECSC-1
Checks: C-3504r6_chk

Review the accounts authorized for access to the network device. Determine if the accounts are assigned the lowest privilege level necessary to perform assigned duties. User accounts must be set to a specific privilege level which can be mapped to specific commands or a group of commands. Authorized accounts should have the greatest privilege level unless deemed necessary for assigned duties. If it is determined that authorized accounts are assigned to greater privileges than necessary, this is a finding.

Fix: F-3082r5_fix

Configure authorized accounts with the least privilege rule. Each user will have access to only the privileges they require to perform their assigned duties.

b
Management connections to a network device must be established using secure protocols with FIPS 140-2 validated cryptographic modules.
Medium - V-3069 - SV-3069r3_rule
RMF Control
Severity
M
CCI
Version
NET1638
Vuln IDs
  • V-3069
Rule IDs
  • SV-3069r3_rule
Administration and management connections performed across a network are inherently dangerous because anyone with a packet sniffer and access to the right LAN segment can acquire the network device account and password information. With this intercepted information they could gain access to the router and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.Information Assurance OfficerDCNR-1, ECSC-1
Checks: C-3532r7_chk

Review the network device configuration to verify only secure protocols using FIPS 140-2 validated cryptographic modules are used for any administrative access. Some of the secure protocols used for administrative and management access are listed below. This list is not all inclusive and represents a sample selection of secure protocols. -SSHv2 -SCP -HTTPS -SSL -TLS If management connections are established using protocols without FIPS 140-2 validated cryptographic modules, this is a finding.

Fix: F-3094r5_fix

Configure the network device to use secure protocols with FIPS 140-2 validated cryptographic modules.

a
The network element must log all attempts to establish a management connection for administrative access.
Low - V-3070 - SV-3070r2_rule
RMF Control
Severity
L
CCI
Version
NET1640
Vuln IDs
  • V-3070
Rule IDs
  • SV-3070r2_rule
Audit logs are necessary to provide a trail of evidence in case the network is compromised. Without an audit trail that provides a when, where, who and how set of information, repeat offenders could continue attacks against the network indefinitely. With this information, the network administrator can devise ways to block the attack and possibly identify and prosecute the attacker.Information Assurance OfficerECAT-1, ECAT-2
Checks: C-3542r4_chk

Review the configuration to verify all attempts to access the device via management connection are logged.

Fix: F-3095r3_fix

Configure the device to log all access attempts to the device to establish a management connection for administrative access.

c
The network element must not have any default manufacturer passwords.
High - V-3143 - SV-3143r2_rule
RMF Control
Severity
H
CCI
Version
NET0240
Vuln IDs
  • V-3143
Rule IDs
  • SV-3143r2_rule
Network elements not protected with strong password schemes provide the opportunity for anyone to crack the password thus gaining access to the device and causing network outage or denial of service. Many default vendor passwords are well known; hence, not removing them prior to deploying the network element into production provides an opportunity for a malicious user to gain unauthorized access to the device.Information Assurance OfficerECSC-1
Checks: C-40236r1_chk

Review the network element configuration to determine if the vendor default password is active.

Fix: F-35391r2_fix

Remove any vendor default passwords from the network element configuration.

c
The network device must require authentication prior to establishing a management connection for administrative access.
High - V-3175 - SV-3175r3_rule
RMF Control
Severity
H
CCI
Version
NET1636
Vuln IDs
  • V-3175
Rule IDs
  • SV-3175r3_rule
Network devices with no password for administrative access via a management connection provide the opportunity for anyone with network access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Information Assurance OfficerECSC-1
Checks: C-3516r7_chk

Review the network device configuration to verify all management connections for administrative access require authentication.

Fix: F-3200r3_fix

Configure authentication for all management connections.

c
The network element must not use the default or well-known SNMP community strings public and private.
High - V-3210 - SV-3210r2_rule
RMF Control
Severity
H
CCI
Version
NET1665
Vuln IDs
  • V-3210
Rule IDs
  • SV-3210r2_rule
Network elements may be distributed by the vendor pre-configured with an SNMP agent using the well known SNMP community strings public for read only and private for read and write authorization. An attacker can obtain information about a network element using the read community string "public". In addition, an attacker can change a system configuration using the write community string "private".Information Assurance OfficerECSC-1, IAIA-1, IAIA-2
Checks: C-3822r5_chk

Review the network element configuration and verify if either of the SNMP community strings “public” or “private” is being used.

Fix: F-3235r4_fix

Configure unique SNMP community strings replacing the default community strings.

b
The network element must time out access to the console port after 10 minutes or less of inactivity.
Medium - V-3967 - SV-3967r2_rule
RMF Control
Severity
M
CCI
Version
NET1624
Vuln IDs
  • V-3967
Rule IDs
  • SV-3967r2_rule
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition quickly terminating an idle session will also free up resources committed by the managed network element. Setting the timeout of the session to 10 minutes or less increases the level of protection afforded critical network components.Information Assurance OfficerECSC-1
Checks: C-3511r3_chk

Review the configuration and verify a session using the console port will time out after 10 minutes or less of inactivity.

Fix: F-3900r4_fix

Configure the timeout for idle console connection to 10 minutes or less.

c
The network device must require authentication for console access.
High - V-4582 - SV-4582r3_rule
RMF Control
Severity
H
CCI
Version
NET1623
Vuln IDs
  • V-4582
Rule IDs
  • SV-4582r3_rule
Network devices with no password for administrative access via the console provide the opportunity for anyone with physical access to the device to make configuration changes enabling them to disrupt network operations resulting in a network outage.Information Assurance OfficerIAIA-1, IAIA-2
Checks: C-3510r4_chk

Review the network device's configuration and verify authentication is required for console access.

Fix: F-4515r4_fix

Configure authentication for console access on the network device.

b
The network element must only allow management connections for administrative access from hosts residing in the management network.
Medium - V-5611 - SV-5611r2_rule
RMF Control
Severity
M
CCI
Version
NET1637
Vuln IDs
  • V-5611
Rule IDs
  • SV-5611r2_rule
Remote administration is inherently dangerous because anyone with a sniffer and access to the right LAN segment, could acquire the device account and password information. With this intercepted information they could gain access to the infrastructure and cause denial of service attacks, intercept sensitive information, or perform other destructive actions.Information Assurance OfficerECSC-1
Checks: C-3527r4_chk

Review the configuration and verify management access to the device is allowed only from hosts within the management network.

Fix: F-5522r3_fix

Configure an ACL or filter to restrict management access to the device from only the management network.

b
The network element must be configured to timeout after 60 seconds or less for incomplete or broken SSH sessions.
Medium - V-5612 - SV-5612r2_rule
RMF Control
Severity
M
CCI
Version
NET1645
Vuln IDs
  • V-5612
Rule IDs
  • SV-5612r2_rule
An attacker may attempt to connect to the device using SSH by guessing the authentication method, encryption algorithm, and keys. Limiting the amount of time allowed for authenticating and negotiating the SSH session reduces the window of opportunity for the malicious user attempting to make a connection to the network element.Information Assurance OfficerECSC-1
Checks: C-3534r4_chk

Review the configuration and verify the timeout is set for 60 seconds or less. The SSH service terminates the connection if protocol negotiation (that includes user authentication) is not complete within this timeout period.

Fix: F-5523r4_fix

Configure the network element so it will require a secure shell timeout of 60 seconds or less.

b
The network element must be configured for a maximum number of unsuccessful SSH login attempts set at 3 before resetting the interface.
Medium - V-5613 - SV-5613r2_rule
RMF Control
Severity
M
CCI
Version
NET1646
Vuln IDs
  • V-5613
Rule IDs
  • SV-5613r2_rule
An attacker may attempt to connect to the device using SSH by guessing the authentication method and authentication key or shared secret. Setting the authentication retry to 3 or less strengthens against a Brute Force attack.Information Assurance OfficerECSC-1
Checks: C-3538r4_chk

Review the configuration and verify the number of unsuccessful SSH login attempts is set at 3.

Fix: F-5524r7_fix

Configure the network element to require a maximum number of unsuccessful SSH login attempts at 3.

a
The network element’s auxiliary port must be disabled unless it is connected to a secured modem providing encryption and authentication.
Low - V-7011 - SV-7365r2_rule
RMF Control
Severity
L
CCI
Version
NET1629
Vuln IDs
  • V-7011
Rule IDs
  • SV-7365r2_rule
The use of POTS lines to modems connecting to network devices provides clear text of authentication traffic over commercial circuits that could be captured and used to compromise the network. Additional war dial attacks on the device could degrade the device and the production network. Secured modem devices must be able to authenticate users and must negotiate a key exchange before full encryption takes place. The modem will provide full encryption capability (Triple DES) or stronger. The technician who manages these devices will be authenticated using a key fob and granted access to the appropriate maintenance port, thus the technician will gain access to the managed device (router, switch, etc.). The token provides a method of strong (two-factor) user authentication. The token works in conjunction with a server to generate one-time user passwords that will change values at second intervals. The user must know a personal identification number (PIN) and possess the token to be allowed access to the device.Information Assurance OfficerECSC-1
Checks: C-3513r3_chk

Review the configuration and verify the auxiliary port is disabled unless a secured modem providing encryption and authentication is connected.

Fix: F-6614r3_fix

Disable the auxiliary port. If used for out-of-band administrative access, the port must be connected to a secured modem providing encryption and authentication.

b
WMAN systems must require strong authentication from the user or WMAN subscriber device to WMAN network.
Medium - V-14207 - SV-14818r1_rule
RMF Control
Severity
M
CCI
Version
WIR0315-01
Vuln IDs
  • V-14207
Rule IDs
  • SV-14818r1_rule
Broadband systems not compliant with authentication requirements could allow a hacker to gain access to the DoD network.Information Assurance OfficerECSC-1, ECWN-1
Checks: C-22269r1_chk

Detailed Policy Requirements: The site WMAN systems will implement strong authentication from the User or WMAN subscriber device to WMAN network. For tactical WMAN systems or commercial WMAN systems operated in a tactical environment, two factor authentication is required, at a minimum. Note: Examples of two-factor authentication are password with biometrics or CAC with PIN. In cases where there are no available WMAN technology solutions that meets this requirement, the local DAA may grant an exception to this requirement until such time as a WMAN product is available that meets this requirement. The exception must be documented during the system DIACAP and in the site SSAA/SSP. At a minimum, the system must meet the authentication requirements of non-tactical WMAN systems. -For tactical or commercial WMAN systems operated in a non-tactical environment, this check does not apply: Checks WIR0315-02 and WIR0315-02 apply. Check Procedures: - Determine if the WMAN system is used in a tactical or non-tactical environment. - Review the WMAN system product documentation (specification sheet, network administration manual, installation manual, etc.) to determine what authentication mechanism is supported between the user/subscriber device and WMAN network. - Review the authentication configuration configured on the WMAN access point. (Have the system administrator and user show you the setting.) - Verify “User or WMAN subscriber device to WMAN network” authentication meets requirements. --For WMAN systems operated in a tactical environment, two factor authentication is required, at a minimum, unless the DAA has approved an exception based on the unavailability of a WMAN product that meets this requirement. Determine if two factor authentication is used (e.g. CAC) or if the DAA has granted an exception. If the DAA has granted an exception, verify the exception has been noted in the site’s SSAA/SSP and that the system meets the requirements for non-tactical authentication. -Mark as a finding if the authentication requirements are not met.

Fix: F-34138r1_fix

Implement strong authentication for the user or device to the WMAN network.

b
The network element must authenticate all NTP messages received from NTP servers and peers.
Medium - V-14671 - SV-15327r2_rule
RMF Control
Severity
M
CCI
Version
NET0813
Vuln IDs
  • V-14671
Rule IDs
  • SV-15327r2_rule
Since NTP is used to ensure accurate log file timestamp information, NTP could pose a security risk if a malicious user were able to falsify NTP information. To launch an attack on the NTP infrastructure, a hacker could inject time that would be accepted by NTP clients by spoofing the IP address of a valid NTP server. To mitigate this risk, the time messages must be authenticated by the client before accepting them as a time source. Two NTP-enabled devices can communicate in either client-server mode or peer-to-peer mode (aka “symmetric mode”). The peering mode is configured manually on the device and indicated in the outgoing NTP packets. The fundamental difference is the synchronization behavior: an NTP server can synchronize to a peer with better stratum, whereas it will never synchronize to its client regardless of the client’s stratum. From a protocol perspective, NTP clients are no different from the NTP servers. The NTP client can synchronize to multiple NTP servers, select the best server and synchronize with it, or synchronize to the averaged value returned by the servers. A hierarchical model can be used to improve scalability. With this implementation, an NTP client can also become an NTP server providing time to downstream clients at a higher stratum level and of decreasing accuracy than that of its upstream server. To increase availability, NTP peering can be used between NTP servers. In the event the device looses connectivity to it upstream NTP server, it will be able to choose time from one of its peers. The NTP authentication model is opposite of the typical client-server authentication model. NTP authentication enables an NTP client or peer to authenticate time received from their servers and peers. It’s not used to authenticate NTP clients because NTP servers don’t care about the authenticity of their clients, as they never accept any time from them. Information Assurance OfficerECSC-1
Checks: C-12793r5_chk

Review the device configuration and verify it is authenticating the NTP messages received from the NTP server or peer. Authentication must be performed using either PKI (supported in NTP v4) or SHA-1 hashing algorithm. If SHA-1 is not supported by both the NTP client and server, then MD5 can be used.

Fix: F-14132r1_fix

Configure the device to authenticate all received NTP messages using either PKI (supported in NTP v4) or SHA-1 hashing algorithm. If SHA-1 is not supported by this client or the NTP peer or server, then MD5 can be used.

b
The network element must not allow SSH Version 1 to be used for administrative access.
Medium - V-14717 - SV-15459r2_rule
RMF Control
Severity
M
CCI
Version
NET1647
Vuln IDs
  • V-14717
Rule IDs
  • SV-15459r2_rule
SSH Version 1 is a protocol that has never been defined in a standard. Since SSH-1 has inherent design flaws which make it vulnerable to attacks, e.g., man-in-the-middle attacks, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1. Information Assurance OfficerECSC-1
Checks: C-12924r6_chk

Review the configuration and verify SSH Version 1 is not being used for administrative access.

Fix: F-14184r3_fix

Configure the network element to use SSH version 2.

a
The relevant U.S. Forces Command (USFORSCOM) or host nation must approve the use of wireless equipment prior to operation of such equipment outside the United States and Its Possessions (US&P).
Low - V-14844 - SV-15612r1_rule
RMF Control
Severity
L
CCI
Version
WIR0100
Vuln IDs
  • V-14844
Rule IDs
  • SV-15612r1_rule
When using a wireless system outside of the US&P, host nation wireless spectrum regulations must be followed. Otherwise the system could interfere with or be disrupted by host nation communications systems.Information Assurance OfficerDesignated Approving AuthorityEBCR-1
Checks: C-13274r1_chk

1. Verify existence of approval documentation signed by U.S. Forces Command or host nation representatives. 2. In accordance with DoD policy, users of non-licensed devices that are intended for use outside of the US&P must submit appropriate forms (DD 1494) for host nation coordination/approval. This is not necessary when it is well known that the host nation makes wide use of the same WLAN protocols as the DoD (i.e., 802.11b, 802.11g, or 802.11n). However, this should be verified. Most noteworthy is that WLAN equipment in Japan uses 802.11j which operates in the 4.9 to 5.0 GHz band. WLAN equipment based on other standards interferes with such equipment in Japan. 3. Mark as a finding if approval documentation does not exist or is not available for verification.

Fix: F-14435r1_fix

The IAO will ensure required approvals are received before wireless equipment / system is activated.

b
Wireless access points and bridges must be placed in dedicated subnets outside the enclave’s perimeter.
Medium - V-14886 - SV-15654r1_rule
RMF Control
Severity
M
CCI
Version
WIR0135
Vuln IDs
  • V-14886
Rule IDs
  • SV-15654r1_rule
If an adversary is able to compromise an access point or controller that is directly connected to an enclave network, then the adversary can easily surveil and attack other devices from that beachhead. A defense-in-depth approach requires an additional layer of protection exist between the WLAN and the enclave network. This is particularly important for wireless networks, which may be vulnerable to attack from outside physical perimeter of the facility or base given the inherent nature of radio communications to penetrate walls, fences, and other physical boundaries. See diagram in checklist. System AdministratorInformation Assurance OfficerECSC-1, ECTM-2, ECWN-1
Checks: C-13412r1_chk

Detailed policy requirements: Wireless access points and bridges must not be directly connected to the enclave network. A network device must separate wireless access from other elements of the enclave network. Sites must also comply with the Network Infrastructure STIG configuration requirements for DMZ, VLAN, and VPN configurations, as applicable. Examples of acceptable architectures include placing access points or controllers in a screened subnet (e.g. DMZ separating intranet and wireless network) or dedicated virtual LAN (VLAN). Additional discussion of WLAN architectures is found in the Wireless Overview document contained in the Wireless STIG package. NOTE: See Figure 3-1 in the Wireless STIG for an example of an acceptable network architecture. Check Procedures: Review network architecture with the network administrator. 1. Verify compliance by inspecting the site network topology diagrams. 2. Since many network diagrams are not kept up-to-date, walk through the connections with the network administrator using network management tools or diagnostic commands to verify the diagrams are current. Mark as a finding if site wireless infrastructure such as access points and bridges are not isolated from the enclave network.

Fix: F-3448r1_fix

Remove wireless network devices with direct connections to an enclave network. If feasible, reconfigure network connections to isolate the WLAN infrastructure from the enclave network, separating them with a firewall or equivalent protection.

b
The network element’s OOBM interface must be configured with an OOBM network address.
Medium - V-17821 - SV-19075r2_rule
RMF Control
Severity
M
CCI
Version
NET0991
Vuln IDs
  • V-17821
Rule IDs
  • SV-19075r2_rule
The OOBM access switch will connect to the management interface of the managed network elements. The management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the OOBM interface does not have an IP address from the managed network address space, it will not have reachability from the NOC using scalable and normal control plane and forwarding mechanisms.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-19238r3_chk

The managed network element’s OOBM interface must be configured with an IP address from the address space belonging to the OOBM network. After determining which interface is connected to the OOBM access switch, review the managed device configuration and verify the interface has been assigned an address from the local management address block.

Fix: F-17736r1_fix

Configure the managed network element’s OOBM interface with an IP address from the address space belonging to the OOBM network.

b
The network elements management interface must be configured with both an ingress and egress ACL.
Medium - V-17822 - SV-19076r2_rule
RMF Control
Severity
M
CCI
Version
NET0992
Vuln IDs
  • V-17822
Rule IDs
  • SV-19076r2_rule
The OOBM access switch will connect to the management interface of the managed network elements. The management interface can be a true OOBM interface or a standard interface functioning as the management interface. In either case, the management interface of the managed network element will be directly connected to the OOBM network. An OOBM interface does not forward transit traffic; thereby, providing complete separation of production and management traffic. Since all management traffic is immediately forwarded into the management network, it is not exposed to possible tampering. The separation also ensures that congestion or failures in the managed network do not affect the management of the device. If the device does not have an OOBM port, the interface functioning as the management interface must be configured so that management traffic does not leak into the managed network and that production traffic does not leak into the management network.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-19239r4_chk

Step 1: Verify the managed interface has an inbound and outbound ACL or filter. Step 2: Verify the ingress ACL blocks all transit traffic—that is, any traffic not destined to the router itself. In addition, traffic accessing the managed elements should be originated at the NOC. Step 3: Verify the egress ACL blocks any traffic not originated by the managed element.

Fix: F-17737r1_fix

If the management interface is a routed interface, it must be configured with both an ingress and egress ACL. The ingress ACL should block any transit traffic, while the egress ACL should block any traffic that was not originated by the managed network elements.

a
The WMAN system must not operate in the 3.30-3.65 GHz frequency band.
Low - V-18598 - SV-20147r1_rule
RMF Control
Severity
L
CCI
Version
WIR0300
Vuln IDs
  • V-18598
Rule IDs
  • SV-20147r1_rule
DoD RADAR systems operate in the 3.30-3.65 GHz frequency band. If the WMAN system operates in the same band, it could potentially interfere with RADAR operations and undermine the mission the RADAR supports. System AdministratorInformation Assurance OfficerDesignated Approving AuthorityECWN-1
Checks: C-22262r1_chk

Review the WMAN system data specification sheet (for both the AP or bridge). Verify the WMAN system does not operate in the 3.30 – 3.65 GHz frequency band. Mark as a finding if the WMAN system does not meet the requirement.

Fix: F-19234r1_fix

Reconfigure the WMAN system so that it does not operate in the 3.30 – 3.65 GHz frequency band.

a
An appropriate WMAN coverage area must be reasonably sized and constrained to the areas intended for WMAN signals.
Low - V-18601 - SV-20152r1_rule
RMF Control
Severity
L
CCI
Version
WIR0310
Vuln IDs
  • V-18601
Rule IDs
  • SV-20152r1_rule
Wireless signals could be intercepted more easily by an adversary if the coverage area is not appropriately sized. If an adversary is able to intercept wireless signals, it is possible to obtain information about the location and intensity of DoD operations. If DoD data is not encrypted in transit, then the adversary will be able to capture it.Information Assurance OfficerDesignated Approving AuthorityECWN-1
Checks: C-22267r1_chk

NOTE: This check should only be reviewed during the initial system Certification and Accreditation (C&A). Review the site SSP/SSAA and other DIACAP documentation. Verify an appropriate WMAN coverage area was determined during system design or the DIACAP. Compare the actual radio coverage of WMAN system with the intended coverage area map. Mark as a finding if the actual usable radio coverage in any direction is 10% greater (or more) than shown on the intended coverage area map.

Fix: F-34150r1_fix

Implement a solution to constrain signals to areas in which they are intended to be received. Potential technical actions include using directional antennas or changing radio transmission power. If the coverage map does not reflect the operational requirement, it may be updated so that the current system is in compliance.

b
When a WMAN system is implemented, the network enclave must enforce strong authentication from user to DoD enclave (wired network). For “User to Enclave” authentication, the enclave must enforce network authentication requirements found in USCYBERCOM CTO 07-15Rev1 (or subsequent updates) (e.g. CAC authentication). Note: User authentication to the enclave must be a separate process from authentication to the WMAN system. If the WMAN vendor implements CAC authentication for the User or WMAN subscriber device to WMAN network, the user may only need to enter their PIN once to authenticate to both the WMAN system and the enclave.
Medium - V-18602 - SV-20153r1_rule
RMF Control
Severity
M
CCI
Version
WIR0320
Vuln IDs
  • V-18602
Rule IDs
  • SV-20153r1_rule
Without strong user authentication to the network a hacker may be able to gain access.ECWN-1
Checks: C-22268r1_chk

Interview the IAO and network system administrator to determine if the site’s network is configured to require CAC authentication before a WMAN user is connected to the network. If possible, have a user set up a WMAN connection and verify the user is required to CAC authenticate before they gain access to the local network. Mark as a finding if a WMAN user is not required to CAC authenticate to the network prior to gaining network access.

Fix: F-14436r1_fix

Comply with policy.

b
Site WMAN systems that transmit unclassified data must implement required data encryption controls.
Medium - V-18603 - SV-20154r1_rule
RMF Control
Severity
M
CCI
Version
WIR0325
Vuln IDs
  • V-18603
Rule IDs
  • SV-20154r1_rule
Sensitive DoD data could be exposed to a hacker.Information Assurance OfficerECWN-1
Checks: C-22270r1_chk

Detailed policy requirements: Site WMAN systems that transmit unclassified data must implement the following data encryption controls: - For tactical WMAN systems or commercial WMAN systems operated in a tactical environment: --The WMAN system must implement FIPS 140-2 validated encryption to protect the ISO OSI Layer 2 radio data frames. The WMAN system must be configured for AES-CCM encryption, if supported by the WMAN system. --The WMAN system must implement FIPS 140-2 validated encryption to protect the ISO OSI Layer 3 data being transmitted. - For tactical WMAN systems or commercial WMAN systems operated in a non-tactical environment and for WMAN bridges: --The WMAN system must implement FIPS 140-2 validated encryption at ISO OSI Layer 2 or 3. Check Procedures: Verify with the IAO that site WMAN systems transmitting unclassified data implement the following data encryption controls: For tactical WMAN systems or commercial WMAN systems operated in a tactical environment: - The WMAN system must implement FIPS 140-2 validated encryption to protect the ISO OSI Layer 2 radio data frames. The WMAN system will be configured for AES-CCM encryption, if supported by the WMAN system. - The WMAN system must implement FIPS 140-2 validated encryption to protect the ISO OSI Layer 3 data being transmitted. For tactical WMAN systems or commercial WMAN systems operated in a non-tactical environment: - The WMAN system must implement FIPS 140-2 validated encryption at ISO OSI Layer 2 or 3. Mark as a finding if these requirements are not met.

Fix: F-14436r1_fix

Comply with policy.

c
A WMAN system transmitting classified data must implement required data encryption controls.
High - V-18604 - SV-20156r1_rule
RMF Control
Severity
H
CCI
Version
WIR0330
Vuln IDs
  • V-18604
Rule IDs
  • SV-20156r1_rule
If not compliant, classified data could be compromised.Information Assurance OfficerECWN-1
Checks: C-22272r1_chk

Detailed Policy Requirements: Site WMAN systems that transmit classified data must implement the following data encryption controls: - The WMAN system must implement FIPS 140-2 validated encryption to protect the ISO OSI Layer 2 radio data frames. The WMAN system will be configured for AES-CCM encryption, if supported by the WMAN system. (Not required for classified WMAN bridges.) - The WMAN system must implement NSA Type 1 certified High Assurance Internet Protocol Encryptor (HAIPE) encryption, other NSA Type 1 certified encryption, or NSA approved Suite B overlay encryption at ISO OSI Layer 3 to protect data being transmitted. Check Procedures: Review the WMAN product specification sheets. - Verify FIPS 140-2 validated encryption is being used at OSI Layer 2 to protect the radio data frames. - Determine if the system supports AES-CCM encryption. If yes, verify the system has been configured for AES-CCM encryption. - Verify NSA Type 1 certified High Assurance Internet Protocol Encryptor (HAIPE) encryption, other NSA Type 1 certified encryption, or NSA approved Suite B overlay encryption is being used at OSI Layer 3 to protect data being transmitted. Mark as a finding if any of these requirements have not been met.

Fix: F-14436r1_fix

Comply with policy.

b
The WMAN site must perform periodic wireless IDS screening in all areas where WMAN coverage exists to prevent unauthorized access, jamming, or electromagnetic interference.
Medium - V-18605 - SV-20157r1_rule
RMF Control
Severity
M
CCI
Version
WIR0335
Vuln IDs
  • V-18605
Rule IDs
  • SV-20157r1_rule
WMAN systems could be at risk of wireless hacker attack if periodic wireless IDS screening is not performed.Information Assurance OfficerECWN-1
Checks: C-22273r1_chk

Detailed Policy Requirements: Site performs periodic wireless IDS screening in all areas where WMAN coverage exists to prevent unauthorized access, jamming, or electromagnetic interference. Requirements are as follows: - Screening will be performed periodically, at least every 30 days is recommended and at least every 90 days is required. - Screening will be completed within the WMAN bands. (The most common WMAN bands are 2.5 GHz, 3.5 GHz, and 5.8 GHz for fixed WMAN and 2-6 GHz for mobile WMAN.) Note: 5.8 GHz is an unlicensed band. For this band, screening can be done to prevent unauthorized access. But since it is an unlicensed band, the WMAN may experience interference. Therefore, screening for interference in the 5.8 GHz band is not required. - Screening will verify the WMAN radio coverage area limitations that were defined during system design and initial setup have been maintained. NOTE: Reference A1.a in the Wireless STIG states “DoD Components shall actively screen for wireless devices. Active electromagnetic sensing at the DoD or contractor premises to detect/prevent unauthorized access of DoD ISs shall be periodically performed by the cognizant DAA or Defense Security Service office to ensure compliance with the DoD Information Technology Security Certification and Accreditation Process (DITSCAP) ongoing accreditation agreement.” Reference A1.d requires WMAN scanning to ensure that Components develop a capability to determine if unauthorized use of the WMAN system is taking place. This is to ensure that the Component is aware of attempted or on-going attacks. -Scanning logs will be maintained by the site for a period of at least one year. Check Procedures: Interview the IAO and review logs of previous site WMAN wireless IDS screening. - Verify WMAN wireless IDS screening sessions are being performed periodically, as required. - Verify previous site WMAN wireless IDS screening sessions are verifing WMAN radio beam coverage area limitations that were defined during system design and initial setup have been maintained. Mark as a finding if any of these requirements are not met.

Fix: F-14436r1_fix

Comply with policy.

a
The WMAN site must implement required procedures for reporting the results of WMAN intrusion scans.
Low - V-18606 - SV-20158r1_rule
RMF Control
Severity
L
CCI
Version
WIR0340
Vuln IDs
  • V-18606
Rule IDs
  • SV-20158r1_rule
If scan results are not properly reported and acted on, then the site could be vulnerable to wireless attack.Information Assurance OfficerECWN-1
Checks: C-22274r1_chk

Detailed Policy Requirements: Site implements the following procedures for reporting the results of WMAN intrusion scans: The site will implement a wireless incident process and plan, as part of the site’s Incident Response Plan, for reporting unauthorized access, jamming, or electromagnetic interference identified during active electromagnetic scanning. The site will establish a Standard Operating Procedure (SOP) to address intrusion, jamming, or electromagnetic interference. Check Procedures: Review the site Incident Response Plan and determine if it includes procedures for reporting unauthorized access, jamming, or electromagnetic interference identified during active electromagnetic scanning. - Determine if the site has an SOP that addresses intrusion, jamming, or electromagnetic interference. Mark as a finding if either of these requirements are not met.

Fix: F-14436r1_fix

Comply with policy.

a
A site must use a WMAN system in compliance with Committee on National Security Systems Policy (CNSSP) 300: the Department or Agency Certified TEMPEST Technical Authority (CTTA) has evaluated the system to determine its TEMPEST vulnerability and provided this information to the DAA.
Low - V-18617 - SV-20174r1_rule
RMF Control
Severity
L
CCI
Version
WIR0345
Vuln IDs
  • V-18617
Rule IDs
  • SV-20174r1_rule
Sensitive or classified information could be compromised via a TEMPEST vulnerability.Information Assurance OfficerDesignated Approving AuthorityECWN-1
Checks: C-22298r1_chk

NOTE: This check should only be reviewed during the initial system Certification and Accreditation (C&A). Interview the IAO and review the site SSAA/SSP or DIACAP documentation to verify the Department or Agency CTTA has completed the required evaluation. Mark as a finding if the required evaluation has not been completed.

Fix: F-14436r1_fix

Comply with policy.

b
Site WMAN systems must implement strong authentication from the user or WMAN subscriber device to WMAN network.
Medium - V-19903 - SV-22073r1_rule
RMF Control
Severity
M
CCI
Version
WIR0315-02
Vuln IDs
  • V-19903
Rule IDs
  • SV-22073r1_rule
Broadband systems not compliant with authentication requirements could allow a hacker to gain access to the DoD network.System AdministratorInformation Assurance OfficerECSC-1, ECWN-1
Checks: C-25553r1_chk

Detailed Policy Requirements: The site WMAN systems must implement strong authentication from the User or WMAN subscriber device to WMAN network. -For tactical or commercial WMAN systems operated in a non-tactical environment: User ID and password or shared secret authentication shall be implemented between the user or WMAN subscriber device to the WMAN network. When user ID/Password are used, the length requirements of the password must be compliant with JTF-GNO CTO 07-15Rev1: o 15 character password length (or the maximum length supported by the system if a 15 character password is not supported). Check Procedures: For non-tactical WMAN systems, verify the system uses either User ID and password or shared secret authentication between the User or WMAN subscriber device (respectively) to the WMAN network. If User ID and password is used, verify the password meets the length requirements of CTO 07-15Rev1. Mark as a finding if the password length requirements are not met.

Fix: F-20573r6_fix

Comply with requirement.

b
Site WMAN systems must implement strong authentication from the user or WMAN subscriber device to WMAN network.
Medium - V-19904 - SV-22074r1_rule
RMF Control
Severity
M
CCI
Version
WIR0315-03
Vuln IDs
  • V-19904
Rule IDs
  • SV-22074r1_rule
Broadband systems not compliant with authentication requirements could allow a hacker to gain access to the DoD network.System AdministratorInformation Assurance OfficerECSC-1, ECWN-1
Checks: C-25554r1_chk

Detailed Policy Requirements: The IAO has not ensured that site WMAN systems implement strong authentication from the User or WMAN subscriber device to WMAN network. -For tactical or commercial WMAN systems operated in a non-tactical environment: User ID and password or shared secret authentication shall be implemented between the User or WMAN subscriber device to the WMAN network. When user ID and password are used, the complexity requirements of the password must be compliant with JTF-GNO CTO 07-15Rev1: --Password complexity is a case sensitive mixture of upper case letters, lower case letters, special characters, and numbers, including at least one of each. Check Procedures: - For non-tactical WMAN systems, verify the system uses either User ID and password or shared secret authentication between the User or WMAN subscriber device (respectively) to the WMAN network. If User ID and password is used, verify the password meets the complexity requirements of CTO 07-15Rev1. Have the system administrator show the password complexity settings in the management console of the WMAN access point. Mark as a finding if the requirements are not met.

Fix: F-20573r6_fix

Comply with requirement.

a
The network element must use two or more NTP servers to synchronize time.
Low - V-23747 - SV-28651r2_rule
RMF Control
Severity
L
CCI
Version
NET0812
Vuln IDs
  • V-23747
Rule IDs
  • SV-28651r2_rule
Without synchronized time, accurately correlating information between devices becomes difficult, if not impossible. If logs cannot be successfully compared between each of the routers, switches, and firewalls, it will be very difficult to determine the exact events that resulted in a network breach incident. NTP provides an efficient and scalable method for network elements to synchronize to an accurate time source.System AdministratorInformation Assurance OfficerECSC-1
Checks: C-3581r3_chk

Review the configuration and verify two NTP servers have been defined.

Fix: F-3044r1_fix

Specify two NTP server IP addresses on the device to be used to request time from.

b
A service or feature that calls home to the vendor must be disabled.
Medium - V-28784 - SV-36774r2_rule
RMF Control
Severity
M
CCI
Version
NET0405
Vuln IDs
  • V-28784
Rule IDs
  • SV-36774r2_rule
Call home services or features will routinely send data such as configuration and diagnostic information to the vendor for routine or emergency analysis and troubleshooting. The risk that transmission of sensitive data sent to unauthorized persons could result in data loss or downtime due to an attack.Information Assurance OfficerNetwork Security OfficerECSC-1
Checks: C-35853r2_chk

Verify the call home service or feature is disabled on the device.

Fix: F-31103r1_fix

Configure the network device to disable the call home service or feature.