15: Wireless Access Control
Threats Addressed:
Control Statement
The processes and tools used to track/control/prevent/correct the security use of wireless local area networks (WLANs), access points, and wireless client systems.
[csf.tools Note: For more information on the Critical Security Controls, visit the Center for Internet Security.]
Subcontrols
15.1: Maintain an Inventory of Authorized Wireless Access Points
Maintain an inventory of authorized wireless access points connected to the wired network.
15.2: Detect Wireless Access Points Connected to the Wired Network
Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access points connected to the wired network.
15.3: Use a Wireless Intrusion Detection System
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless access points connected to the network.
15.4: Disable Wireless Access on Devices if Not Required
Disable wireless access on devices that do not have a business purpose for wireless access.
15.5: Limit Wireless Access on Client Devices
Configure wireless access on client machines that do have an essential wireless business purpose, to allow access only to authorized wireless networks and to restrict access to other wireless networks.
15.6: Disable Peer-to-Peer Wireless Network Capabilities on Wireless Clients
Disable peer-to-peer (ad hoc) wireless network capabilities on wireless clients.
15.7: Leverage the Advanced Encryption Standard (AES) to Encrypt Wireless Data
Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.
15.8: Use Wireless Authentication Protocols That Require Mutual, Multi-Factor Authentication
Ensure that wireless networks use authentication protocols such as Extensible Authentication Protocol-Transport Layer Security (EAP/TLS), which requires mutual, multi-factor authentication.
15.9: Disable Wireless Peripheral Access of Devices
Disable wireless peripheral access of devices [such as Bluetooth and Near Field Communication (NFC)], unless such access is required for a business purpose.
15.10: Create Separate Wireless Network for Personal and Untrusted Devices
Create a separate wireless network for personal or untrusted devices. Enterprise access from this network should be treated as untrusted and filtered and audited accordingly.