Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
When AOS is used as a wireless local area network (WLAN) controller, WLAN Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) implementation must use certificate-based public key infrastructure (PKI) authentication to connect to DoW networks.
Description
Discussion Text
DoW certificate-based PKI authentication is strong, two-factor authentication that relies on carefully evaluated cryptographic modules. Implementations of EAP-TLS that are not integrated with certificate-based PKI could have security vulnerabilities.
For example, an implementation that uses a client certificate on a laptop without a second factor could enable an adversary with access to the laptop to connect to the WLAN without a PIN or password. Systems that do not use the certificate-based PKI are also much more likely to be vulnerable to weaknesses in the underlying public key infrastructure (PKI) that supports EAP-TLS.
Certificate-based PKI authentication must be used to connect WLAN client devices to DoW networks. The certificate-based PKI authentication should directly support the WLAN EAP-TLS implementation.
At least one layer of user authentication must enforce network authentication requirements (e.g., CAC authentication) before the user is able to access DoW information resources.
For example, an implementation that uses a client certificate on a laptop without a second factor could enable an adversary with access to the laptop to connect to the WLAN without a PIN or password. Systems that do not use the certificate-based PKI are also much more likely to be vulnerable to weaknesses in the underlying public key infrastructure (PKI) that supports EAP-TLS.
Certificate-based PKI authentication must be used to connect WLAN client devices to DoW networks. The certificate-based PKI authentication should directly support the WLAN EAP-TLS implementation.
At least one layer of user authentication must enforce network authentication requirements (e.g., CAC authentication) before the user is able to access DoW information resources.
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.