What changed in Network WLAN AP-IG Platform STIG V7R4V7R4 changes

Title

WLAN components must be Wi-Fi Alliance certified with WPA2 or WPA3.

Check text

Review the WLAN equipment specification and verify it is Wi-Fi Alliance certified with either the older WPA2 certification or the newer WPA3 certification. WPA3 is preferred but not required at this time. If the WLAN equipment is not Wi-Fi Alliance certified with WPA2 or WPA3, this is a finding.

Fix text

Use WLAN equipment that is Wi-Fi Alliance certified with WPA2 or WPA3.

Discussion

Wi-Fi Alliance certification ensures compliance with DoDW interoperability requirements between various WLAN products.

V-243209 in V7R4

Discussion

If the DoDDoW WLAN components (WLAN AP, controller, or client) are not NIST FIPS 140-2/FIPS 140-3 (Cryptographic Module Validation Program, CMVP) certified, the WLAN system may not adequately protect sensitive unclassified DoDDoW data from compromise during transmission.

V-243210 in V7R4

Discussion

Most commercially available WLAN equipment is preconfigured for signal power appropriate to most applications of the WLAN equipment. In some cases, this may permit the signals to be received outside the physical areas for which they are intended. This can occur when the intended area is relatively small, such as a conference room, or when the access point is placed near or window or wall, thereby allowing signals to be received in neighboring areas. In such cases, an adversary may be able to compromise the site's posture by measuring the presence of the signal and the quantity of data transmitted to obtain information about when personnel are active and what they are doing. If the signal is not appropriately protected through defense-in-depth mechanisms, the adversary could possibly use the connection to access DoDDoW networks and sensitive information.

V-243211 in V7R4

Title

The WLAN access point must be configured for Wi-Fi Alliance WPA2 or WPA3 security.

Check text

Verify the access point is configured for either WPA2/WPA3 (Enterprise) or WPA2/WPA3 (Personal) authentication. The procedure for performing this review will vary depending on the AP model. Have the system administrator (SA) show the configuration setting. If the access point is not configured with either WPA2 or WPA3 security, this is finding.

Fix text

Configure the access point for WPA2 (or WPA3) authentication, confidentiality, and integrity services. In the case of WPA2WPA3 (Personal), this action will require the selection of a strong passcode or passphrase. In the case of WPA2WPA3 (Enterprise), this action will require the organization to deploy RADIUS or equivalent authentication services on a separate server. In cases in which the access point does not support WPA2/WPA3, the organization will need to procure new equipment.

Discussion

The Wi-Fi Alliance's WPA2/WPA3 certification provides assurance that the device has adequate security functionality and can implement the IEEE 802.11i standard for robust security networks. The previous version of the Wi-Fi Alliance certification, WPA, did not require AES encryption, which must be supported for DoDDoW WLAN implementations. Devices without any WPA certification likely do not support required security functionality and could be vulnerable to a wide range of attacks.

V-243212 in V7R4

Title

DoDDoW Components providing guest WLAN access (internet access only) must use separate WLAN or logical segmentation of the enterprise WLAN (e.g., separate service set identifier [SSID] and virtual LAN) or DoDDoW network.

Check text

Have the system administrator (SA) show how the guest WLAN is physically connected to the firewall or supporting switch and how it is logically connected through firewall or switch configuration settings. Verify the equipment is connected via a separate WLAN or logical segmentation of the host WLAN (e.g., separate service set identifier [SSID] and virtual LAN). Verify the guest WLAN only provides internet access. If a guest WLAN is not set up as a separate WLAN from the DoDDoW network or is not set up as a logical segmentation from the DoDDoW network or DoDDoW WLAN, this is a finding. If the guest WLAN does not provide only internet access, this is a finding.

V-243213 in V7R4