UCF STIG Viewer Logo

Wireless access points and bridges must be placed in dedicated subnets outside the enclave’s perimeter.


Finding ID Version Rule ID IA Controls Severity
V-14886 WIR0135 SV-15654r9_rule ECSC-1 ECTM-2 ECWN-1 Medium
If an adversary is able to compromise an access point or controller that is directly connected to an enclave network, then the adversary can easily surveil and attack other devices from that beachhead. A defense-in-depth approach requires an additional layer of protection exist between the WLAN and the enclave network. This is particularly important for wireless networks, which may be vulnerable to attack from outside physical perimeter of the facility or base given the inherent nature of radio communications to penetrate walls, fences, and other physical boundaries. See diagram in checklist.
Harris SecNet 11 / 54 Security Technical Implementation Guide 2011-10-07


Check Text ( C-13412r4_chk )
Detailed policy requirements:

Wireless access points and bridges must not be directly connected to the enclave network. A network device must separate wireless access from other elements of the enclave network. Sites must also comply with the Network Infrastructure STIG configuration requirements for DMZ, VLAN, and VPN configurations, as applicable.

Examples of acceptable architectures include placing access points or controllers in a screened subnet (e.g. DMZ separating intranet and wireless network) or dedicated virtual LAN (VLAN). Additional discussion of WLAN architectures is found in the Wireless Overview document contained in the Wireless STIG package.

NOTE: See Figure 3-1 in the Wireless STIG for an example of an acceptable network architecture.

Check Procedures:

Review network architecture with the network administrator.
1. Verify compliance by inspecting the site network topology diagrams.
2. Since many network diagrams are not kept up-to-date, walk through the connections with the network administrator using network management tools or diagnostic commands to verify the diagrams are current.

Mark as a finding if site wireless infrastructure such as access points and bridges are not isolated from the enclave network.
Fix Text (F-3448r4_fix)
Remove wireless network devices with direct connections to an enclave network. If feasible, reconfigure network connections to isolate the WLAN infrastructure from the enclave network, separating them with a firewall or equivalent protection.