|Finding ID||Version||Rule ID||IA Controls||Severity|
|Improper use of wireless remote access to a DoD network can compromise both the wireless client and the network, as well as, expose DoD data to unauthorized people. Without adequate training remote access users are more likely to engage in behaviors that make DoD networks and information more vulnerable to security exploits.|
|Wireless Remote Access Policy Security Implementation Guide||2011-10-10|
|Check Text ( C-31258r3_chk )|
| Detailed Policy Requirements: |
The IAO and the site wireless device administrator must ensure all wireless remote access users receive training on the following topics before they are authorized to access a DoD network via a wireless remote access device:
- Maintaining physical control of the device
- Reducing exposure of sensitive data
- Backing up data frequently
- User authentication, anti-virus, personal firewall, and content encryption requirements
- Enabling wireless interfaces only when needed
- Enable VPN connection to the DoD network immediately after establishing a wireless connection
- All Internet browsing will be done via the VPN connection to the DoD network
- No split tunneling of VPN
- Locations where wireless remote access is authorized or not authorized (i.e., home, airport, hotel, etc.)
- Wireless client configuration requirements
- Use of WPA2 Personal (AES) on home WLAN
- Home WLAN password and SSID requirements - Discontinue the use of devices suspected of being tampered with and notify the site IAO.
For iOS devices, add:
-User should select “Forget this Network” while still in physical range. (This prevents the iPhone from automatically joining networks later that may share the same SSID. The user will not be able to “forget” individual networks when out of range and will have to reset all network settings.)
Review site wireless device and/or IA awareness training material to verify it contains the required content.
Note: Some training content may be listed in the User Agreement signed by the user.
Verify site training records show authorized wireless remote access users received required training and training occurred before the users were issued a device. Check training records for approximately five users, picked at random. Mark as a finding if training material does not contain the required content or if wireless remote access users have not received required training.
|Fix Text (F-27724r1_fix)|
|Complete required training|