OpenControls Logo

STIG Viewer

STIGViewer Support

AOS must protect wireless access to the network using authentication of users and/or devices.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-266559ARBA-NT-000120SV-266559r1040167_ruleCCI-001443medium
Description
Allowing devices and users to connect to the system without first authenticating them allows untrusted access and can lead to a compromise or attack. The security boundary of a wireless local area network (WLAN) extends from the client device to the network boundary where network access is controlled. This boundary represents the portion of the network most vulnerable to attack and must be protected. Within this boundary there must be two distinct, but related, security protection mechanisms: authentication and data-in-transit encryption. These protections ensure access control and protection from eavesdropping for both the WLAN system and the DOD network enclave. Wireless technologies include, for example, microwave, packet radio (UHF/VHF), 802.11x, and Bluetooth. Wireless networks use authentication protocols (e.g., Extensible Authentication Protocol (EAP)/Transport Layer Security (TLS) and Protected EAP [PEAP]), which provide credential protection and mutual authentication. Satisfies: SRG-NET-000069, SRG-NET-000070
STIGDate
HPE Aruba Networking AOS Wireless Security Technical Implementation Guide2024-10-29

Related Frameworks

2 mappings across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-15.1Authentication & Encryption
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (7) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-18(1)Authentication and Encryption
1.00
AC-3Access Enforcement
1.00
CM-7Least Functionality
1.00
IA-3(1)Cryptographic Bidirectional Authentication
1.00
SC-8Transmission Confidentiality and Integrity
1.00
SC-8(1)Cryptographic Protection
1.00
NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.17
1.00
CCI2 mappings
CCI-001443
1.00
CCI-001444
1.00

Details

Check Text (C-266559r1040167_chk)

Verify the AOS configuration with the following command: show wlan ssid-profile For each WLAN SSID: show wlan ssid-profile <SSID profile name> If a WPA Passphrase is set or if Encryption is not set with wpa2-aes or wpa3-cnsa, this is a finding.

Fix Text (F-70386r1040166_fix)

Configure AOS with the following commands: configure terminal wlan ssid-profile <profile name> opmode <wpa2-aes or wpa3-cnsa> exit write memory