Check: WLAN-NW-000500
Network WLAN Controller Platform STIG:
WLAN-NW-000500
(in versions v7 r3 through v7 r1)
Title
WLAN must use EAP-TLS. (Cat II impact)
Discussion
EAP-TLS provides strong cryptographic mutual authentication and key distribution services not found in other EAP methods, and thus provides significantly more protection against attacks than other methods. Additionally, EAP-TLS supports two-factor user authentication on the WLAN client, which provides significantly more protection than methods that rely on a password or certificate alone. EAP-TLS also can leverage the DoD Common Access Card (CAC) in its authentication services, providing additional security and convenience.
Check Content
Note: If the equipment is WPA2/WPA3 certified by the Wi-Fi Alliance, it is capable of supporting this requirement. Review the WLAN equipment configuration to verify that EAP-TLS is actively used and no other methods are enabled. If EAP-TLS is not used or if the WLAN system allows users to connect with other methods, this is a finding.
Fix Text
Change the WLAN configuration so it supports EAP-TLS, implementing supporting PKI and AAA infrastructure as necessary. If the WLAN equipment is not capable of supporting EAP-TLS, procure new equipment capable of such support.
Additional Identifiers
Rule ID: SV-243234r720157_rule
Vulnerability ID: V-243234
Group Title: SRG-NET-000070
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001444 |
The information system protects wireless access to the system using encryption. |
Controls
Number | Title |
---|---|
AC-18 (1) |
Authentication And Encryption |