Device Class 3: Wireless Access

Control ID: AC-18 Wireless Access Family: Access Control Source: NIST 800-53r4
Control: The organization:
  1. Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and
  2. Authorizes wireless access to the information system prior to allowing such connections.
Supplemental Guidance:
Wireless technologies include, for example, microwave, packet radio (UHF/VHF), 802.11x, and Bluetooth. Wireless networks use authentication protocols (e.g., EAP/TLS, PEAP), which provide credential protection and mutual authentication.

Related Controls: AC-2, AC-3, AC-17, AC-19, CA-3, CA-7, CM-8, IA-2, PL-4, SI-4, IA-3, IA-8
Control Enhancements:
(4) Wireless Access | Restrict Configurations By Users
The organization identifies and explicitly authorizes users allowed to independently configure wireless networking capabilities.
Supplemental Guidance: Organizational authorizations to allow selected users to configure wireless networking capability are enforced in part, by the access enforcement mechanisms employed within organizational information systems.
Related Controls: AC-3, SC-15

(5) Wireless Access | Antennas / Transmission Power Levels
The organization selects radio antennas and calibrates transmission power levels to reduce the probability that usable signals can be received outside of organization-controlled boundaries.
Supplemental Guidance: Actions that may be taken by organizations to limit unauthorized use of wireless communications outside of organization-controlled boundaries include, for example: (i) reducing the power of wireless transmissions so that the transmissions are less likely to emit a signal that can be used by adversaries outside of the physical perimeters of organizations; (ii) employing measures such as TEMPEST to control wireless emanations; and (iii) using directional/beam forming antennas that reduce the likelihood that unintended receivers will be able to intercept signals. Prior to taking such actions, organizations can conduct periodic wireless surveys to understand the radio frequency profile of organizational information systems as well as other systems that may be operating in the area.
Related Controls: N/A

(1) Wireless Access | Authentication And Encryption
The information system protects wireless access to the system using authentication of [Selection (one or more): users; devices] and encryption.
Supplemental Guidance:
Related Controls: N/A
References: N/A
Mechanisms:

See AC-1, AC-3, AC-6

  • Only high privileged users explicitly identified will have permission to modify wireless configurations. See AC-3
  • Organizations shall conduct periodic wireless site surveys to look for rogue wireless networking devices and to measure physical areas where the wireless communication might be accessible from outside the physical constraints of the building.
  • Appropriately tune wireless antennas in an organization or make use of directional antennas to only propagate wireless signals within the physical confines of the organization.
Protocol Implementation Conformance Statements: N/A