← Back to Network WLAN AP-IG Platform Security Technical Implementation Guide

V-243212

CAT II (Medium)

The WLAN access point must be configured for Wi-Fi Alliance WPA3 security.

Rule ID

SV-243212r1268436_rule

STIG

Network WLAN AP-IG Platform Security Technical Implementation Guide

Version

V7R4

CCIs

CCI-001453

Discussion

The Wi-Fi Alliance's WPA3 certification provides assurance that the device has adequate security functionality and can implement the IEEE 802.11i standard for robust security networks. The previous version of the Wi-Fi Alliance certification, WPA, did not require AES encryption, which must be supported for DoW WLAN implementations. Devices without any WPA certification likely do not support required security functionality and could be vulnerable to a wide range of attacks.

Check Content

Verify the access point is configured for either WPA3 (Enterprise) or WPA3 (Personal) authentication. The procedure for performing this review will vary depending on the AP model. Have the system administrator (SA) show the configuration setting.

If the access point is not configured with WPA3 security, this is finding.

Fix Text

Configure the access point for WPA3 authentication, confidentiality, and integrity services. 

In the case of WPA3 (Personal), this action will require the selection of a strong passcode or passphrase. 

In the case of WPA3 (Enterprise), this action will require the organization to deploy RADIUS or equivalent authentication services on a separate server.

In cases in which the access point does not support WPA3, the organization will need to procure new equipment.