Wireless Network Access
Certification criterion
When a wireless network is used, wireless network protective measures such as user authentication, encryption of transmitted and received data, and AP control must be applied. In addition, protective measures against connection to unauthorized wireless networks, such as AD Hoc connections and use of unauthorized APs, must be established and implemented.
Key checkpoints
- When a wireless network is used for business purposes, are protective measures such as authentication and encryption of transmitted and received data established and implemented to secure the wireless AP and network segment?
- Are application and termination procedures established and implemented so that only authorized employees can use the wireless network?
- Are protective measures against unauthorized wireless networks, such as detection/blocking of AD Hoc connections and unauthorized wireless APs within the organization, established and implemented?
Detailed explanation
When a wireless network is used for business purposes, protective measures must be established and implemented to secure the wireless AP and network segment, taking into account the following matters such as authentication and encryption of transmitted and received data.
- Managing the list of wireless network devices (APs, etc.)
- Configuring encryption functions for user authentication and information transmission/reception (WPA2-Enterprise mode, WPA3-Enterprise mode, etc.)
- Authentication methods for terminals connecting to the wireless AP (MAC authentication, etc.)
- Enabling the SSID hiding function
- Configuring ACLs for the wireless network
- Access control for administrators of the wireless AP (IP restriction), etc.
Application and termination procedures must be established and implemented so that only authorized employees can use the wireless network.
- Procedures for applying for and approving wireless network usage rights (registration of users and connecting terminals, etc.)
- Procedures for terminating access rights when the wireless network is no longer needed due to reasons such as resignation or expiration of the usage period
- Separating the wireless network provided to external persons from the wireless network used by employees, etc.
Protective measures against unauthorized wireless networks, such as detection/blocking of AD Hoc connections and unauthorized wireless APs within the organization, must be established and implemented.
- Installing/operating a WIPS (Wireless Intrusion Prevention System) and periodically checking for the installation of unauthorized APs (Rogue APs), etc.
Related laws
- Personal Information Protection Act Article 29 (Duty of Safety Measures)
- Standards for Measures to Ensure the Safety of Personal Information Article 6 (Access Control)
Evidence (examples)
- Network configuration diagram
- Records of AP security settings
- History of unauthorized wireless network inspections
- History of wireless network usage applications/approvals
Nonconformity examples
- A case where the external-use wireless network and the internal wireless network share the same address range, allowing external persons to access the internal network through the wireless network without separate controls
- A case where the encryption function for information transmission/reception was enabled when configuring the wireless AP, but was set up in an insecure manner
- A case where security settings are inadequate for a wireless AP connected to the internal network for business purposes, such as exposure of the wireless AP administrator password (use of a default password) or failure to apply access control