CMMC AC.3.012 - Protect Wireless Access

CMMC AC.3.012 - Protect Wireless Access

Requirement text: AC.3.012: Protect wireless access using authentication and encryption.

DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
Organizations authenticate individuals and devices to help protect wireless access to the
system. Special attention is given to the wide variety of devices that are part of the Internet
of Things with potential wireless access to organizational systems.

CMMC CLARIFICATION
Use a combination of authentication and encryption methods to protect the access to
wireless networks. Authenticating users to a Wireless Access Point can be done in numerous
ways. One approach uses shared key authentication based on a Pre-Shared Key. Another
possibility uses Network Extensible Authentication Protocol (EAP) based on an
authentication server (such as a Remote Authentication Dial-In User Service (RADIUS)
server) and a mechanism to enforce port-based network access control. Open authentication
should not be used because it authenticates any user, and at best, logs the MAC address,
which is easily spoofed.

Example
You are responsible for protecting the data in your organization by configuring the Wireless
Access Point to enforce authentication. Before users gain access to your network, they must
authenticate by demonstrating possession of a pre-shared key (typically used in smaller
companies) before crypto keys can be installed; or by passing credentials to a RADIUS server
(typically used in larger organizations) before the access port is opened.

References
• NIST SP 800-171 Rev 1 3.1.17
• CIS Controls v7.1 15.7, 15.8
• NIST CSF v1.1 PR.PT-4
• CERT RMM v1.2 KIM:SG4.SP1
• NIST SP 800-53 Rev 4 AC-18(1)

    • Related Articles

    • Access Control: SP 800-171 Security Family 3.1

      Access is the ability to make use of any system resource. Access control is the process of granting or denying requests to:       • use information,       • use information processing services, and       • enter company facilities.  System-based ...

    • CMMC AC.2.011 - Authorize Wireless Access

      Requirement text: AC.2.011: Authorize wireless access prior to allowing such connections. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 Establishing usage restrictions and configuration/connection requirements for wireless access to the system ...

    • CMMC Level 1 Overview - Basic Cyber Hygiene

      CMMC Level 1 l focuses on Federal Contract Information (FCI), which is defined as “information, not intended for public release, that is provided by or generated for the Government under a contract to develop or deliver a product or service to the ...

    • CMMC AC.2.013 - Control Remote Access

      Requirement text: AC.2.013: Monitor and control remote access sessions. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 Remote access is access to organizational systems by users (or processes acting on behalf of users) communicating through ...

    • CMMC AC.3.014 - Encrypt Remote Access

      Requirement text: AC.3.014: Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2 Cryptographic standards include FIPS-validated cryptography and NSA-approved ...