Appendix A: Misuse Guidelines - 3e Technologies International AirGuard 3e-525A-3 User Manual

3e-525A–3 Wireless Access Point

Appendix A: Misuse Guidelines

This appendix contains a vulnerability analysis for the Wireless Ac-
cess Point, referred to as the "TOE"(Target of Evaluation). The following
table contains potential threats/issues and the remedies that are em-
ployed.
The TOE may broadcast its SSID The TOE may broadcast its SSID The TOE may broadcast its SSID
(Service Set Identifier). SSIDs are (Service Set Identifier). SSIDs are
used to gain access to wireless access used to gain access to wireless access used to gain access to wireless access
points for 802.11 wireless networks. points for 802.11 wireless networks. points for 802.11 wireless networks. points for 802.11 wireless networks.
SSID information could be useful by SSID information could be useful by SSID information could be useful by SSID information could be useful by
an attacker to glean information about an attacker to glean information about an attacker to glean information about an attacker to glean information about
the wireless LAN. For this reason, an the wireless LAN. For this reason, an
access point that broadcasts the SSID access point that broadcasts the SSID access point that broadcasts the SSID
can compromise wireless network can compromise wireless network
security.
A Wireless Scanner client device may A Wireless Scanner client device may A Wireless Scanner client device may
be able to connect without authen- be able to connect without authen-
ticating to the TOE. This event may ticating to the TOE. This event may ticating to the TOE. This event may
indicate that encryption is not turned indicate that encryption is not turned
on.
A Wireless Scanner client device may A Wireless Scanner client device may A Wireless Scanner client device may
be able to obtain an IP address using be able to obtain an IP address using be able to obtain an IP address using be able to obtain an IP address using
DHCP (Dynamic Host Control Proto- DHCP (Dynamic Host Control Proto- DHCP (Dynamic Host Control Proto- DHCP (Dynamic Host Control Proto-
col) after successfully associating with col) after successfully associating with col) after successfully associating with col) after successfully associating with
the TOE. This means that the Wireless the TOE. This means that the Wireless
Scanner client device has gained ac- Scanner client device has gained ac- Scanner client device has gained ac-
cess to the IP network and can com- cess to the IP network and can com-
municate with other computers on the municate with other computers on the municate with other computers on the
same network. A potential attacker same network. A potential attacker same network. A potential attacker same network. A potential attacker
could also use DHCP in the same could also use DHCP in the same
manner to gain access to the network.
A client is communicating directly A client is communicating directly A client is communicating directly
with the TOE. This could be an at- with the TOE. This could be an at-
tempt to reconfigure the TOE over the tempt to reconfigure the TOE over the tempt to reconfigure the TOE over the
wireless interface. Under normal, se- wireless interface. Under normal, se-
cure circumstances, TOE's should only cure circumstances, TOE's should only cure circumstances, TOE's should only
be configured over the wired interface, be configured over the wired interface, be configured over the wired interface, be configured over the wired interface,
through the wired network. through the wired network.
29000167-001 B
Threat
Appendix A: Misuse Guidelines
Remedy
The TOE does not broadcast its SSID.
The SSID field is zeroed-out in the
broadcast 802.11 Beacon message sent broadcast 802.11 Beacon message sent broadcast 802.11 Beacon message sent
by the TOE by the TOE
MAC address filtering is performed in MAC address filtering is performed in MAC address filtering is performed in
the TOE. Also, authentication using the TOE. Also, authentication using the TOE. Also, authentication using the TOE. Also, authentication using
RSA, as per the FIPS 140-2 security RSA, as per the FIPS 140-2 security RSA, as per the FIPS 140-2 security RSA, as per the FIPS 140-2 security
policy, is required before any client policy, is required before any client policy, is required before any client policy, is required before any client
device can join the wireless LAN. device can join the wireless LAN.
All TOE's are configured to allow con- All TOE's are configured to allow con- All TOE's are configured to allow con-
nections only from valid, recognized nections only from valid, recognized nections only from valid, recognized nections only from valid, recognized
clients. This ensures that DHCP ac- clients. This ensures that DHCP ac-
cess is secure, through a form of MAC cess is secure, through a form of MAC cess is secure, through a form of MAC
address filtering, because the DHCP address filtering, because the DHCP address filtering, because the DHCP address filtering, because the DHCP
server is configured to only provide IP server is configured to only provide IP server is configured to only provide IP server is configured to only provide IP
addresses to specific, approved MAC addresses to specific, approved MAC addresses to specific, approved MAC addresses to specific, approved MAC
addresses. addresses.
All TOE's are configured such that the All TOE's are configured such that the All TOE's are configured such that the
TOE is disabled to the access point's TOE is disabled to the access point's TOE is disabled to the access point's TOE is disabled to the access point's
configuration options (e.g., SNMP, configuration options (e.g., SNMP, configuration options (e.g., SNMP, configuration options (e.g., SNMP,
telnet, HTTP). All communication to telnet, HTTP). All communication to
the TOE occurs through the network
gateway.
A-1