3e Technologies International AirGuard 3e-525A-3, Руководство пользователя

Страница: 107 / 112

3e-525A–3 Wireless Access Point Appendix A: Misuse Guidelines
29000167-001 B A-1
Appendix A: Misuse Guidelines
This appendix contains a vulnerability analysis for the Wireless Ac-
cess Point, referred to as the "TOE"(Target of Evaluation). The following
table contains potential threats/issues and the remedies that are em-
ployed.
Threat Remedy
The TOE may broadcast its SSID
(Service Set Identifi er). SSIDs are
The TOE may broadcast its SSID The TOE may broadcast its SSID
used to gain access to wireless access
points for 802.11 wireless networks.
used to gain access to wireless access used to gain access to wireless access
SSID information could be useful by
points for 802.11 wireless networks. points for 802.11 wireless networks.
an attacker to glean information about
SSID information could be useful by SSID information could be useful by
the wireless LAN. For this reason, an
an attacker to glean information about an attacker to glean information about
access point that broadcasts the SSID
can compromise wireless network
access point that broadcasts the SSID access point that broadcasts the SSID
security.
The TOE does not broadcast its SSID.
The SSID fi eld is zeroed-out in the
broadcast 802.11 Beacon message sent
by the TOE
broadcast 802.11 Beacon message sent broadcast 802.11 Beacon message sent
A Wireless Scanner client device may
be able to connect without authen-
A Wireless Scanner client device may A Wireless Scanner client device may
ticating to the TOE. This event may
indicate that encryption is not turned
ticating to the TOE. This event may ticating to the TOE. This event may
on.
MAC address fi ltering is performed in
the TOE. Also, authentication using
MAC address fi ltering is performed in MAC address fi ltering is performed in
RSA, as per the FIPS 140-2 security
the TOE. Also, authentication using the TOE. Also, authentication using
policy, is required before any client
RSA, as per the FIPS 140-2 security RSA, as per the FIPS 140-2 security
device can join the wireless LAN.
policy, is required before any client policy, is required before any client
A Wireless Scanner client device may
be able to obtain an IP address using
A Wireless Scanner client device may A Wireless Scanner client device may
DHCP (Dynamic Host Control Proto-
be able to obtain an IP address using be able to obtain an IP address using
col) after successfully associating with
DHCP (Dynamic Host Control Proto- DHCP (Dynamic Host Control Proto-
the TOE. This means that the Wireless
col) after successfully associating with col) after successfully associating with
Scanner client device has gained ac-
cess to the IP network and can com-
Scanner client device has gained ac- Scanner client device has gained ac-
municate with other computers on the
same network. A potential attacker
municate with other computers on the municate with other computers on the
could also use DHCP in the same
same network. A potential attacker same network. A potential attacker
manner to gain access to the network.
All TOE’s are confi gured to allow con-
nections only from valid, recognized
All TOE’s are confi gured to allow con- All TOE’s are confi gured to allow con-
clients. This ensures that DHCP ac-
nections only from valid, recognized nections only from valid, recognized
cess is secure, through a form of MAC
address fi ltering, because the DHCP
cess is secure, through a form of MAC cess is secure, through a form of MAC
server is confi gured to only provide IP
address fi ltering, because the DHCP address fi ltering, because the DHCP
addresses to specifi c, approved MAC
server is confi gured to only provide IP server is confi gured to only provide IP
addresses.
addresses to specifi c, approved MAC addresses to specifi c, approved MAC
A client is communicating directly
with the TOE. This could be an at-
A client is communicating directly A client is communicating directly
tempt to reconfi gure the TOE over the
wireless interface. Under normal, se-
tempt to reconfi gure the TOE over the tempt to reconfi gure the TOE over the
cure circumstances, TOE’s should only
be confi gured over the wired interface,
cure circumstances, TOE’s should only cure circumstances, TOE’s should only
through the wired network.
be confi gured over the wired interface, be confi gured over the wired interface,
All TOE’s are confi gured such that the
TOE is disabled to the access point’s
All TOE’s are confi gured such that the All TOE’s are confi gured such that the
confi guration options (e.g., SNMP,
TOE is disabled to the access point’s TOE is disabled to the access point’s
telnet, HTTP). All communication to
confi guration options (e.g., SNMP, confi guration options (e.g., SNMP,
the TOE occurs through the network
gateway.