Wireless Communication Standard

See purpose.

This standard specifies the technical requirements that wireless infrastructure devices must satisfy including the wireless network user devices themselves as well as all wireless Network Devices. Only those wireless infrastructure devices that meet the requirements specified in this standard or are granted an exception by the Technology Department team are approved for connectivity to a Diocese of Paterson network. Network devices including, but not limited to hubs, bridges, routers, switches, firewalls, remote access devices, moderns, or wireless access points, must be installed, supported, and maintained by either the Technology Department or a qualified company (volunteers must document all steps taken).

All employees, contractors, consultants, temporary, volunteers, and other workers at the Diocese of Paterson and its subsidiaries, including all personnel that maintain a wireless infrastructure device on behalf of the Diocese of Paterson, must comply with this standard. This standard applies to wireless devices that make a connection to the network and all wireless infrastructure devices that provide wireless connectivity to the network.

• 4.1 General Requirements
  • 4.1.1 All wireless infrastructure devices that connect to a Diocese of Paterson network or provide access to Diocese of Paterson Confidential, Diocese of Paterson Highly Confidential, or Diocese of Paterson Restricted information must:
  • 4.1.2 Use Extensible Authentication Protocol-Fast Authentication via Secure Tunneling (EAP-FAST), Protected Extensible Authentication Protocol (PEAP), or Extensible Authentication Protocol- Translation Layer Security (EAP-TLS) as the authentication protocol.
  • 4.1.3 Use Temporal Key Integrity Protocol (TKIP) or Advanced Encryption System (AES & GCM) protocols with a minimum key length of 128 bits.
  • 4.1.4 Change default vendor passwords.
  • 4.1.5 Have ICMP echo requests turned off.
  • 4.1.6 Have all Routers must be either WPA2 or WPA3.
  • 4.1.7 Update all firmware for the wireless access point must be kept up to date.
  • 4.1.8 Depending on the location (some places will have a singular WAP as their entire network) networks should have firewalls and their rules kept up to data (free ones are available on Suricata and Snort).
• 4.2 If a volunteer were to follow these standards the topology and the administrative passwords must be logged in accessible place on site in case of overturn in a location easily accessible (eg a folder in your desktop)
• 4.3 All Bluetooth devices must be Secure Simple Pairing with encryption enabled.
• 4.4 All wireless networks that meet the requirements of 4.1.1 must also have a separate guest network.
• 4.5 Networks Used for More Sensitive Information
  • 4.5.1 Locations which must implement some form of Network Access Control NAC/Network Access Protection NAP.
  • 4.5.2 Wireless networks must have their Wi-Fi device power limited order to ensure that the reach of the device does not extend far out of the walls of the building.
  • 4.5.3 Wireless Networks should have their broadcast beacon packets at higher bandwidth and if possible, lower the number of beacon packets.
  • 4.5.4 Admin portals for wireless devices must only be connected to using HTTPS/SSH.
  • 4.5.5 Enable MAC address filtering.
  • 4.5.6 If possible, institute a more restrictive IP address range limit.
  • 4.5.7 Physical wireless router location must be within the center of the building if possible.
• 4.6 Home Wireless Device Requirements
  • 4.6.1 All home wireless infrastructure devices that provide direct access to a Diocese of Paterson network, such as those behind Enterprise Teleworker (ECT) or hardware VPN, must adhere to the following:
    • 4.6.1.1 Enable Wi-Fi Protected Access Pre-Shared Key (WPA-PSK), EAP-FAST, PEAP, or EAP-TLS
    • 4.6.1.2 When enabling WPA-PSK, configure a complex shared secret key (at least 20 characters) on the wireless client and the wireless access point.S
    • 4.6.1.3 Disable broadcast of SSIDS
    • 4.6.1.4 Change the default SSID nameS
    • 4.6.1.5 Change the default login and passwordS

• 5.1 Compliance measurement
  • 5.1.1 The DoP Technology team may verify compliance to this Standard through various methods, including but not limited to, business tool reports, internal and external audits, and feedback to the Standard owner.
• 5.2 Exception
  • 5.2.1 All devices should be compliant with cyber insurance standards and local/federal governance standards. Any exception/outliers should be approved by the DoP Technology team in advance.
• 5.3 Non-Compliance
  • 5.3.1 An employee found to have violated this Standard may be subject to disciplinary action, up to and including termination of employment.
• 5.4 The Technology Department must approve exceptions to this standard in advance.

None.

• 7.1 Suricata
• 7.2 Snort
• 7.3 The following definition and terms can be found in the SANS Glossary located at:
  • AES
  • EAP-FAST
  • EAP-TLS
  • PEAP
  • SSID
  • TKIP
  • WPA-PSK