Wireless Administrator Checklist

http://networksecurity.weebly.com/

Daily Tasks

Physically locate rogue wireless devices within AOR

• Identify rogue devices with wireless discovery device
• Physically locate rogue devices
• Verify authorization for device or disable
• Document wireless device information for rogue devices located outside AOR
• Document and report wireless device information for rogue devices located within
AOR through approved reporting channels
• Track visit request to coordinate/prevent wireless enabled devices from
entering/leaving AOR

Review Wireless Access Point audit logs

• Identify and research system warning and error messages
• Identify and research failed access attempts
• Identify and research communication problems
• Track/monitor performance and activity

Review Wireless IDS audit logs

• Research generated alerts
• Identify and research system warning and error messages
• Identify and research failed access attempts
• Identify and research communication problems
• Track/monitor performance and activity

Review Wireless I/A device (i.e. RADIUS) audit logs

• Identify and research failed logon attempts
• Identify and research system warning and error messages
• Track/monitor performance and activity

Virus scan devices that are part of the wireless infrastructure

• Use approved virus scanner to scan wireless devices (where appropriate)

Weekly Tasks

Wireless device configuration management

• Check vendor sites for patch and firmware updates
• Update Wireless IDS signature files
 • Update Anti-Virus signature files
• Monitor security news sources for wireless security related information
• Compare wireless network device configuration files against a baseline for
changes
• Check for Unnecessary Services

Archive Audit logs

• Archive audit logs to a media/device with one-year retention

Monitor wireless device performance

• Verify wireless encryption/authentication devices (RADIUS, IPSEC service, etc)
for proper performance and activity
• Run hardware integrity diagnostics on wireless network devices
• Synchronize clock/time on wireless devices

Perform/verify weekly backup

• Run and verify that a successful backup of wireless network devices has been
completed

Monthly Tasks

Perform Self-Assessment Security and Policy Review

• Use Wireless Checklist to perform Self-Assessment Security Review
• Use Network Checklist to perform Self-Assessment Security Review
• Ensure wireless infrastructure complies with site Wireless Policy
• Develop plan to implement remediation actions to mitigate deviations
• Implement corrective actions to mitigate deviations
• Run an approved Vulnerability scanner (SCCVI)

Wireless device configuration management

• Compare device configuration with documented secure baseline
• Verify physical location of wireless devices
• Verify physical integrity of wireless devices (have devices been modified or
opened)
• Verify equipment has not been replaced or moved
• Verify antenna location, position, and direction

Verify wireless client security configuration

 • Spot check the configuration on a sample of wireless client devices (25% of
wireless devices)
• Identify wireless profiles that indicate wireless client is accessing unauthorized
wireless networks

Quarterly Tasks

Wireless device configuration management

• Change administrator/management passwords on wireless network devices
• Change Pre-Shared Key (PSK) on all appropriate devices

Test backup/restore procedures

• Restore backup files to a test system to verify procedures and files are usable

Wireless signal strength mapping

• Use mobile device to identify/document signal coverage of wireless network
devices
• Use mobile device to identify/document residential/commercial wireless devices
that are visible during site surveys

Annual Tasks

Review and update site policies and training

• Ensure site Acceptable Use Policy addresses current Wireless Security Policy
• Ensure personnel Annual Security Awareness Training addresses current site
Wireless Security Policy
• Ensure site Certification and Accreditation documents reflect the current wireless
infrastructure
• Ensure wireless users are informed about increased level of threat associated with
wireless usage
• Ensure wireless users receive additional training related to wireless attack
detection and prevention

Initial

Tasks as Required

Wireless device configuration management

• Delete clients from the MAC address filtering list and access control list that no
longer require wireless network access
• Install vendor security patches
 • Update VMS for IAVMs
• Update wireless device firmware
• Schedule downtime for system/device reboots
• Change all default passwords on new equipment

Wireless user account management

• Maintain list of authorized wireless users
• Verify list of authorized wireless users still require wireless access
• Verify User Account Configuration
• Remove access from users that are no longer authorized for wireless access
• Ensure new wireless users have signed a site Wireless Usage Agreement

Authorized wireless device tracking

• Maintain list of authorized wireless devices
• Remove devices that are no longer approved for wireless access

After administrator personnel departure

• Change encryption keys on all wireless network devices
• Change administrator passwords
• Change passwords on wireless network devices
• Remove departing administrator’s wireless access

INFOCON Status requirement changes

• Adjust wireless security review/configuration to reflect current INFOCON
requirements

After system configuration changes

• Verify changes accomplish the desired objectives
• Create Emergency System Recovery Data
• Create new system configuration baseline
• Document System Configuration Changes
• Review and update SSAA
• Update VMS for Asset Changes
• Run and verify that a successful backup of the device has been performed
• Note the locations of wireless routers, APs, repeaters, dependent security devices,
and antenna on installation maps and floor plans
• Use mobile device to identify/document signal coverage of wireless network
devices (same process as Monthly Task)

After security incident involving wireless infrastructure

• Perform all tasks identified in this checklist

----------------------------------------------------------------