
35
A user may gain access to services (either on the TOE or by
sending data through the TOE) for which they are not
authorized according to the TOE security policy.
An unauthorized user or process may gain access to an
administrative account.
Rogue APs and malicious wireless clients may attempt to
subvert the wireless network.
An unauthorised user may attempt to gain access to an
authorised client with saved credentials and attempt to subvert
the wireless network.
4.3 Organizational Security Policies
An organizational security policy is a set of rules, practices, and procedures imposed by an organization to
address its security needs. Table 11 identifies the organizational security policies applicable to the WLAN.
Table 10 Organizational Security Policies
The TOE shall display an initial banner for administrator
logins describing restrictions of use, legal agreements, or any
other appropriate information to which users consent by
accessing the system.
The authorized users of the TOE shall be held accountable for
their actions within the TOE.
The TOE shall provide cryptographic functions for its own use,
including encryption/decryption operations.
Only NIST FIPS validated cryptography (methods and
implementations) are acceptable for key management (i.e.;
generation, access, distribution, destruction, handling, and
storage of keys) and cryptographic services (i.e., encryption,
decryption, signature, hashing, key exchange, and random
number generation services).
The TOE shall provide the capability to encrypt/decrypt
wireless network traffic between the TOE and those wireless
clients that are authorized to join the network.
In concordance with the DOD Wireless Policy, there will be no
ad hoc 802.11 or 802.15 networks allowed.
Comentarios a estos manuales