Securing the Network

1.0 Purpose

This policy (provided here with permission from SANS) prohibits access to <Company Name> networks via unsecured wireless communication mechanisms. Only wireless systems that meet the criteria of this policy or have been granted an exclusive waiver by InfoSec are approved for connectivity to <Company Name>‘s networks.

2.0 Scope

This policy covers all wireless data communication devices (that is, personal computers, cellular phones, PDAs, and so forth) connected to any of <Company Name>‘s internal networks. This includes any form of wireless communication device capable of transmitting packet data. Wireless devices and/or networks without any connectivity to <Company Name>‘s networks don't fall under the purview of this policy.

3.0 Policy

To comply with this policy, wireless implementations must do the following: maintain point-to-point hardware encryption of at least 56 bits; maintain a hardware address that can be registered and tracked, that is, a MAC address; and support strong user authentication that checks against an external database, such as TACACS+, RADIUS, or something similar.

4.0 Enforcement

Any employee found to have violated this policy could be subject to disciplinary action, up to and including, termination of employment.

5.0 Definitions

• Terms (add terms here)

• Definitions (add definitions here)

• User Authentication A method by which the user of a wireless system can be verified as a legitimate user independent of the computer or OS being used.

  6.0 Revision History

  The references to <Company Name> would be replaced by the company or client name and references to InfoSec would be replaced by the name of the company department responsible for network security. The reference to Aironet refers to a pioneer wireless manufacturer, since acquired by Cisco. The design with standardized sections and titles makes it easy to add a policy unique to the organization that would fit right in.

  EXCEPTION

  A limited-duration waiver to this policy for Aironet products has been approved, if specific implementation instructions are followed for corporate and home installations.