ASD ISM 1315 Disable wireless network administrative interfaces
What it says
The administrative interface on wireless access points is disabled for wireless network connections.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that administrative access to wireless routers cannot be done through wireless connections.
This control ensures that people cannot access the admin settings of a wireless network through a wireless connection. This matters because if someone with bad intentions gets admin access over wireless, they could change settings and cause major problems for your network and business operations.
Free. Save your status, tasks and notes.
Why it matters
If wireless admin access isn't disabled on access points, nearby attackers can change settings, weakening security and causing outages.
How to implement
The IT team should configure each wireless router to disable remote admin access via wireless.
Use the router's settings interface to ensure that any admin access can only be done over a wired connection.
IT support staff should review and update network policies to clearly state that admin interfaces for wireless routers are not allowed to be accessed wirelessly.
Use internal documentation to communicate this policy to staff and stakeholders.
Network administrators should regularly check router settings to confirm that wireless admin access remains disabled.
Use a checklist to verify that no changes have accidentally enabled this access over time.
The procurement officer should ensure that any new routers purchased allow admin access restrictions to be configured easily.
Consult with suppliers to select equipment that supports this security feature before buying.
The IT security team should develop a training session for relevant staff on why admin access restrictions are crucial and how to manage router settings safely.
Schedule and deliver the training using easy-to-follow instructions and practical examples.
Keep it running
Periodically confirm AP management interfaces are blocked on wireless SSIDs; manage via wired admin VLAN or VPN/jump host only.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Access to the network configuration documents: Request network setup procedures and router configurations.
Look at
These documents for sections detailing how admin access is restricted to wired connections. Good evidence will show clear steps and responsible persons for configuring these settings.
- Check 2 of 5What an auditor asks for
Ask for
A demonstration of the current router settings: Request a live or recorded walkthrough of a router's settings showing disabled wireless admin access. Look to confirm that the option is indeed turned off.
Good evidence
Outcome is seeing this setting disabled across all wireless routers used in the organisation.
- Check 3 of 5What an auditor asks for
Ask for
Logs of changes to router settings: Request logs that detail recent changes made to router settings, including who made them and when.
Look at
Logged instances confirming settings adjustments as well as consistent dates and responsible personnel. Good evidence includes logs showing regular checks and no unauthorised changes.
- Check 4 of 5What an auditor asks for
Ask for
Network policy documents: Request the documents outlining network management policies related to this control.
Look at
Specific clauses that discuss disabling wireless admin access.
Good evidence
Includes explicitly stated policies and dates of approval or review by management.
- Check 5 of 5What an auditor asks for
Ask for
Training session records: Request evidence of training sessions conducted regarding this control.
Look at
Attendance records, session materials, and feedback forms. Good evidence is having clear records of who attended, what was taught, and how often training is revisited.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.20.
ISM-1315 requires organisations to disable the administrative interface on wireless access points for wireless network connections, preventing wireless-based management access. This relates to Annex A 8.20 because securing and controlling network devices includes hardening management planes and restricting how administration can occur on devices such as wireless access points. Annex A 8.20 is broader as it covers security management and control of networks and all network devices generally, not this specific wireless administrative-interface restriction.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.