ASD ISM 1320 Avoid using MAC filtering for wireless access control
What it says
MAC address filtering is not used to restrict which devices can connect to wireless networks.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishDo not use MAC address filtering to control devices connecting to your wireless network.
The control advises against using MAC address filtering to decide which devices can connect to your wireless network. This is crucial because MAC addresses can be easily faked, meaning someone with the right skills could pretend to be an authorised device and gain access to your network, potentially compromising your security.
Free. Save your status, tasks and notes.
Why it matters
Relying on MAC filtering can permit unauthorised wireless access, as attackers can easily spoof permitted MAC addresses.
How to implement
Business owners should evaluate alternative ways to control access to the wireless network, like using strong passwords and advanced encryption.
This can be done by consulting with a trusted IT professional to set up these safer measures.
The IT team should disable the MAC filtering feature on the wireless router's settings.
They can access the router's admin interface and find the option to turn off MAC address filtering, usually under the security or access control settings.
IT administrators should implement WPA3 encryption on the wireless network to ensure more secure access.
This involves updating the network settings on the router to enable WPA3 if supported, or at least WPA2 if WPA3 is unavailable.
Managers should educate staff about the importance of using strong and unique passwords for connecting to the wireless network.
They can conduct a quick training session and share guidelines on creating strong passwords.
Business owners should set up regular reviews of wireless network security settings.
This can be achieved by scheduling periodic meetings with the IT team to review and update wireless security configurations, ensuring only the latest secure methods are used.
Keep it running
Verify WLAN configs have MAC filtering disabled; enforce WPA2/3-Enterprise with 802.1X, and review settings after changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The router's configuration documentation: Request a printout or screenshot of the router settings showing disabled MAC filtering.
Look at
The wireless security section and confirm MAC filtering is off.
Good evidence
Shows MAC filtering clearly marked as 'disabled'.
- Check 2 of 5What an auditor asks for
Ask for
A security policy document: Request the document detailing why MAC filtering is not used in the network.
Look at
The justification provided for avoiding MAC filtering.
Good evidence
Explains the vulnerabilities of MAC filtering and the chosen alternative security measures.
- Check 3 of 5What an auditor asks for
Ask for
Meeting notes on security reviews: Request documentation from the latest wireless security review meeting.
Look at
Discussion points and decisions related to MAC filtering and wireless security practices.
Good evidence
Includes notes showing MAC filtering review and alternative measures considered.
- Check 4 of 5What an auditor asks for
Ask for
To see staff training records: Request evidence of training sessions on secure wireless practices.
Look at
Attendance records and training materials.
Good evidence
Includes a list of attendees and the topics covered about secure network access.
- Check 5 of 5What an auditor asks for
Ask for
A list of authorised devices: Request a list of devices that have been given access to the wireless network through secure methods.
Look at
The list for any indication of MAC addresses being recorded or unused.
Good evidence
Shows device authorisation being managed through secure, alternative methods, not MAC addresses.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.20.
ISM-1320 requires that MAC address filtering is not used to restrict which devices can connect to wireless networks, because it is not an effective access control. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which would include choosing robust wireless access control mechanisms rather than weak ones like MAC filtering. Annex A 8.20 is broader and technology-agnostic, while ISM-1320 is a specific prohibition focused on wireless access control design.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.