ASD ISM 1712 Ensure secure authenticator communication for wireless FT
What it says
The use of FT (802.11r) is disabled unless authenticator-to-authenticator communications are secured by an ASD-Approved Cryptographic Protocol.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain English802.11r is disabled unless secured by approved cryptographic protocol.
This control ensures that when your wireless network uses a feature called 'Fast Transition', which helps devices switch quickly between different Wi-Fi access points, the communications between access points are secure. Without secure communication, someone with bad intentions could potentially intercept sensitive information when devices switch between Wi-Fi hotspots, putting your data and network at risk.
Free. Save your status, tasks and notes.
Why it matters
If 802.11r FT is enabled without secured authenticator-to-authenticator links, attackers could spoof or intercept roaming exchanges, leading to unauthorised access.
How to implement
The IT team should review the network settings to check if the Fast Transition feature, known as 802.11r, is enabled.
If it is, they should ensure that this feature is only used if the communication between access points is secured by an approved cryptographic protocol that meets the standards set by the Australian Signals Directorate (ASD).
The network administrator should document and list all Wi-Fi access points used in the organisation and verify they support secure 802.11r communication.
This involves checking the device specifications or consulting with the vendor for detailed information on security protocols implemented.
IT staff should regularly update the firmware on all Wi-Fi equipment to the latest version, as updates often include security enhancements.
They should schedule these updates out of business hours to minimise disruptions.
Managers should organise regular security training for staff, focusing on the importance of secure network transitions, and ensure that staff are aware of the potential risks of unsecured wireless communications.
The IT team should periodically test the Wi-Fi network for vulnerabilities, including the secure implementation of Fast Transition.
They may use tools for vulnerability scanning or engage a professional service for a scheduled security audit.
Keep it running
Confirm 802.11r FT is disabled, or secure authenticator-to-authenticator traffic with an ASD-Approved Cryptographic Protocol; periodically validate WLAN settings and protocol approval status.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A network configuration report: Request detailed documentation of the wireless network settings.
Look at
Specific settings indicating 802.11r is either secured by an ASD-approved cryptographic protocol or disabled.
Good evidence
Is when the report clearly demonstrates adherence to security protocols.
- Check 2 of 5What an auditor asks for
Ask for
Staff training records: Request evidence of recent security training sessions held for staff. Examine attendance records and session content to ensure they include information about secure wireless network practices.
Good evidence
Includes a detailed agenda and sign-in sheet for relevant sessions.
- Check 3 of 5What an auditor asks for
Ask for
To see firmware update logs: Request the update logs for all Wi-Fi access points.
Look at
The dates and details of firmware updates to ensure they are recent and sourced from the manufacturer.
Good evidence
Is logs showing regular updates to the latest versions.
- Check 4 of 5What an auditor asks for
Ask for
Vendor communications or documentation: Request any correspondence with vendors about the security capabilities of the access points.
Look at
Confirmations that the devices support an ASD-approved cryptographic protocol for 802.11r.
Good evidence
Is written confirmation from the vendor.
- Check 5 of 5What an auditor asks for
Ask for
Test results from any network vulnerability scans: Request the most recent vulnerability scan reports of the wireless network.
Look at
The findings and mitigation actions taken, particularly regarding Fast Transition security.
Good evidence
Includes resolved issues and evidence of ongoing monitoring.
Mappings
Closest match in ISO/IEC 27001: A.8.24, Effective use of cryptography and key management, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.24.
ISM-1712 requires organisations to disable 802.11r Fast Transition unless authenticator-to-authenticator communications are secured using an ASD-Approved Cryptographic Protocol. Annex A 8.24 requires the organisation to define and implement rules for effective use of cryptography and cryptographic key management. ISM-1712 is a specific wireless/roaming implementation of cryptographic protection expectations that Annex A 8.24 addresses more broadly across the organisation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.