07/09/2024
CJISSECPOL v5.9.5
194
5.13 Policy Area 13: Mobile Devices
This policy area describes considerations an d requirements for mobile devices including smartphones and tablets. Mobile devices are not limited to a single form factor or communications medium. The requirements in this section augmen t those in other areas of the Policy to address the gaps introduced by using mobile devices.
The agency shall: (i) establish usage restrictions and implementation guidance for mobile devices; and (ii) authorize, monitor, control wireless access to the information system. Wireless technologies, in the simplest sense, enable one or more devices to communicate without physical connections—without requiring ne twork or peripheral cabling.
Appendix G provides reference material and additional information on mobile devices.
5.13.1 Wireless Communications Technologies
Examples of wireless communication technologies include, but are not limited to: 802.11, cellular, Bluetooth, satellite, microwave, and land mobile radio (LMR). Wireless technologies require at least the minimum security applied to wired t echnology and, based upon the specific technology or implementation, wirele ss technologies may require additional security controls as described below.
5.13.1.1 802.11 Wireless Protocols
Wired Equivalent Privacy (WEP) and Wi-Fi Pr otected Access (WPA) cryptographic algorithms, used by all pre-802.11i protocols, do not meet th e requirements for FIPS 1 40-2 and shall not be used.
Agencies shall implement the following controls for all agency-managed wireless access points with access to an agency’s network that processes unencrypted CJI:
1. Perform validation testing to ensure rogue APs (Access Points) do not exist in the 802.11 Wireless Local Area Network (WLAN) and to fully understand the wireless network security posture.
2. Maintain a complete inventory of all Access Points (APs) and 802.11 wireless devices.
3. Place APs in secured areas to prevent unauthorized physical access and user manipulation.
4. Test AP range boundaries to determine the prec ise extent of the wireless coverage and design the AP wireless coverage to limit the coverage area to only what is needed for operational purposes.
5. Enable user authentication and encryption mechanisms for the management interface of the AP.
6. Ensure that all APs have strong administrative passwords and ensure that all passwords are changed in accordance with Section 5.6.2.1.
7. Ensure the reset function on APs is used only when needed and is only invoked by authorized personnel. Restore the APs to th e latest security settings, when the reset functions are used, to ensure the factory default settings are not utilized.