Wireless- Public Hotspot Pattern
Wireless public hotspot security pattern to access corporate computing resources
Click on controls in the diagram to view details. Download SVG
When to Use
You should apply this pattern when providing access for remote workers via Wireless Hotspots to your private corporate or organisation network. This pattern does not cover Bluetooth or Infrared.
When NOT to Use
Highly secure environments where risks from external connectivity must be minimised.
Typical Challenges
Strong authentication should be as easy to use as possible, with certificates stored on Smartcards a useful option. Other common approaches involve the use of tokens that generate a time based code that is entered along with a user ID and static PIN.
Clients need to have good configuration management to ensure that OS and application patches, signatures for antivirus and personal firewalls are kept up to date.
Threat Resistance
Spoofing, eavesdropping, impersonation, unauthorised access to computing resources.
Assumptions
Wireless Access Points cannot be trusted therefore the client machines must have personal firewalls installed, ideally with the ability to detect malicious traffic via anomaly detection or signatures. Personal firewalls should be configured to silently drop all inbound connections. Confidentiality and integrity is provided by use of a VPN to connect to private networked resources. Strong authentication ensures only valid users can connect.
Ensure that Network Intrusion Detection and Protection devices are deployed to cover traffic from VPN.
Mapped Controls (17)
- AC-19 Access Control For Portable And Mobile Devices
- AT-01 Security Awareness And Training Policy And Procedures
- AT-03 Security Training
- AT-04 Security Training Records
- AU-02 Auditable Events
- CA-02 Security Assessments
- CA-07 Continuous Monitoring
- IA-02 User Identification And Authentication
- IR-02 Incident Response Training
- IR-04 Incident Handling
- IR-05 Incident Monitoring
- IR-06 Incident Reporting
- IR-07 Incident Response Assistance
- RA-05 Vulnerability Scanning
- SC-08 Transmission Integrity
- SC-09 Transmission Confidentiality
- SC-13 Use Of Cryptography