Is firmware on wireless devices updated to support Review policies and procedures strong encryption for authentication and Review vendor documentation transmission over wireless networks? Examine system configurations Are other security-related wireless vendor defaults Review policies and procedures changed, if applicable? Review vendor documentation Examine system configurations Are only necessary services, protocols, daemons, 2.2.2 Review configuration standards etc. enabled as required for the function of the Examine system configurations system (services and protocols not directly needed to perform the device’s specified function are disabled)? Are all enabled insecure services, daemons, or Review configuration standards protocols justified per documented configuration Interview personnel standards? Examine configuration settings Compare enabled services, etc. to documented justifications 2.2.3 Are additional security features documented and Review configuration standards implemented for any required services, protocols or Examine configuration settings daemons that are considered to be insecure? For example, use secured technologies such as SSH, FTP, SSL or IPSec VPN to protect insecure services such as NetBIOS, file-sharing, Telnet, etc. Are system administrators and/or personnel that 2.2.4 Interview personnel configure system components knowledgeable about common security parameter settings for those system components? Are common system security parameters settings Review system configuration included in the system configuration standards? standards
Is firmware on wireless devices updated to support strong encryption for authentication and transmission over wireless networks? Review policies and procedures Review vendor documentation Examine system configurations Are other security-related wireless vendor defaults changed, if applicable? Review policies and procedures Review vendor documentation Examine system configurations 2.2.2 Are only necessary services, protocols, daemons, etc. enabled as required for the function of the system (services and protocols not directly needed to perform the device’s specified function are disabled)? Review configuration standards Examine system configurations Are all enabled insecure services, daemons, or protocols justified per documented configuration standards? Review configuration standards Interview personnel Examine configuration settings Compare enabled services, etc. to documented justifications 2.2.3 Are additional security features documented and implemented for any required services, protocols or daemons that are considered to be insecure? For example, use secured technologies such as SSH, SSL or IPSec VPN to protect insecure services such as NetBIOS, file-sharing, Telnet, FTP, etc. Review configuration standards Examine configuration settings 2.2.4 Are system administrators and/or personnel that configure system components knowledgeable about common security parameter settings for those system components? Interview personnel Are common system security parameters settings included in the system configuration standards? Review system configuration standards
cash-pic-saq-c-vt-v3.docx