School
of Visual Arts is hereinafter referred to as “the company.”

1.0
Overview

Wireless communication
is playing an increasingly important role in the workplace.  In the past, wireless access was the
exception; it has now become the norm in many companies.  However, while wireless access can increase
mobility and productivity of users, it can also introduce security risks to the
network.  These risks can be mitigated
with a sound Wireless Access Policy.

2.0 Purpose

The purpose of this
policy is to state the standards for wireless access to the company’s
network.  Wireless access can be done
securely if certain steps are taken to mitigate known risks.  This policy outlines the steps the company
wishes to take to secure its wireless infrastructure.

3.0 Scope

This policy covers
anyone who accesses the network via a wireless connection.  The policy further covers the wireless
infrastructure of the network, including access points, routers, wireless
network interface cards, and anything else capable of transmitting or receiving
a wireless signal.

4.0 Policy

4.1
Physical Guidelines

Unless a directional
antenna is used, a wireless access point typically broadcasts its signal in all
directions.  For this reason, access
points must be located central to the office space rather than along exterior
walls.  Technology must be used to
control the signal broadcast strength so that it is reduced to only what is
necessary to cover the office space. 
Directional antennas must be used as necessary to focus the signal to
areas where it is needed. 

Physical security of access points must be considered.  Access points must be placed in secured areas
of the office.  Cabling to and from
access points should be secured so that it cannot be accessed without
difficulty. 

4.2 Configuration and Installation
The following
guidelines apply to the configuration and 
installation of wireless networks:

4.2.1 Security
Configuration

•           The Service Set Identifier
(SSID) of the access point must be changed from the factory default.  The SSID must be changed to something
completely nondescript.  Specifically,
the SSID must not identify the company, the location of the access point, or
anything else that may allow a third party to associate the access point’s
signal to the company.

•           The SSID must not be
broadcast.  This adds a layer of security
by requiring wireless users to know the SSID in order to connect to the
network.

•           The wireless access point must
utilize Mac address filtering so that only known wireless NICs are able to
connect to the wireless network.

•           The wireless access point must
not connect to the company’s trusted network without a firewall or other form
of access control separating the two networks.

•           Encryption must be used to
secure wireless communications.  The
strongest available algorithm must be used (i.e., WPA rather than WEP).  Encryption keys must be changed and
redistributed quarterly.

•           Administrative access to
wireless access points must utilize strong passwords.

•           All logging features must be
enabled on the company’s access points.

•           Wireless networking should
require users to authenticate against a centralized server.  These connections should be logged, with IT
staff reviewing the log regularly for unusual or unauthorized connections.

•           Wireless LAN management
software should be used to enforce wireless security policies.  The software must have the capability to
detect rogue access points.

•           Users accessing the wireless
network must be provided a personal software firewall to secure their
computers.

4.2.2 Installation

•           Software and/or firmware on
the wireless access points and wireless network interface cards (NICs) must be
updated prior to deployment.

•           Wireless networking must not
be deployed in a manner that will circumvent the company’s security controls.

•           Wireless devices must be
installed only by the company’s IT department.

•           Channels used by wireless
devices must be evaluated to ensure that they do not interfere with company
equipment.

4.3
Accessing Confidential Data

Wireless access to
confidential data is permitted as long as the access is consistent with this
and other policies that apply to confidential data.

4.4 Inactivity
Users must disable
their wireless capability when not using the wireless network.  This will reduce the chances that their
machine could be compromised from the wireless NIC. 

Inactive wireless access points must be disabled.  If not regularly used and maintained,
inactive access points represent an unacceptable risk to the company.

Wireless access points must be disabled during non-business hours.  This should be accomplished with management
software rather than manually performed.

4.5 Audits
The wireless network
must be audited quarterly to ensure that this policy is being followed.  Specific audit points should be: location of
access points, signal strength, SSID, SSID broadcast, and use of strong
encryption.

4.6 Applicability of Other Policies
This document is part
of the company’s cohesive set of security policies.  Other policies may apply to the topics
covered in this document and as such the applicable policies should be reviewed
as needed.

5.0
Enforcement

This policy will be
enforced by the IT Manager and/or Executive Team. Violations may result in
disciplinary action, which may include suspension, restriction of access, or
more severe penalties up to and including termination of employment. Where
illegal activities or theft of company property (physical or intellectual) are
suspected, the company may report such activities to the applicable
authorities.

6.0 Definitions

Mac Address 
Short for Media Access Control Address. 
The unique hardware address of a network interface card (wireless or
wired).  Used for identification purposes
when connecting to a computer network.

SSID  Stands for Service Set
Identifier.  The name that uniquely
identifies a wireless network.

WEP  Stands for Wired Equivalency
Privacy.  A security protocol for
wireless networks that encrypts communications between the computer and the
wireless access point.  WEP can be
cryptographically broken with relative ease.

WiFi  Short for Wireless
Fidelity.  Refers to networking protocols
that are broadcast wirelessly using the 802.11 family of standards.

Wireless Access Point  A central
device that broadcasts a wireless signal and allows for user connections.  A wireless access point typically connects to
a wired network.

Wireless NIC  A Network Interface
Card (NIC) that connects to wireless, rather than wired, networks.

WPA  Stands for WiFi Protected
Access.  A security protocol for wireless
networks that encrypts communications between the computer and the wireless
access point.  Newer and considered more
secure than WEP.

7.0
Revision History

Revision 2.0, 1/1/2015