SI-4(14) Wireless Intrusion Detection
Enhancement of: SI-4
High-Level Description
Family: System and Information Integrity (SI)
Framework: NIST SP 800-53 Rev 5
Wireless signals may radiate beyond organizational facilities. Organizations proactively search for unauthorized wireless connections, including the conduct of thorough scans for unauthorized wireless access points. Wireless scans are not limited to those areas within facilities containing systems but also include areas outside of facilities to verify that unauthorized wireless access points are not connected to organizational systems.
What to Check
How to Test
Step 1: Review Documentation
Examine the System Security Plan (SSP) and related artifacts for SI-4(14) implementation details. Verify the organization has documented how this control is satisfied.
Step 2: Validate Implementation
# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly
# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null
Step 3: Test Operating Effectiveness
Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.
Tools
| Tool | Purpose | Usage |
|---|
| cloud-audit-mcp | Check integrity monitoring | cloud_audit_monitoring |
| AWS CLI | Review GuardDuty/Inspector | aws guardduty list-detectors |
Remediation Guide
Control Statement
Employ a wireless intrusion detection system to identify rogue wireless devices and to detect attack attempts and potential compromises or breaches to the system.
Implementation Guidance
Wireless signals may radiate beyond organizational facilities. Organizations proactively search for unauthorized wireless connections, including the conduct of thorough scans for unauthorized wireless access points. Wireless scans are not limited to those areas within facilities containing systems but also include areas outside of facilities to verify that unauthorized wireless access points are not connected to organizational systems.
Risk Assessment
| Finding | Severity | Impact |
|---|
| SI-4(14) Wireless Intrusion Detection not implemented | High | System and Information Integrity |
| SI-4(14) partially implemented | Medium | Incomplete System and Information Integrity |
CWE Categories
| CWE ID | Title |
|---|
| CWE-20 | Improper Input Validation |
References
Checklist
