Detections
Analytics

3.1.2 Ensure wireless interfaces are not available

Information

Wireless networking is used when wired networks are unavailable. Wireless interfaces use kernel modules loaded at runtime.

- IF - wireless is not required, wireless kernel modules should be disabled to reduce the potential attack surface. Wireless interfaces can be used as a secondary network path to bypass network monitoring, exfiltrate data, or introduce rogue access points that circumvent perimeter controls. Servers and workstations that operate in wired-only environments have no operational need for wireless capability.

Solution

Run the following command to disable any wireless interfaces:

# find /lib/modules/`uname -r`/kernel/drivers/net/wireless -name '*.ko' -printf 'install %f /bin/false\nblacklist %f\n\n' | sed 's/\.ko//1' >> /etc/modprobe.d/blacklist-wireless.conf

Note: the *.conf file in /etc/modprobe.d/ in the above command can renamed as needed.

After running this command, reload module configurations and verify no wireless modules remain loaded:

# modprobe --showconfig | grep -E '(install|blacklist).*80211|wifi|wireless'
# lsmod | grep -E '80211|wifi|wireless'

Nothing should be returned by the lsmod command.

Impact:

Many laptop workstations and some desktop workstations require wireless connectivity for normal operation. Applying this recommendation to such systems will disable wireless network access, which may disrupt users. Verify that no wireless connectivity is operationally required before applying remediation

See Also

https://workbench.cisecurity.org/benchmarks/26893

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|15.4, CSCv7|15.5

Plugin: Unix

Control ID: 9667f9594866ee7bf0a59f07af28d38cf10d1594a1a0fcbd3971a6558b5293f4