Guideline for a healthy information system v.2.0 (EN)

/STANDARD
The use of Wi-Fi in a professional environment is now widespread, yet it still presents very specific security risks: poor guarantees in terms of availability, no control over the coverage area which can lead to an attack out of the geographical scope of the organization, default configuration of access points that are not secure by design, etc. 

The network architecture segmentation must be able to limit the consequences of intrusion by radio access up to a given perimeter of the information system. The flows coming from devices connected to the Wi-Fi access network must therefore be filtered and restricted to just the necessary flows. 

Furthermore, it is important to give priority to the use of robust encryption (WPA2 mode, AES CCMP algorithm) and centralised authentication, if possible through client certificates for devices. 

Protecting the Wi-Fi network with a single and shared password is not advisable. However, if this is inevitable, it must be complex and its renewal must be planned, but under no circumstances must be transmitted to unauthorized third parties. 

Moreover, access points must be administrated in a secure way (e.g.: dedicated interface, changing the default administrator password). 

Finally, all Wi-Fi connection from staff or visitor terminals (laptops, smartphones) must be separate from Wi-Fi connections from the organization’s devices (e.g.: distinct SSID and VLAN, dedicated internet access).