Summary

Access points must not use the factory-set IP address.

Description

This requirement refers to the fact that factory-set IP addresses are well-known, publicly available and documented by manufacturers. If access points use these default IP addresses, it becomes easier for attackers to locate and eventually exploit them. Changing the default IP address makes it more harder for unauthorized individuals or attackers to access specific devices.

References

• MITRE-M1031. Network intrusion prevention
• PADSS-6_1. The wireless technology must be implemented securely
• HITRUST-09_m. Network controls
• ISO27002-8_20. Network controls
• PTES-6_7_6_2. Exploitation - Proximity access (attacking the user)
• PTES-7_4_5_2. Post Exploitation - Pillaging (system configuration - configured wireless networks and keys)
• C2M2-9_2_c. Implement network protections for cybersecurity architecture
• PCI-2_3_1. Wireless environments are configured and managed securely
• ISO27001-8_20. Network controls