c11.2 Detection of unauthorized wireless access points
Detect and manage the presence of wireless access points (authorized and unauthorized). In a pure AWS environment there is no customer wireless infrastructure, which must be documented in scope.
Requirement 11
Test Security of Systems and Networks Regularly
PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.
11.2 Wireless access points are identified and monitored, and unauthorized wireless access points are addressed
- 11.2.1 Authorized and unauthorized wireless access points managed Covered
- 11.2.2 Inventory of authorized wireless access points maintained Your responsibility
How to implement on AWS
For 100% AWS deployments, document that no wireless networks exist within the customer scope. In hybrid environments, maintain an inventory of authorized access points and processes for detecting unauthorized ones; centralize the evidence and its periodic review.
Practical implementation
How this control is implemented in each reference architecture:
For a pure AWS deployment the tactical work is documenting wireless non-applicability, or running quarterly detection where hybrid wireless exists.
- Confirm there is no customer wireless infrastructure in the AWS scope (AWS manages data-center wireless).
- Record the non-applicability of 11.2 for the customer scope, with rationale, in the PCI scope document.
- If hybrid wireless exists, maintain an authorized-AP inventory (with business justification) and quarterly rogue-AP detection records.
How to validate: The scope document states 11.2 applicability with rationale; where wireless exists, the AP inventory and quarterly detection records are current.
Avoid: Silently skipping 11.2 on AWS. Document the non-applicability explicitly; an assessor needs the rationale on record.
Decide wireless applicability once at the org level, and where hybrid wireless connects, run detection from the central network account.
- Document wireless non-applicability once at the organization level so every account inherits the position.
- For hybrid environments, manage rogue-AP detection from the central network account.Network/inspection account
Transit Gateway - Record detection results against the shared-responsibility matrix centrally.Org-level evidence store
Amazon S3
How to validate: The org-level scope document addresses 11.2, and any hybrid wireless has current quarterly detection records referenced from the matrix.
Avoid: Documenting wireless applicability inconsistently per account. Decide it once at the org level.
PCI validation
Testing procedures
- Examine the methodology and documentation and interview personnel to verify processes detect and identify both authorized and unauthorized wireless access points at least every 3 months (11.2.1.b, 11.2.1.c).
- Examine documentation to verify an inventory of authorized wireless access points with business justification is maintained (11.2.2). On AWS this is typically AWS-managed; document non-applicability for the customer scope where applicable.
Evidence in AWS
- PCI scope document indicating applicability or non-applicability of wireless.
- Where applicable: inventory of authorized APs and quarterly detection records.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 11.2 — Unauthorized wireless access points are identified and addressed periodically.
AWS services
AWS Config Learning resources
References
- PCI DSS v4.0.1 Requirement 11.2