The transmission power of wireless access points should be adjusted to restrict the wireless signal to the organization's facilities as closely as possible.
Control Type: Technical
Control Function: Preventive
Description: Oftentimes, wireless networks broadcast their Service Set Identifier (SSID) to a much larger range than is needed. This is especially noticeable in busy, crowded areas with lots of neighboring storefronts and offices. An overextended Wi-Fi network is a security risk. Since the SSID is viewable to a wide area outside the facility, threat actors can locate and potentially compromise the network without needing to breach the physical premises of the organization. Wardriving is a specific reconnaissance method involving threat actors driving along streets with large numbers of businesses, using a laptop or other mobile device to snoop for WiFi networks. Warflying is another method in which threat actors use drones to scout for Wi-Fi networks from the air, potentially gathering more targets than one could in a car. To lower the risk of wireless attacks stemming from an overextended SSID, organizations should adjust the Transmission Power setting on their SOHO router or wireless access points. This might involve some trial and error to find the right balance. The transmission power should not be tuned so low that it denies access to valid clients within the facilities. Implementing this control can be assisted by using Wi-Fi mapping software that displays a heat map of wireless coverage in and around the physical premises.