Purpose

This policy establishes the requirements and guidelines for using the 802.1X EAP-TLS authentication protocol to secure network access (wired or wireless) and protect sensitive organizational data. It aims to ensure proper authentication of users and devices before granting access to the network and enforce robust security measures aligned with organizational principles.

Scope

This policy applies to all employees, contractors, third-party vendors, and devices accessing the organization’s network through wired or wireless connections. This includes laptops, desktops, mobile devices, and other network-enabled devices.

Policy Statement

1. Authentication Requirements:
   • 802.1X EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) shall be the standard authentication method for network access across all organizational network segments.
   • All devices accessing the network must use digital certificates issued by the organization’s Public Key Infrastructure (PKI) for mutual authentication. The client device and the network infrastructure (e.g., switches and access points) must validate each other’s certificates to establish trust.
2. Certificate Management:
   • Digital certificates used in the EAP-TLS process must be issued by an internal Certification Authority (CA) or a trusted third-party CA in compliance with the organization’s PKI standards.
   • Certificates must be regularly renewed according to the expiration dates and security requirements outlined in the Certificate Management policy.
   • Certificate revocations must be handled promptly through mechanisms such as Certificate Revocation Lists (CRLs) or the Online Certificate Status Protocol (OCSP).
3. Access Control:
   • Network access will only be granted if the device can successfully complete the EAP-TLS 802.1X authentication process using valid certificates.
   • Access control policies should enforce role-based access control (RBAC), ensuring users are granted network access based on their organizational roles.
   • Network access will be denied to devices that cannot meet the 802.1X EAP-TLS authentication standards (e.g., devices without a valid certificate).
4. Network Segmentation:
   • Networks must be segmented according to security needs and requirements. Devices authenticated using 802.1X EAP-TLS will be granted access to appropriate network segments based on their user role, device type, or department.
   • Unauthorized or non-compliant devices should be isolated in a separate quarantine network until they can be brought into compliance.
5. Encryption Requirements:
   • All communications over the 802.1X authentication process, including the EAP-TLS handshake, must be encrypted using robust encryption protocols (e.g., TLS 1.2 or higher) to prevent eavesdropping and man-in-the-middle attacks.
   • Weak or deprecated cryptographic protocols, such as SSL or TLS versions earlier than 1.2, are strictly prohibited.
6. Compliance and Auditing:
   • Network access logs, including EAP-TLS authentication attempts, must be regularly reviewed to ensure compliance with this policy and to detect potential security incidents.
   • A security auditing process must be in place to verify that all systems and devices support 802.1X EAP-TLS authentication and adhere to network access control policies.
   • Compliance with this policy will be periodically assessed as part of the organization’s risk management and security audit processes.
7. Incident Response:
   • In case of a failed authentication or potential compromise of network access credentials, the Incident Response Team will immediately investigate the incident following established protocols.
   • Any signs of misuse or malicious activity during the authentication process must be reported and addressed immediately, including the revocation of compromised certificates.
8. Roles and Responsibilities

• Network Administrators:
  • Configure and maintain the 802.1X EAP-TLS authentication infrastructure, including RADIUS servers and access control devices.
  • Ensure digital certificate management, including issuance, renewal, and revocation.
  • Monitor access logs for unauthorized attempts or potential security breaches.
• Security Officers:
  • Define and enforce the organization’s overall network security and access control policies.
  • Oversee compliance with 802.1X EAP-TLS authentication requirements.
  • Conduct regular audits to verify the proper implementation of network security controls.
• End Users:
  • Ensure their devices have valid and up-to-date certificates installed before accessing the network.
  • Report any issues related to network access or authentication promptly to IT support.

Violations of this policy may result in disciplinary action, including termination of employment or contractual agreements. Non-compliance will result in restricted access to the organization’s network resources.

9. Review and Revision

This policy will be reviewed annually or following significant changes to the organization’s network infrastructure or security requirements. Revisions will be made as necessary to ensure continued compliance with industry standards and regulatory requirements.