NIST 800-53 REV 5 • SYSTEM AND COMMUNICATIONS PROTECTION
SC-40(3) — Imitative or Manipulative Communications Deception
Implement cryptographic mechanisms to identify and reject wireless transmissions that are deliberate attempts to achieve imitative or manipulative communications deception based on signal parameters.
Supplemental Guidance
The implementation of cryptographic mechanisms to identify and reject imitative or manipulative communications ensures that the signal parameters of wireless transmissions are not predictable by unauthorized individuals. Such unpredictability reduces the probability of imitative or manipulative communications deception based on signal parameters alone.
Practitioner Notes
Protect against imitative or manipulative communications deception — attacks where an adversary mimics your wireless communications to inject false data or steal credentials.
Example 1: Use 802.1X with certificate-based authentication for WiFi. Clients verify the authentication server's certificate before sending credentials, preventing evil twin access points from harvesting user passwords.
Example 2: Configure your wireless IDS to detect MAC address spoofing. Alert when a new access point appears with the same SSID as your corporate network but with a different MAC address or on a different channel — this is a classic evil twin indicator.