[Autogenerated] So, Jacob,
we started talking about making sure things were working in Requirement 10.
Yes,
that requirement for service providers spells report
to to do things with failures.
Requirement 11 is all about checking things.
Error working, isn't it?
And it starts off by looking at wireless access.
This is a really weird one, because it is an odd one.
So So talk me through.
I could tell you why it's there because it's there because there
was a very big breach a long time ago where somebody sat in the
car park and siphoned cardholder data from a big fashion retailer
over the wireless network.
So that's why we have that requirement in place,
yes, but as a necessity time, you know,
I often see just mouth is not a place where we don't have any wireless networks.
Well, that that's an error, right?
Because the goal in 11 1 is to say, find hostile wireless devices, right?
And in the early part of my career, when I did ___________,
testing some of the internal kind of half social engineering,
half kind of technical pen testing was figuring out,
Can we walk into a place and plug a wireless network into into a network,
jack somewhere that we shouldn't and then have the end
of the colleague in the car park, you know,
connect to the network and do something terrible right on.
The answer was generally, yeah, we could do that, right.
We could disable the door control system.
Um, testing for was network.
If I just pull out my phone and scan for wireless networks,
you know, 50 or 60 of them quite frequently.
Sure.
So?
So there's, I think once upon a time,
it was an intern with nets Tumbler on a laptop,
Right?
Uh, you know, in advance of the mobile phone that could do that for you.
Kind of wandering around the space, looking for wireless networks anymore.
That seems like a more troublesome approach,
right,
Because you can't tell if that radio signal is connected
to your network or somebody else's.
I think you have to go through kind of the other side, right?
And a lot of the sort of general kind of asset management stuff will cover this,
right?
What is plugged into my switches?
Right.
Uh, and and on a small enough scale,
somebody going and looking at the back of the switch and
saying what is plugged into my switches?
Can I follow the wires?
Do they all go to the places I expect them to?
Could work right on the larger scale that gets that gets,
you know, uh, troublesome very quickly.
But if you're able to, then see, what are all the things that are connected,
right?
Do I recognize them?
Do they belong, uh, you know, is sort of one way to do it.
And then 11, 1 morphed a little bit along the way.
I think in this sort of 3.1, uh,
time frame where it wasn't just about wireless devices
connected over a network connection.
But if somebody is inserting,
like a USB wireless interface into a server or
workstation or something like that, uh, that also matters.
So, uh, you know, it may be the case where you know,
if you have a handful of rack racks of systems in a data center,
you go look and somebody plug something into the USB ports,
right?
Or again, You look at you know, the, uh,
device sort of configuration logs or a D message on UNIX,
a Linux systems or whatever, and like what's plugged into the USB ports.
Yeah, but you know, the standard says very clearly.
If you've got very good network access control,
like road devices can't get plugged in.
Right?
That has the that fulfills the intent of the required does.
It does.
So you don't need a wireless specific utility to do that.
There's an accessory.
You seeing more people relying on the network level control
rather than the scanning for wireless.
Yes, very much so.
Yeah.
Just you can see for water in any public environment.
I don't I don't see how it works, even in a co location facility right there.
You know,
there might be other tenants in that cola who have some
WAP in there for whatever reason.