Indian Telecom Security Assurance Requirements  
For 
Wi-Fi CPEs  
 
 
 
Security Assurance Standards (SAS),  
National Cent er for Communications  Security, Bengaluru  
Department of Telecom, Ministry of Communications  
Government of India   
   
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 2 of 32 
© NCCS 2020  
Table of Contents  
 
Introduction  ................................ ................................ ................................ ................................ ................  5 
1  Access and Authorization  ................................ ................................ ................................ ........................  6 
1.1  Management Protocols Entity M utual Authentication  ................................ ................................ ... 6 
1.2  Management Traffic Protection  ................................ ................................ ................................ .......  6 
1.3  Role -Based access control  ................................ ................................ ................................ ................  6 
1.4  User Authentication - Local/Remote  ................................ ................................ ...............................  6 
1.5  Remote Management Standards  ................................ ................................ ................................ ..... 7 
1.6  Remote Management Stan dards for Connected Devices, Additional Features  ..............................  7 
1.7  Unambiguous identification of the user & group  ................................ ................................ ............  7 
2  Authentication and Att ribute Management  ................................ ................................ ...........................  8 
2.1  Authentication Policy  ................................ ................................ ................................ .......................  8 
2.2  Authentication Support - External  ................................ ................................ ................................ ... 8 
2.3  Protection against brute force and dictionary attacks  ................................ ................................ .... 8 
2.4  Enforce Strong Password  ................................ ................................ ................................ .................  9 
2.5  Inactive S ession Timeout  ................................ ................................ ................................ .................  9 
2.6  Password Change facility, 1st Installation /Factory Reset  ................................ ...............................  9 
2.7  Protected Authentication feedback  ................................ ................................ ...............................  10 
2.8  Removal of predefined or default authentication attributes  ................................ ........................  10 
2.9  Storage of Passwo rds in encrypted form  ................................ ................................ .......................  10 
3  Software Security  ................................ ................................ ................................ ................................ .. 11 
3.1  Secure Update  ................................ ................................ ................................ ................................  11 
3.2  Secure Upgrade  ................................ ................................ ................................ ..............................  11 
3.3  Sou rce Code security assurance  ................................ ................................ ................................ .... 11 
3.4  Known Malware Check  ................................ ................................ ................................ ..................  11 
3.5  No unused softw are ................................ ................................ ................................ .......................  12 
3.6  Unnecessary Service Removal  ................................ ................................ ................................ .......  12 
3.7  Secure Time Synchronization  ................................ ................................ ................................ .........  13 
3.8  Self -Testing  ................................ ................................ ................................ ................................ ..... 13 
3.9  Featu re / Service Activation Policy  ................................ ................................ ................................  13 
3.10  Restricted reachability of services  ................................ ................................ ...............................  13 
4  System Secure Execution Environment  ................................ ................................ ................................  15 
4.1  No unused functions  ................................ ................................ ................................ ......................  15    
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 3 of 32 
© NCCS 2020  
4.2  No unsupported components  ................................ ................................ ................................ ........  15 
4.3  No Known Vulnerabilities in System on Chip (SOC) solution  ................................ .........................  15 
5  User Audit  ................................ ................................ ................................ ................................ .............  17 
5.1  Audit Event Generation  ................................ ................................ ................................ .................  17 
6  Data Protection  ................................ ................................ ................................ ................................ ..... 18 
6.1  Cryptographic Based Secure Communication  ................................ ................................ ................  18 
6.2  Cryptographic Based Secure Communication on Wi -Fi Access  ................................ .....................  18 
6.3  Cryptographic Algorithm selection for Wi -Fi Access  ................................ ................................ ...... 18 
6.4  Crypto -Key Protection Mechanism  ................................ ................................ ................................  19 
6.5  Protecting data and information - Confidential System Internal Data  ................................ ..........  19 
6.6  Protecting data and information in storage  ................................ ................................ ..................  19 
6.7  Protection against Copy of Data  ................................ ................................ ................................ .... 19 
6.8  Protection against Data Exfiltration - Overt Channel  ................................ ................................ .... 20 
6.9  Protection against Data Exfiltration - Covert Channel  ................................ ................................ ... 20 
7  Network Services  ................................ ................................ ................................ ................................ .. 21 
7.1  Traffic Filtering - Network Level  ................................ ................................ ................................ ..... 21 
8  Attack Prevention Mechanism  ................................ ................................ ................................ ..............  22 
8.1  Excessive Overload Protection  ................................ ................................ ................................ .......  22 
8.2  Filtering IP Options  ................................ ................................ ................................ .........................  22 
9  Vulnerability Testing Requirements  ................................ ................................ ................................ ...... 23 
9.1  Fuzzing - Network and Application Level  ................................ ................................ .......................  23 
9.2  Port Scanning  ................................ ................................ ................................ ................................ . 23 
9.3  SSID Scanning  ................................ ................................ ................................ ................................ . 23 
9.4  Vulne rability Scanning  ................................ ................................ ................................ ...................  23 
10  Operating System  ................................ ................................ ................................ ................................  25 
10.1  Handling of ICMP  ................................ ................................ ................................ .........................  25 
10.2  Privilege Escalation  ................................ ................................ ................................ ......................  25 
10.3  System account identification  ................................ ................................ ................................ ...... 25 
10.4  OS -Hardening Kernel Security  ................................ ................................ ................................ ...... 25 
10.5  Protection from buffer overflows  ................................ ................................ ................................  26 
10.6  External file system mount restrictions  ................................ ................................ .......................  26 
11  Web Interface  ................................ ................................ ................................ ................................ ..... 27 
11.1  HTTPS Support  ................................ ................................ ................................ .............................  27    
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 4 of 32 
© NCCS 2020  
11.2   logging  ................................ ................................ ................................ ................................ .........  27 
11.3   HTTP User sessions ................................ ................................ ................................ ......................  27 
11.4  HTTP input validation  ................................ ................................ ................................ ...................  28 
11.5   No unused HTTP methods  ................................ ................................ ................................ ..........  28 
11.6   No unused add -ons ................................ ................................ ................................ .....................  28 
11.7   No compile r, interpreter, or shell via CGI or other server -side scripting  ................................ ... 28 
11.8  No CGI or other Scripting for uploads  ................................ ................................ ..........................  29 
11.9  No executi on of system Commands with SSI  ................................ ................................ ...............  29 
11.10  No Default Content  ................................ ................................ ................................ ....................  29 
11.11  No Directory Listing  ................................ ................................ ................................ ....................  29 
11.12   Information in HTTP Headers  ................................ ................................ ................................ .... 29 
11.13   Information in Error Page  ................................ ................................ ................................ .........  30 
12  Other Security Requirem ent ................................ ................................ ................................ ...............  31 
12.1  Remote Diagnostic Procedure - Verification  ................................ ................................ ................  31 
12.2  No Password Recovery  ................................ ................................ ................................ .................  31 
12.3  Softwa re Integrity Check - Installation  ................................ ................................ ........................  31 
12.4  Software Integrity Check - Boot  ................................ ................................ ................................ ... 31 
12.5  Unused Physi cal Interfaces Disabling  ................................ ................................ ...........................  32 
12.6  No Default Profile ................................ ................................ ................................ .........................  32 
 
 
     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 5 of 32 
© NCCS 2020  
Introduction  
 
This Indian Telecom Security Assurance Requirement (ITSAR) document specifies security 
requirements for WiFi Customer Premises Equipment (CPE). The WiFi CPEs are the 
equipment that are used or deployed at customer premises in telecom networks for providing 
internet connectivity to end users.  
 
The types of devices  for which ITSAR  is applicab le are WiFi Routers, WiFi Modems, 
Broadband Modems with WiFi facility, Cable M odems with WiFi facility, FTTH ONTs with 
WiFi facility , and WiFi Data cards which provide WiFi f acility with backend 2G / 3G / 4G 
connectivity.  
 
The security require ments are dra wn from national,  international standards and best security 
practices for telecom networks. TSDSI STD T1.3GPP 33.117 -14.2.0 V.1.0.0  is the reference 
document on which the ITS AR is modelled.  The security requirements are grouped into 12 
sections based on th e sub -areas, the WiFi  CPE devices seeking certification has to meet the 
security requirements mentioned in this document.  
 
 
 
 
 
     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 6 of 32 
© NCCS 2020  
 
1  Access and Authorization  
 
 
 
 
1.1 Management  Protocols Entity Mutual Authentication  
 
The CPE shall communicate with authent icated management entities only. The protocols used 
for the CPE management shall support mutual authentication mechanisms, preferably with pre -
shared key arrangements Or by equivalent entity mutual authentication mecha nisms. This shall 
be verified for all protocols used for CPE management. (This feature shall be supported on all 
WAN management interfaces) . 
 
 
1.2  Management Traffic Protection  
 
All management traffic shall be protected by integrity and encryption. Unprotected sessions 
shall not be accepted. The remote access methods can support traffic encryption using protocols 
such as  HTTPS, SSHv2 or can be based on lower tunnelling protocols (IPsec VPN, TLS VPN, 
etc.). 
 
 
1.3  Role -Based access control  
 
CPE shall support Role -Based Access Control (RBAC) wh ich provides at least two different 
access levels or domains to guarantee that individuals can only perform the operations that they 
are auth orized for.  The RBAC system controls how users are allowed access to the various 
domains and what type of operatio ns. 
 
 
1.4  User Authentication - Local/Remote  
 
Local/Remote access to the CPE for configuration and maintenance purposes shall be granted 
only to authenticated users or machines using at least one authentication attribute.  This 
authentication attribute wh en combined with the user name shall enable unambiguous    
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 7 of 32 
© NCCS 2020  
authentication and identification of the authorized user. No methods to ex ist providing 
authentication -bypass attacks to succeed under all combinations of interface / methods of 
authentication.  
 
 
1.5  Remote Management Standards  
 
The remote management mechanisms for CPE to be fully compliant with the remote 
management standards that the OEM chose to implement, example: TR -069 or any other 
relevant standards, Such mechanisms to include entity mutual aut hentication, encryption of the 
management traffic.  
 
 
1.6  Remote Management Standards for Connected Devices, 
Additional Features  
 
The remote management mechanisms for devices connected to CPE, Or for configuration of 
additional features of CPE like DDNS, U PnP etc., are to be compliant with the respective latest 
standards published at the time of commencement of security testing. Thes e additional features 
are to be configured as disabled in the factory default settings, with provision for user to enable 
individual features on menu -selection. Such mechanisms to include entity mutual 
authentication, encryption of the management traffic.  
 
 
1.7  Unambiguous identification of the user & group  
 
The CPE shall identify each login user unambiguously.  CPE shall be ab le to assign individual 
accounts per user, where a user could be a person, or, for Machine Accounts, an application, or 
a system. It is a desirable feature to configure user preferred USERID name in configuration 
menu instead of pre -configured ADMIN User I D. Use of group accounts or group credentials, 
or sharing of the same account between several users shall not be enabled by CPE . 
 
     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 8 of 32 
© NCCS 2020  
 
2  Authentication and Attribute Management  
 
 
 
 
2.1  Authentication Policy  
 
The usage of a system functions such as network services (like SSH, SFTP, Web services), 
management access, local usage of operating systems and applications shall be allowed only 
after successful authentication on the basis of the user identity and at least one authentication 
attribute (e.g. password, certificate).  
 
This requirement shall also be applied to accounts that are only used for communication 
between systems.   
 
 
2.2  Authentication Support - External  
 
If CPE supports external authentication (for the Cyber -cafe use -case scenario), the user 
authentication credentials should be protected and securely communicated if the authentication 
credentials are managed by external authentication servers.  
 
 
2.3  Protection against brute force and dictionary attacks  
 
CPE shall have a mechanism that provides  a  protection against brute force and dictionary 
attacks which aim to use manual/automated guessing to obtain  the  passwords for user and 
machine accounts.   
 
CPE to detect repeated invalid attempts to sign into an account with incorrect passwords during 
a short period of time  and it  may implement at least  one of the following  most commonly 
used protection mea sures  
 
a) Increasing the delay (e.g. doubling ) for each newly entered incorrect password.  
b) Blocking an account after a specified number of incorr ect attempts (typically 5) for a certain 
period of time.  
c) Using CAPTCHA to prevent automated attempts .     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 9 of 32 
© NCCS 2020  
 
This feature to be enabled for login attempts for CPE and on authentication attempts on Wi -Fi 
access through SSID with PSK . 
 
 
 
2.4  Enforce Strong P assword  
 
CPE shall only accept passwords that comply with the following complexity criteria:  
 
 a) Password containing a minimum length of 8 characters are only permitted by default. shorter 
lengths shall be rejected by the NE.  
b) Minimum password length - the default minimum value of 8 characters.  
c) Password comprises at least three of the follow ing categories:  
 
- at least 1 uppercase character (A -Z)  
- at least 1 lowercase character (a -z)  
- at least 1 digit (0 -9)  
- at least 1 special character (e.g. @ ;!$.)  
 
CPE shall   support password field length of minimum 64 characters.   
This Feature to b e enabled for CPE Login -IDs as well as for the PSK key associated with SSID 
for Wi -Fi access.  
 
 
 
2.5  Inactive Session Timeout  
 
CPE shall monitor  inactive  sessio ns of administrative login users, Data users either on LAN or 
WiFi and initiate session locking mechanism based on user configurable timers. Unlocking the 
session shall be permissible only by authentication. If the inactivity period further continue s for 
a defined period, Session /user ID time out must occur after this inactivity. The timer values can 
be admin configurable as per requirement. When the time out occurs the same screen must be 
cleared of all displayed information.  
 
 
 
2.6  Password Chan ge faci lity, 1st Installation /Factory Reset  
 
CPE shall enforce change of authentication attribute (eg: - password) on 1st installation 
configuration or On factory reset conditions. If a password is used as an authentication    
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 10 of 32 
© NCCS 2020  
attribute, then the CPE shall p rovide a function that facilitates the user to change his password 
at any time.   However, the CPE shall not allow the previously used passwords up to a certain 
number (Password History).  
 
 
 
2.7  Protected Authentication feedback  
 
When a user enters the password  at the local console, local or remote management GUI, the 
CPE should give obscure feedback  by displaying characters like “*” . 
 
 
2.8  Removal of predefined or default authentication attributes  
 
CPE may come with predefined (by the vendor, devel oper or prod ucer)   authentication 
attributes such as password or cryptographic keys.  CPE shall remove the predefined / default 
authentication attributes from its run -time configuration. Such predefined authentication 
attributes can be restored only throu gh factory r eset, preferably through operating a physical 
button.  
 
 
2.9  Storage of Passwords in encrypted form  
 
User passwords should be stored using password hashes or encrypted, based on a strong 
hashing mechanism designed for use with passwords (exampl e: HMAC, PBK DF2, Argon2), 
OEM may choose his own hashing mechanism for implementation. Passwords may not be 
stored in clear text.  This requirement does not apply to pre -shared keys that must be used in 
raw form, such as IKE pre -shared keys.  
 
 
     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 11 of 32 
© NCCS 2020  
 
3  Softwar e Security  
 
 
 
 
3.1  Secure Update  
 
The update process should verify the authenticity of the source repository and the integrity of 
the software patch preferably employing Digital Certificate for authenticity and hashing 
(example:SHA2) for integrity before updating the  software in the CPE. The update mechanism 
should prevent illegal software patching.  
 
 
 
 
3.2  Secure Upgrade  
 
CPE should support authenticity and integrity check while performing software upgrade 
Preferably employing Digital Certificate for authenticity an d hashing (example: SHA2) for 
integrity . 
 
 
3.3 Source Code security assurance  
 
Source code of the CPE (in high level programming language )  shall be free from known 
security vulnerabilities ,  the high security critical weak nesses listed in the CWE databa se and  
all the exploitable security vulnerabilities listed in the latest SANS Top 25 and OWASP Top 
10. OEM may provide Software Test Document (STD) in this regard.  
 
 
 
 
 
 
 
3.4  Known Malware Check     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 12 of 32 
© NCCS 2020  
 
The Operating System and th e applications installed in the  CPE shall be free from any known 
malware. The CPE shall support mechanism to carry out anti -malware checks. OEM to submit 
Software Test document (STD)  to establish that the CPE is free from Known Malware.  
 
 
 
3.5  No unused  software  
 
Unused software comp onents or parts of software which are not needed for operation or 
functionality of the CPE shall not be installed or shall be deleted after installation. This includes 
also parts of a software, which will be installed as exam ples but typically not be used (e.g. 
default web pages, example databases, test data). OEM to provide Software Test Document 
(STD)  in this regard.  
 
 
3.6  Unnecessary Service Removal  
 
The OEM to provide list of essential services and the related ports required for functioning of 
CPE, li st of optimal services supported by CPE and their related ports. The CPE shall only run 
protocol handlers and services which are needed for its operation, and which do not have any 
known security vulnerabilities. In parti cular, by default the following ser vices and their ports 
shall be initially configured to be disabled on the CPE by the vendor.  
  
- FTP 
- TFTP  
- Telnet  
- rlogin, RCP, RSH  
- HTTP  
- SNMPv1 and v2  
- SSHv1, HNAP  
- TCP/UDP Small Servers (Echo, Chargen, Discard and Daytime)  
- Finger  
- BOOTP serve r 
- Discovery protocols (CDP, LLDP)  
- IP Identification Service (Identd)  
- PAD  
- MOP   
 
 
 
 
    
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 13 of 32 
© NCCS 2020  
3.7  Secure Time Synchronization  
 
The CPE shall support time synchronization feature for its  core functionality or for the 
addit ional supported functionality. For CPEs that have time synchronization feature, it shall 
support the secure time synchronization feature preferably by using Network Time Protocol 
NTP.  
 
The CPE clock shall be synchronized with NTP server  in a secure manner .  The CPE client 
should be able to  verify the authentication and authorization of the NTP Server.  
 
OEM shall plugin well known vulnerabilities, input validation vulnerabilities related to NTP 
feature.  
 
 
3.8  Self -Testing  
 
The CPE shall support the detection mechanism for identification of  failure of underlying 
security mechanisms (such as software image integrity, runtime integrity, cryptographic 
modules etc) used. The CPE to perform such self -tests periodically/at the time  of booting, 
visual indication on failure is a desirable feature.  
 
 
3.9  Feature / Service Activation Policy  
 
The CPE shall have factory default settings such that only the essential features / services and 
ports required for main operational needs of CPE are only enabled. Optional features, added 
services, futuristic ser vice / applications are disabled by default. Such disabled services could 
only be enabled after successful authentication and selection by ADMIN user.  
 
 
 
3.10  Restricted reachability o f services  
 
The CPE shall restrict the reachability of services so that  they can only be reached on interfaces 
where their usage is required. OEM to map the essential services required to be accessed from 
WAN side, LAN side to limit access to services only  on need / functionality basis. For 
Interfaces on which services are ac tive, the reachability to be limited to legitimate 
communication peers. One such Use -case scenario is to restrict web -management access of 
CPE to only LAN ports and not to permit access  on Wi -Fi, WAN side.     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 14 of 32 
© NCCS 2020  
 
     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 15 of 32 
© NCCS 2020  
 
 
4  System Secure Execution Environment  
 
 
 
 
4.1  No unused functions  
 
Unused functions of the CPEs' software and hardware shall be deactivated.  
 
During installation of software and hardware often functions will be activated that are not 
required for operation or function of the system. If unused funct ions of software cannot be 
deleted or de -installed individually, such functions shall be deactivate d in the configuration of 
the CPE in permanent manner.  
 
Also hardware functions which are not required for operation or function of the system (e.g. 
unused interfaces) shall be permanently deactivated. Permanently means that they shall not be 
reactivated again after CPE reboot.  
 
OEM to provide report in this regard, List of the used functions of the CPE's software and 
hardware as given by the OEM shall match the list of used  software and hardware  functions 
that are necessary for the operation of the CPE.  
 
 
4.2  No unsupported components  
 
The CPE shall not contain software and hardware components that are no longer supported by 
their vendor, producer or devel oper, such as components that have reached end -of-life or end -
of-support. Excluded are components t hat have a special support contract. This contract shall 
guarantee the correction of vulnerabilities over components' lifetime. OEM to provide report 
and dec laration to this effect.  
 
 
4.3  No Known Vulnerabilities in System on Chip (SOC) solution  
    
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 16 of 32 
© NCCS 2020  
This tes t is applicable for such CPEs which have System on Chip solutions, where majority of 
CPE functions are realized in a VLSI chip. OEM to provide self -test / th ird-party  / Chip -vendor 
test report indicating that the SOC is free from malware, known -vulnerabil ities.  
 
 
     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 17 of 32 
© NCCS 2020  
 
5  User Audit  
 
 
 
 
5.1  Audit Event Generation  
 
 
 
CPE to have capability to log important Security events. The audit logs may preferably be 
stored  in non -volatile memory. If applicable (for cyber -cafe, Public Data Office usage scenario) 
provision for secure log export should exist and logs may capture uni que System Reference 
such as website address, IP Address, MAC address, hostname, login attempts etc.  
 
     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 18 of 32 
© NCCS 2020  
 
 
6  Data Protection  
 
 
 
 
 
6.1  Cryptographic Based Secure Communication  
 
The communication security dimension ensures that information flows only betwe en the 
authorized end points (the information is not diverted or intercepted as it flows between  these 
end points). The data is protected against well know attacks related to Sniffing, Disclosure, 
reconnaissance etc.,  
 
The secure communication mechanisms b etween the CPE and connected entities shall use 
industry standard protocols such as IPSEC, VPN, SSH, TLS/SSL, etc., and NIST specified 
cryptographic algorithms with specific key sizes such as SHA, Diffie -Hellman, AES etc.  
 
 
 
6.2  Cryptographic Based Secur e Communication on Wi -Fi 
Access  
 
The communication security dimension on WiFi access ensures tha t information flows only 
between the authorized end points (the information is not diverted or intercepted as it flows 
between these end points). The security m echanism to protect against well known attacks like  
capture -decrypting, PIN detection, Key reco very, Key reinstallation attacks.  
 
It shall support WPA2 -PSK with AES as default standard. Other encryption options stronger 
than WPA2 may be made available under configuration menu for user choice selection.  
 
 
 
6.3  Cryptographic Algorithm selection for W i-Fi Access  
 
    
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 19 of 32 
© NCCS 2020  
It shall support WPA2 -PSK with AES -128 as default standard. Other internationally accepted 
encryption standards stronger  like AES -192 etc., may also be made available with user choice 
selection. Weaker encryption options like WEP, WPS, TKIP etc., are not  to be available for 
selection / configuration.  
 
 
 
6.4  Crypto -Key Protection Mechanism  
 
The CPE to have protection mechanisms agains t access to keys in the CPE against Key 
disclosure, reconnaissance, re -installation attacks, nonce -resets, Ze roizng blocks of key etc.  
 
 
 
6.5  P rotecting data and information - Confidential System 
Internal Data  
 
When CPE is not in debug (maintenance) mode,  there shall be no system function that reveals 
confidential system internal data in the clear to users and a dministrators. Such system functions 
could be, for example, local or remote OAM CLI or GUI, error messages, logging messages, 
alarms, configuration  file exports etc. Confidential system internal data contains authentication 
data (i.e. PINs, cryptographic k eys, passwords, cookies) as well as system internal data that is 
not required for systems administration and could be of advantage to attackers (i. e. stack traces 
in error messages).  
 
 
6.6  Protecting data and information in storage  
 
For sensitive data in (persistent or temporary) storage read access rights shall be restricted. Files 
of a system that are needed for the functionality shall be protecte d against manipulation.  
 
 
6.7  Protection against Copy of Data  
 
CPE shall have protection against creating a copy of data in use / data in transit. Protective 
measures should eixit against use of available system functions / software residing in CPE to 
create copy of data for illegal transmission. The software function s, components in the CPE  for 
creation of dat a copy are to be disabled or sufficiently secured to prevent illegal copy of data.     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 20 of 32 
© NCCS 2020  
 
 
6.8  Protection against Data Exfiltration - Overt Channel  
 
CPE shall have mechanisms to prevent data exfiltration attacks for theft of data in use / data in 
transit. Estab lishment of outbound overt channels  such as FTP, HTTP, HTTPS IM, P2P, Email 
etc are to be forbidden if they are initiated by / originate from t he CPE. Outbound -use of such 
services are to be disabled in the CPE, if it is essential to have some of these se rvices for 
outbound -use (remote management etc.,), facility to exist for monitoring anomalous channels.  
 
 
6.9  Protection against Data Exfiltrat ion - Covert Channel  
 
CPE shall have mechanisms to prevent data exfiltration attacks for theft of data in use / data in 
transit. Establishment of outbound covert channels and tunnels such as DNS Tunnel, HTTPS 
Tunnel,ICMP Tunnel, TLS,  SSL, SSH, IPSEC VPN, RTP Encapsulation etc are to be 
forbidden if they are initiated by / originate from the CPE. Outbound -use of suc h services are to 
be disabled in the CPE, if it is essential to have some of these services for outbound -use 
(remote management etc.,), facility  to exist for monitoring anomalous channels.  
 
     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 21 of 32 
© NCCS 2020  
 
 
7  Network Services  
 
 
 
 
7.1  Traffic Filtering - Network Level  
 
 
The CPE shall provide a mechanism to filter incoming IP packets on any IP interface. It is 
preferable to configure Access Control List (ACL) as default deny -all on WAN port, with 
feature to enable the types of traffic permitted on user selection.  
 
 
     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 22 of 32 
© NCCS 2020  
 
8  Attack Prevention Mechanism  
 
 
 
8.1  Excessive Overload Protection  
 
The CPE may provide security measures to deal with overload situations which may occur 
during periods of increased traffic. In particular, partial or complete impairment of system 
availab ility shall be avoided.  
 
 
8.2  Filtering IP Options  
 
IP packets with unnecessary options or extension headers shall not be proces sed. IP options and 
extension headers (e.g. source routing) are only required in exceptional cases. So, all packets 
with enable d IP options or extension headers shall be filtered. OEMs may refer to standards 
such as RFC 6192, RFC 7126 . 
 
 
     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 23 of 32 
© NCCS 2020  
 
 
9  Vulnerabili ty Testing Requirements  
 
 
 
 
9.1  Fuzzing - Network and Application Level  
 
The protocols supported by the CPE shall be robust wh en receiving unexpected or malformed 
inputs. This requirement shall be applicable for both network level as well as application level 
protocols supported by the equipment.  
 
 
9.2  Port Scanning  
 
It shall be ensured that on all network interfaces, only vendo r documented/identified  ports  on 
the transport layer respond to requests from outside the system.  
 
 List of the identified open ports shall match the list of network services that are necessary for 
the operation of the CPE.  
 
 
9.3  SSID Scanning  
 
The CPE s hall not disclose sensitive in formation, PIN details on SSID scan / attack techniques. 
It needs to provide disguised feedback to users on unsuccessful attempts without revealing of 
reason for failures. Option to hide / unhide SSID on user selection is an e ssential feature.  
 
 
9.4  Vulne rability Scanning  
 
The purpose of vulnerability scanning is to ensure that there are  no known vulnerabilities (or 
that relevant vulnerabilities are identified and remediation plans in place to mitigate them) on 
the Network Pr oduct, both in the OS and in t he applications installed, that can be detected by    
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 24 of 32 
© NCCS 2020  
means of automatic testing tools via the Internet Protocol enabled network interfaces. OEM to 
provide self test report establishing that no publicly known  vulnerability exist s. 
 
 
     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 25 of 32 
© NCCS 2020  
 
 
10  Operating System  
 
 
 
 
 
10.1  Handling of ICMP  
 
Processing of ICMPv4 and ICMPv6 packets which are not required for operation shall be 
disabled on the CPE. In particular, there are certain types of ICMP4 and ICMPv6 that are not 
used in most netwo rks, but represent a risk. Refer standards such as RFC 6192 , RFC 7279, RFC 
4890.  
 
 
 
10.2  Privilege Escalation  
 
There shall not be a privilege escalation method in interactive sessions (CLI or GUI) which 
allows a lower privileged / guest user to gain admin istrator/root privileges from another user 
account without re-authentication or thru exploitation of authent ication bypass  vulnerabilities.  
 
 
 
10.3  System account identification  
 
Each system account in Operating system of the CPE  shall have a unique ide ntification, the 
OEM to provide information on implementati on mechanism for this requirement.  
 
 
 
10.4  OS -Hardening Kernel Security  
    
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 26 of 32 
© NCCS 2020  
OEM may submit the process for OS Hardening undertaken to justify that the OS is sufficiently 
hardened and Kernel based ap plications / functions not needed for the operation of the CPE are 
deactivated. OEM to provide information on steps taken in this regard.  
 
 
10.5  Protection from buffer overflows  
 
The system shall support mechanisms for buffer overflow protection. Documen tation which 
describes these buffer overflow mechanisms and  also how to check that they have been enabled 
and/or implemented shall be provided.  
 
 
10.6  External file system mount restrictions  
 
If normal users are allowed to mount external file systems (at tached locally or via the network), 
OS-level restrictions shall be set properly in order to prevent privilege escalation or extended 
access permissions due to the contents of the mounted file systems  
 
 
     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 27 of 32 
© NCCS 2020  
 
 
11  Web Interface  
 
 
 
 
 
11.1  HTTPS Support  
 
The co mmunication between Web client and Web server  to be protected using  industry 
standard secured communication protocols  TLS/HTTPS. Cipher suites with NULL encryption 
shall not be supported. CPE to be protected against sniffing and side jacking  attacks . 
 
 
11.2   logging  
 
 Access to the webserver ( bot h successful as well as failed attempts) shall be logged. The web 
server log shall contain the following information:  
 
- Access timestamp  
- Source (IP address)  
- Account (if known)  
- Attempted login name (if the  associated account does not exist)  
- Relevant fields in http request. The URL should be included whenever  possible.  
- Status code of web server response  
 
 
11.3   HTTP User sessions  
 
1. The session ID shall uniquely identify the user and distinguish the s ession from all  other 
active sessio ns. 
2. The session ID shall be unpredictable.  
3. The session ID shall not contain sensitive information in clear text (e.g. account  number, 
social security, etc.).  
4. In addition to the Session Idle Timeout .  
5. Sessio n ID's shall be regenerated for each  new session (e.g. each time a user logs  in).  
6. The session ID shall not be reused or renewed in subsequent sessions.     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 28 of 32 
© NCCS 2020  
7. The CPE shall not use persistent cookies to manage sessions but only  session cookies.  
8. Where session cookies are used the attribu te 'HttpOnly' shall be set to true.  
9. Where session cookies are used the 'domain' attribute shall be set to ensure that  the cookie 
can only be sent to the specified domain.  
10. Where session cookies are used the 'path'  attribute shall be set to ensure th at the  cookie can 
only be sent to the specified directory or sub -directory.  
11. The CPE  shall not accept session identifiers from GET/POST variables.  
12. The CPE  shall be configured to only accept server generate sess ion  ID's.  
 
 
 
 
11.4  HTTP input vali dation  
 
The CPE shall have a mechanism in place to ensure that web application inputs are not 
vulnerable to command injection or cross -site scripting attacks. The CPE shall validate, filter, 
escape, and encode user -contr ollable input before it is placed in  output that is used as a web 
page that is served to other users.  
 
 
 
11.5   No unused HTTP methods  
 
HTTP methods that are not required shall be deactivated. Standard requests to web servers only 
use GET, HEAD, and POST. If other methods are required, they shall not introduce security 
leaks such as TRACK or TRACE.  
 
 
 
11.6   No unused add -ons 
 
All optional add -ons and components of the web server shall be deactivated if they are not 
required. In particular, CGI or other scr ipting components, Server Side Includes (SSI), and 
WebDAV shall be deactivated if they are not required.  
 
 
11.7   No compiler, interpreter, or shell via CGI or other server -
side scripting     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 29 of 32 
© NCCS 2020  
 
If CGI (Common Gateway Interface) or other scripting technology is used, t he CGI directory - 
or other corresponding scripting directory - shall not include compilers or interpreters (e.g. 
PERL interpreter, PHP interpreter/compiler, Tcl interpreter/compiler or operating system 
shells).  
 
 
11.8  No CGI or other Scripting for  upload s 
 
If CGI or other scripting technology is used, the associated CGI/script directory shall not be 
used for uploads.  
 
 
11.9  No execution of system Commands with SSI  
 
If Server Side Includes (SSI) is active, the execution of system commands shall be deactiv ated.  
 
 
11.10  No Default Content  
 
Default content (examples, help files, documentation, aliases) that is provided with the standard 
installation of the web server shall be removed.  
 
 
11.11  No Directory Listing  
 
Directory listings (indexing) / Directory browsing shall be deactivated.  
 
 
11.12   Information in HTTP Headers  
 
The HTTP header shall not include information on the version of the web server and the 
modules/add -ons used.  
 
    
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 30 of 32 
© NCCS 2020  
11.13   Information in Error Page  
 
User -defined error pages shall  not include version information about the web server and the 
modules/add -ons used. Error messages shall not include internal information such as internal 
server names, error codes, etc. Default error pages of the web server shall be replaced by error 
page s defined by the vendor.  
 
 
     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 31 of 32 
© NCCS 2020  
 
12  Other Security Requirement  
 
 
 
 
 
12.1  Remote Diagnostic Procedure - Verification  
 
If the CPE is providing Remote access for troubleshooting purposes/alarm maintenance,  then it 
should be allowed only for authorized users and a ll activities performed by the remote user is to 
be logged with parameters like User id , time stamp,  interface type,  event level (e.g. 
CRITICAL, MAJOR, MINOR), result type (e.g. SUCCESS, FAILURE).  
 
 
 
12.2  No Password Recovery  
 
Network devices have a fu nction that resets the current system password. In the event of system 
password reset, the entire configuration of the CPE shall be irretrievably deleted.  
No provision should exist for password recovery.  
 
 
 
12.3  Software Integrity Ch eck - Installation  
 
CPE should validate the software package integrity before t he installation / upgrade. Tampered 
software shall not be executed or installed if integrity check fails.  
 
 
 
12.4  Software Integrity Check - Boot 
 
The CPE shall verify the inte grity of a software co mponent at the time of boot / re -boot 
typically by comparing the result of a measurement (typically a cryptographic hash / CRC) of 
the component to the expected reference value.     
  
Document Name  ITSAR for Wi -Fi CPEs  
Doc. No. Version  Release date  Enforcement date  
ITSAR -WFC -004 1.0 XX-XXX-XXXX  XX-XXX-XXXX  
Page 32 of 32 
© NCCS 2020  
 
 
 
12.5  Unused Physical Interfaces Disabling  
 
The CPE s hall support the mecha nism to verify all the physically accessible interfaces. 
Physically accessible Interfaces (including LAN ports) which are not under use shall be 
disabled by configuration so that they remain inactive even in the event of a reboot.  
 
 
 
12.6  No Default Profi le 
 
Predefined or default user accounts shall be deleted or disabled. Default accounts such as guest, 
master are generally  preconfigured with known or nil authentication attribute and therefore 
such  standard users shall be deleted or disabled.  
 
 
 
 
 
 
 
 
 
 
 
G. Narendranath           P.V. Puranik               Rajeev Thaman              P.K. Singh              U.V. Ramana  
DDG SA                              DDG ASC            Scientist G, SAG, DRDO     DDG TS, TEC           DDG NTB  
Chairman                          Member                   External Member        Member           Member Convener