Wireless Security - Getting It Right

It may sound strange but is true that severalheader of packets sent over a wireless Lan - is sent
organisations, which have adopted Wirelessas unencrypted text and is vulnerable to being sniffed
networking, are open to severe security breaches.by third parties. Unfortunately most supplier equipment
Mostly the reasons are that organisations simply plugis configured to broadcast the SSID automatically,
the access points and go live without bothering toessentially giving new devices a ticket to join the
change the default factory settings. Wireless localnetwork. While this is useful for public wireless
area networks are open to risk not because thenetworks in places such as airports and retail
systems are incapable but due to incorrect usage. Theestablishments - in the US for example, Starbucks is
biggest problem lies with inadequate security standardsoffering 802.11b access in some of its stores - it
and with poorly configured devices. For a start, mostrepresents another security loophole for corporates
of the wireless base stations sold by suppliers comethat do not switch it off. Finally any MAC address can
with the in-built security Wired Equivalent Privacybe change!d to another (spoofed), so the use of ACL
(WEP) protocol turned off. This means that unless youis not foolproof either.
manually reconfigure your wireless access points, yourActive
networks will be broadcasting data that is unencrypted.To implement an Active type of security, you need to
In the old world of wired local area networks, theimplement the IEEE 802.1x security standard. This
architecture provides some inherent security. Typicallycovers two areas - network access restriction
there is a network server and multiple devices with anthrough mutual authentication and data integration
Ethernet protocol adapter that connect to each otherthrough WEP key rotation. Mutual authentication
physically via a LAN backbone. If you are notbetween the client station and the access points helps
physically connected, you have no access to the LAN.ensure that clients are communicating with known
Compare it with the new wireless LAN architecture.networks and dynamic key rotation reduces exposure
The LAN backbone of the wired world is replacedto key attacks.
with radio access points. The Ethernet adapters inDue to weaknesses in WEP, some standard
devices are replaced with a radio card. There are noalternatives to WEP have emerged. Most of the Wi-Fi
physical connections - anyone with a radio capability ofmanufacturers have agreed to use a temporary
sniffing can connect to the network.standard for enhanced security called Wi-Fi Protected
What can go wrong?Access (WPA).
Unlike the wired network, the intruder does not needIn WPA, the encryption key is changed after every
physical access in order to pose the following securityframe using Temporary Key Integrity Protocol (TKIP).
threats:This protocol allows key changes to occur on a
Eavesdropping. This involves attacks against theframe-by-frame basis and to be automatically
confidentiality of the data that is being transmittedsynchronized between the access point and the
across the network. In the wireless network,wireless client. The TKIP is really the heart and soul of
eavesdropping is the most significant threat becauseWPA security. TKIP replaces WEP encryption. And
the attacker can intercept the transmission over the airalthough WEP is optional in standard Wi-Fi, TKIP is
from a distance away from the premises of therequired in WPA. The TKIP encryption algorithm is
company.stronger than the one used by WEP but works by
Tampering. The attacker can modify the content ofusing the same hardware-based calculation
the intercepted packets from the wireless networkmechanisms WEP uses.
and this results in a loss of data integrity.Hardened
Unauthorized access. The attacker could gain accessThere are organisations like banks, which have very
to privileged data and resources in the network bystringent security requirements. They need to
assuming the identity of a valid user. This kind ofimplement the hardened type of security systems.
attack is known as spoofing. To overcome this attack,These are solutions certified in accordance with the
proper authentication and access control mechanismsFederal Information Protection Standard (FIPS 1.40).
need to be put up in the wireless network.Products in this category offer point-to-point security
Denial of Service. In this attack, the intruder floods thefor wireless information communication and include
network with either valid or invalid messages affectingofferings such as AirFortress and IPSec Virtual Private
the availability of the network resources.Networks (VPNs). A VPN will increase the cost of
How to protect?your network, but you can base your decision on
There are 3 types of security options - basic, activewhether to implement it by using the same course of
and hardened. Depending upon your organisationaction that you should be taking with all other parts of
needs, you can adopt any of the above.your infrastructure. Map the risks against the business
Basicdata that you will be passing over radio, and assess
You can achieve the basic security by implementingthe financial impact of a breach. If the data is too
Wired Equivalent Standard 128 or WEP 128. The IEEEcritical, reassess what should be passed over the
802.11 task group has established this standard. WEPnetwork, or use a VPN to enhance your protection.
specifies generation of encryption keys. TheSummary
information source and information target uses theseThe vendors are working towards implementing
keys to prevent any eavesdroppers (who do notnewer standards and this year we should see
have these keys) to get access to the data.products implementing IEEE 802.11i that will further the
Network access control is implemented by using aauthentication and encryption gains implemented by
Service Set Identifier (SSID - a 32 character uniqueWPA. Most notably, it will add a ground up encryption
identifier) associated with an access point or a groupstandard known as Advanced Encryption Standard
of access points. The SSID acts as a password for(AES) as well as various other enhancements.
network access.Newer standards apart, organisations must understand
Another additional type of security is Access Controlthat achieving wireless security is essential and the
List (ACL). Each wireless device has a unique identifiergood part is that it is easy. An organisation must define
called Media Access Control address (MAC). A MACits security needs and use the features available in the
list can be maintained at an access point or a serversystems accordingly. Choose a good vendor who can
of all access points. Only those devices are allowedhelp you implement your requirements through
access to the network that have their MAC addressstandards based solutions. A good implementation
specified.must be supported by a security policy, which is well
The above implementations are open to attack. Evenunderstood by everyone in the organisation. Make your
when you do turn on WEP, there are still problemsemployees aware that they all are responsible for
inherent within it. The problem lies in the protocol'ssecurity and share the cost of security breaches.
encryption key mechanism, which is implemented inAssign authority & ownership to few employees
such a way that the key can be recovered byfor the various parts in the security policy and make
analysing the data flow across the network over aperiodic reviews of their performance. Most important
period of time. This has been estimated at between 15is to monitor your systems for any possible breaches
minutes and several days. The SSID attached to theand adapt if necessary. Never sleep well.