Managing wireless security
Wireless networks
are everywhere, and nearly every device is capable of wireless
connection. This makes it easy to connect anywhere. With this always-on
availability for numerous devices come security considerations about joining a computer to a particular network.
Designing a secure wireless
infrastructure is an increasingly important responsibility for
administrators, and understanding the options available and the factors
to take into account when deciding on the right security for a
particular environment is critical.
Understanding types of wireless security
Because the technology surrounding wireless connection changes
constantly, and the previous security models are always under scrutiny,
wireless equipment manufacturers are working to develop the next great
way to keep information secure. The currently available security
options for wireless networking are:
-
Wired Equivalent Privacy (WEP)
This standard was developed for the original 802.11
wireless infrastructure. It allows the computer connecting to the
wireless network to supply a password of a defined encryption level
(from 40-bit to 256-bit) when connecting. The communication between
devices on the network is scrambled to be unreadable by humans.
-
Wi-Fi Protected Access (WPA)
This wireless
standard was developed to address the weaknesses of WEP by providing
better encryption and authentication capabilities than WEP could offer.
The encryption for WPA is provided through the Temporal Key Integrity Protocol (TKIP) or Advanced
Encryption Standard (AES) to boost the security of wireless networking.
Similar to WEP, WPA uses passphrases to initiate the connection, but at
predetermined intervals, making the passphrase more difficult to guess
for those attempting to gain unauthorized access.
-
Wi-Fi Protected Access v2 (WPA2)
This wireless standard was developed to replace or advance WPA by moving away from TKIP security models due to known flaws in these security encryption configurations that could allow unauthorized access.
-
Extensible Authentication Protocol (EAP)
This wireless standard (and its many variants) uses a centralized
authentication server to authorize access to the wireless network.
Administrators need to consider several things when preparing a
wireless networking infrastructure. Security and encryption methods are
near the top of the list, but the types of devices that will be
connected using wireless technology must also be considered. If the
devices that connect within an organization do not support the newer
standards, considerations must be made for these devices, or the
devices will not be able to connect.
For example, the CEO at Contoso loves her smart phone and finds it
very easy to use. The phone is about four years old and does not
support the latest wireless security technology. When the IT department
is working on plans for a wireless network, this is something that must
be considered. Many times, suggesting an upgrade and pointing out the
benefits of upgrading might be effective, but existing hardware has to
be considered to avoid problems in the future.
Wireless networking risks
Configuring
wireless solutions to allow both employees and nonemployees to connect
wirelessly to the Internet is a good idea generally; however, even the
most secured wireless networks face risks associated with each type of wireless security configuration, such as:
-
No security
Providing no security for a wireless network creates a great deal of
risk because any computer attempting to connect to that network will be
allowed without being prompted for additional information.
-
Easily discoverable passphrases
WEP and, in some cases, WPA, have been very easily cracked using
various methods to gain access to the pre-shared key or even the
passphrase.
-
Denial of service As with any networking technology, wireless networks can be susceptible to denial-of-service
attacks caused by repeatedly bombarding an access point with
information. This does not allow access to the keys necessarily but can
render the network unusable by those connected to it.
-
Malicious associations
These attacks appear as access points available for connection. When
someone connects to the access point, she might really be connecting to
a laptop used by a malicious entity to attempt to gain access to
legitimate networks.
-
MAC spoofing This
type of attack occurs when an attacker attempts to present a legitimate
MAC address for his computer when trying to gain access to a certain
network.
The list of threats presented here is not exhaustive. It is meant to
provide an idea of some of the attack types being used to gain access
to wireless networks that you should consider when planning the
deployment of a wireless infrastructure.
Reducing security issues on a wireless network
In addition to choosing the correct security options for an
environment, simple and practical actions can help keep the wireless
network secured. These include:
-
Use long passwords
When choosing a password to associate with a wireless network, use a
longer password than you might initially think necessary. Longer
passphrases are more secure than shorter ones because they can be more
difficult to guess. This should not be the only means of security,
however.
-
Use at least WPA2 encryption
Many wireless
networks are left open, although this is now decreasing. On any
wireless network, the encryption level should be set to at least WPA2.
The stronger the encryption level, the safer the network can be.
-
Routinely change administrator passwords
Creating a policy for the people within an organization to change their
passwords every 90 days is a good start; the local computer administrator accounts should also have their passwords changed on a set schedule to enhance the security for these accounts.
-
Maintain a guest wireless network
Creating a wireless network for nonemployee use helps increase security
by providing access to the Internet rather than to a corporate network.
This list is intended to spark some critical thinking about security for wireless networks and about security in general.
In addition to anticipating possible threats to help keep
the wireless networks deployed within an organization secure, IT needs
to educate others within that organization about these risks because
they can also occur on home networks. If a computer is compromised
while on a home network, it can cause problems when connected to a
corporate network.
