|
This article was featured in the July, 2006 issue of
the Technology First Magazine.
Dayton, OH
July 14, 2006 -
By Angela Richardson, IT Recruiter,
Roytman Information Services, Inc.
and Jim Richardson, Network Engineer,
Fruit Of The Loom
Wireless Technology: Secure or Risky?
You see the wireless trend everywhere: laptops with built-in
wireless cards, home based wireless products, wireless services
being offered by hotels and airports. Heck, there are even
entire cities providing Wi-Fi internet access. However, it
wasn’t so long ago that wireless networking was generally
perceived as too much of a security risk to be a central part
of most companies’ information delivery strategies.
What can be credited for the recent explosion of the wireless
industry? There is not one, but many security enhancement
that have come onto the scene, making wireless networking
a viable option for companies that rejected it in the past.
Until recently, wireless networking was considered too much
of a security risk to be worth serious consideration for many
companies. With sensitive information being broadcast over
the airwaves with only Wired Equivalent Privacy (WEP) protection,
there was plenty of justification for this mindset. WEP was
introduced in 1997 and ratified in 1999 by the 802.11 standards
committee which defines widely supported identification, authentication,
and encryption methods. WEP relies on a ‘secret’
key shared between wireless devices to encrypt data. The 40
or 80 bit shared key which remains static can be quite easily
picked off by someone with a radio card and certain software
programs. In fact, a wireless network relying solely on WEP
can be hacked in a matter of minutes by someone ‘listening’
to radio traffic and finding the repeating key.
Wi-Fi Takes Steps
Due to the security limitations, the wireless industry was
compelled to act. The Wi-Fi Alliance was created which is
a joint effort by heavyweights such as Microsoft, Intel, Cisco,
Sony, Symbol, and others. According to the Wi-Fi Alliance,
the main goal in establishing this organization was to drive
the adoption of a single worldwide-accepted standard for high-speed
wireless local area networking. The alliance addressed WEP’s
shortcomings by introducing Wi-Fi Protected Access (WPA) keys
with Temporal Key Integrity Protocol (TKIP) encryption. WPA
is a subset of the recently ratified 802.11i standards. WEP,
along with TKIP encryption, adds a great deal of protection
to a wireless network. A hacker would have to listen in constantly
for days, weeks, or even months to crack the code. This is
a significant improvement in security in comparison to WEP.
WPA2 which was also developed by the Wi-Fi Alliance provides
extended authentication, key management, and advanced encryption
and is increasingly supported.
In addition to the security provided by WPA and WPA2, a number
of companies are developing systems that offer additional
security features for wireless networks. One such system is
Cisco’s Wireless Control System (WCS) which provides
‘rogue’ Access Point (AP) detection and mitigation.
This system is designed to guard against someone bringing
their own wireless AP and jumping on your network. The WCS
will provide alarms when it detects a rogue device that isn’t
part of the system and appropriate measures can be taken.
Mitigation involves the system’s Access Points, if so
defined performing automatic denial of service attacks on
a rogue device.
To further increase the security of your system, another
option is to broadcast a “honeypot” wireless network.
Strictly defined, a honeypot is a server that is configured
to detect an intruder by mirroring a real production system.
To create a honeypot network, one sets up an insecure wireless
network that is irresistible to hackers. Useful information
can be gathered about hackers while they waste their time
in the honeypot. Now, who says security isn’t fun?
Further security measures that have arisen in recent years
include MAC (physical device address) filtering, Access Control
Lists, and Access Control Servers (ACS) all which provide
even more extensive device and user authentication.
The Future Is Now
So if you are considering implementing a wireless networking
in your organization, it will be reassuring to know that there
are enhanced security features available. However, you will
need to be ready for a challenge as security standards are
evolutionary and quite complex. Before attempting to implement
a wireless network, prepare yourself with a solid plan and
the appropriate training. Once the right strategy is in place,
you can work towards joining those on top of the wireless
trend. It’s your choice; you can jump aboard now or
be dragged aboard later.
Guide to Wireless Security Terms *
WEP (Wired Equivalent Privacy)
An IEEE standard security protocol for wireless 802.11 networks.
Introduced in 1997, WEP was found to be very inadequate and
was superseded by WPA, WPA2 and 802.11i.
WPA (Wi-Fi Protected Access)
A security protocol for wireless 802.11 networks developed
by the Wi-Fi Alliance to provide a migration from WEP. The
WPA logo certifies that devices are compliant with a subset
of the IEEE 802.11i protocol. WPA2 certifies full support
for 802.11i.
TKIP(Temporal Key Integrity Protocol)
TKIP uses the same algorithm as WEP for encryption, but adds
sophisticated key management and effective message integrity
checking. TKIP was designed to be efficient enough to work
in older WEP devices by updating their firmware to WPA.
802.11i
An IEEE standard security protocol for 802.11 wireless networks
that was developed to replace the original WEP protocol. Also
known as "Robust Security Network" (RSN), 802.11i
provides sophisticated authentication using a variety of protocols
(802.1X, EAP and RADIUS) and strong security with the AES-CCMP
encryption protocol. However, in order to allow in-place upgrading
of older WEP hardware, 802.11i also supports the TKIP protocol,
which is less robust than AES-CCMP, but far superior to WEP.
*Definitions taken from PCMAG.com encyclopedia.
Angela Richardson is a Recruiting Specialist
at Roytman Information Services, Inc., a Dayton, Ohio-based
provider of Career Placement and Consulting solutions in Information
Technology, Management and Engineering. Established in 1995
the company has been growing consistently in a highly competitive
industry. For additional information please visit http://www.roytmanIS.com
|
