Subject: [NEXTEL-1] Making Sense of 802.11 - Wireless LAN Lockdown

From: Marcel <[email-masked]>
Date: Wed, 05 Feb 2003 21:47:40 -0500

Making Sense of 802.11

Wireless LAN Lockdown

By Jason Brooks
February 3, 2003 

The drastic drop in the cost of WLAN (wireless LAN) gear, along with the great extent to
which 802.11b networking is now being built into notebook and handheld computers,
virtually guarantees that wireless networking will secure a spot on your agenda—whether
you've placed it there or not. IT administrators would do well, then, to head off a
wireless groundswell by taking the lead in deploying these networks 
and doing so with the sort of attention to security that end users often can't afford to
pay.

In the past year, there's been some encouraging movement toward more secure wireless
networking standards. However, as security standards for these networks mature, so, too,
will the tactics of those who would crack them.

Inherently Less Secure

Wireless networks are fundamentally less secure than wired ones. Nearly every business,
however, is already plugged in to perhaps the least secure network of all—the Internet. By
regarding WLANs with the same suspicion they do the Internet, companies can unwire
themselves with relatively high confidence.

First, survey your WLAN coverage to make sure that access does not extend beyond your
campus.

Then, start with the security built in to Wi-Fi products. Although WEP (Wired Equivalent
Privacy), the primary security mechanism that ships with 802.11b gear, has been proved
flawed, it provides better protection than nothing.

In addition, be sure to apply patches as vendors ready security updates for their WLAN
hardware and software offerings (such as those this spring that will bring Wi-Fi Protected
Access to existing equipment). If there were any doubts about the importance of patching,
the Slammer worm outbreak last month should have put them to rest.

Companies can protect themselves against casual attacks by enabling WEP, changing access
point administration passwords and SSIDs (Service Set Identifiers) from their factory
defaults, and separating the wireless network from the wired network into an
Internet-access-only zone. Atop such a framework, companies can provide secure access to
the network resources they've sequestered in the same way that they provide these services
across the Internet—with a VPN (virtual private network).

This can be particularly attractive to companies that have already developed a VPN
infrastructure to secure traffic across the Internet. And, because of the popularity of
VPNs for securing Internet traffic, VPN clients ship with or are available for most
operating systems and computing devices.

VPN clients do impose additional processing power overhead that can be especially
noticeable on handheld devices, but we've experienced good performance with the mobile VPN
clients we've tested.

Moving forward, client-side encryption capabilities should improve as chip makers build
hardware acceleration engines for encryption algorithms into their processors. Transmeta
Corp., for example, has announced it will do so in future Crusoe chips.

Some WLAN equipment vendors have bolstered and otherwise extended WEP in their
products—replacing, for example, WEP's static key mechanisms with dynamic ones.

eWeek Labs recommends that companies eye such proprietary solutions with caution, however,
because they generally require vendor homogeneity from access point to NIC.

Wireless networking is all about flexibility and openness, two virtues that proprietary
security technologies can work to suppress. And WLAN functionality is being built into a
wide range of computing devices, many of which may not interoperate with a given
proprietary security technology.

For companies searching for a single, end-to-end solution—and willing to pay for
it—vendors such as ReefEdge Inc. offer appliance and software-based solutions that provide
for user authentication, traffic encryption and access point management in fairly turnkey
packages. Such systems tend to be hardware-agnostic and offer benefits such as
quality-of-service assurance and smooth roaming among access points.

Companies with small or particularly well-managed networks can further boost security by
disabling Dynamic Host Configuration Protocol within their WLANs, to keep closer control
of users accessing the network, and by enabling media access control address filtering on
access points, to limit network access to an authorized set of wireless NICs.

Wireless LAN Lockdown (continued) 

Making Sense of 802.11

802.11a An extension of the 802.11 standard family that operates in the 5GHz band; by
replacing the DSSS (direct sequence spread-spectrum) transmission technology of 802.11b
with an OFDM (orthogonal frequency division multiplexing) encoding scheme, 802.11a can
deliver speeds up to 54M bps

802.11b The most widely used WLAN standard, 802.11b operates in the unlicensed 2.4GHz band
and transmits in DSSS; maximum speeds for 802.11b top out at 11M bps

802.11e An effort to boost the quality-of-service and multimedia capabilities of the other
802.11 standards while maintaining backward compatibility

802.11g Uses the same OFDM scheme as 802.11a and will potentially deliver speeds on par
with 802.11a; however, 802.11g gear operates in the 2.4GHz swath of spectrum that 802.11b
equipment occupies and, for this reason, should be compatible with existing WLAN
infrastructures

802.11i Another complementary 802.11 standard, intended to boost security with improved
key-distribution methods and advanced encryption technologies such as AES and TKIP
 
Senior Analyst Jason Brooks can be reached at [email-masked].

http://www.eweek.com/article2/0,3959,857260,00.asp

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/