Case Scenario Exercise

---

In this exercise, you will read a scenario about a company’s wireless networking security challenge and then answer the questions that follow. The questions are intended to reinforce key information presented in this chapter. If you are unable to answer a question, review the lessons and try the question again. You can find answers to the questions in the “Questions and Answers” section at the end of this chapter.

Scenario

You are the lead systems administrator at a large law firm. Law firms are among the slowest adopters of new technologies, and your employer is no exception. Your organization has, to date, not deployed a wireless network. After bringing up the benefits of wireless networks at a recent meeting with the senior partners, you learned that you will not be deploying a wireless network for several years, if ever.

The lack of an IT-configured wireless network has not entirely stopped their adoption, however. Yesterday, you noticed a junior attorney accessing the Web from the firm’s library—without an Ethernet cable. When you asked the attorney how he was connected to the network, he confessed that he plugged a consumer WAP into the network port in his office.

You need to explain to the senior partners why your organization needs a wireless network security policy even if they do not want to sponsor a wireless network.

Questions

1. Which of the following risks are posed to your organization by the presence of a rogue wireless network? (Choose all that apply.)

   1. An attacker could use a wireless network card to capture traffic between two wired network hosts.

   2. An attacker could access hosts on your internal network from the lobby of your building with a wireless-enabled mobile computer.

   3. An attacker could use your Internet connection from the lobby of your building with a wireless-enabled mobile computer.

   4. An attacker could capture an attorney’s e-mail credentials as the attorney downloads his messages across the wireless link.

   5. An attacker with a wireless network card could join your Active Directory domain.

2. Which of the following would reduce the risk of a security compromise resulting from a vulnerable rogue wireless network? (Choose all that apply.)

   1. Publishing a wireless network security policy allowing employee-managed WAPs that have authentication and encryption enabled.

   2. Publishing a wireless network security policy forbidding employee-managed WAPs.

   3. Publishing instructions for other employees to access the current employee- managed WAP.

   4. Deploying an IT-managed WAP using open network authentication without encryption.

   5. Deploying an IT-managed WAP with WEP encryption and 802.1X authentication.

   6. Educating internal employees about the risks associated with wireless networks.

---