Chapter 11: Securing Wireless Networks

Overview

Wireless network access has become essential at home, the office, and even the local coffee shop. Laptops, phones, and PDAs have the ability to use a myriad of wireless technologies. Organizations are deploying wireless networks for a variety of reasons: ease of use, total cost of ownership (TCO) of wired vs. wireless networks, or even as a method of increasing revenue by providing customers with convenient on-site Internet access.

The convenience provided by wireless networks is significant for anyone using the technology. Unfortunately, the reality is that wireless networks when improperly secured present a laundry list of security problems. Prior to the advent of wireless technologies, network administrators had to worry less about what happened outside the walls of the environment they were in. In today's world of wireless access points, PDAs, and cell phone links to the organization's infrastructure, this is certainly not the case. Let's look at a scenario that is becoming an all-too-common mistake.

An enterprise user has an 802.11g wireless access point at home. This allows the user to move freely throughout the home and access other devices as if the device being used is physically plugged in. Other than having to plug in the laptop from time to time to charge the battery, all other cables are optional. Yet, at work users find themselves having to find a network jack, plug in, and hope the jack they are using is active. The cost of 802.11 wireless network devices has plummeted in recent years , making such devices very affordable. Given the price decrease and the configuration ease Plug and Play access points provide, users feel that adding wireless network devices to the enterprise network should be "no big deal." A user may go to a local computer hardware store and pick one up for the office, in addition to the one they have picked up for themselves at home. By simply unplugging the desktop or laptop from the jack normally used and plugging in the access point, a rogue access point is now active on the inside of the enterprise network. The user no longer has to worry about being tied down with wires and can move about the environment within a 300-400 foot range of common wireless access points.

The use of the term "rogue" denotes the device in question is not under the enterprise's administrative control or is misconfigured in such a way that a miscreant can use it to gain access to the network. At this point, there is an entry point to the organization's enterprise network that is not under the control of the enterprise administrators (effectively circumventing any security measure put into place by the organization for network access).

What if the environment in which this rogue wireless access point lies is physically smaller than the range of this access point? It is very possible (unless special materials are used in the building construction to limit radio signals) the signal will be available and the wireless access point accessible outside the office walls. Now, the user who set this up may have read the manual and may have disabled the Service Set Identifier (SSID) and filtered the Media Access Control (MAC) addresses allowed to use the access point. The user may have even gone as far as to add a 128-bit WEP encryption "key" so all traffic traversing the access point is encrypted. These are all basic steps necessary when securing a wireless network, but overall these are really just speed bumps for miscreants who target the access point as an entry point into the organization's network. If network administrators don't periodically audit their organizations for rogue wireless access points, they could be inadvertently inviting miscreants into their network and they may be completely unaware of their presence.

Why is it a security risk to have rogue wireless access points on the network anyway? Even the best-laid security plans and practices can be foiled over time if a miscreant has unfettered access to the inside of an enterprise network. A miscreant that finds a rogue wireless access point can access the inside of an enterprise network without having to go through the firewall, access control lists (ACLs), VPN concentrator, or other security devices that network administrators deploy to keep unauthorized people from gaining network access. Finding rogue access points, especially in enterprise environments, has been given various names , such as "war driving" and "war nibbling" (the name depends on what type of network you are trying to find). All this can be done from a somewhat-remote location that might not be visible to an organization's employees (especially the administrators). In the scenario that was used, a parking lot or adjacent office space anywhere within the radius of the access point can be used as a hiding spot for miscreants attempting network access.

Another example for wireless technology use is to complement other services provided by an organization. Generally, Return on Investment (ROI) is a requirement with many IT projects. Wireless networks can quickly show ROI for businesses that have facilities allowing users to connect (for Internet access, for instance) while conducting other business there. Starbucks, McDonalds, and others have deployed hot spots at various locations to provide this type of service to their customers. These types of services can bring customers in and keep them there for longer periods of time compared to locations with no Internet access.

Various retailers have also implemented wireless technology in order to streamline their inventory and checkout processes. Examples of merchants with this sophistication include Best Buy and Wal-Mart. When a company faces the option of wiring a large area vs. implementing wireless access points, TCO can be very apparent and in favor of wireless technologies in today's fast-paced market. In this example, wired assets would not work well at all; therefore, by implementing wireless infrastructure, the organizations can conduct business much more efficiently . The key to remember is that all of the data is being sent over the air and must be secured in some manner.

If these brief scenarios don't scare you, you are either one of the few network administrators diligent in your efforts to secure wireless infrastructure or you need to read this chapter to help you understand the threats involved with wireless networks today. We will analyze threats your network is faced with every day when wireless technologies are implemented. This analysis will include examining some of the packages that can be used to break into your "secure" wireless network. Of course, countermeasures are included.

This chapter will provide information on the following:

• Wireless History A quick history of how wireless came to be.

• Basic Wireless Security A brief explanation of the standards in securing wireless networks.

• Advanced Wireless Security Once you have the basics covered, what else can you do?

• Bluetooth At only 12 Mbps and although only some of the devices connect to your IP network. Bluetooth is now a real security consideration.

• Wireless Jails A look at a vendor- agnostic approach to securing your wireless network.