9.1 Access Point Security

WLAN security starts with the access point. The remainder of this chapter discusses ways of securing communications between the end users and the network, but those steps are pointless if an attacker can easily compromise the access point.

Location is the first step that needs to be taken to secure an access point, or a series of access points. The access point has to be physically secured, so that it is not easily accessible by an attacker. If possible, access points should be mounted within the ceiling and stored inside a locked cage to prevent unauthorized direct access and removal.

Access points should be located toward the center of a building, so the signal weakens by the time it gets to the perimeter. If an organization has multiple buildings and is trying to set up a WLAN throughout the campus, it may be difficult to limit the signal to the interior of the buildings . In cases like this, steps should be taken to ensure the security of the campus itself, preventing unauthorized users from accessing the grounds. ^[1]

^[1] Especially unknown users carrying a laptop and several high-gain antennas.

Proximity and physical security are not enough. If keys and other filters are to be stored on the access points, access to them should be limited. This presents a real problem for most WLAN administrators, because many access points ship with management tools that are inherently insecure . Access points generally rely on one of three methods for configuration: HTTP, Telnet, and SNMP. The security flaws in Telnet and HTTP are well known: All data is sent clear text. SNMP suffers from many of the same security problems as Telnet and HTTP; SNMP will be discussed in Chapter 16.

Whenever possible HTTP, Telnet, and SNMP should be disabled on access points, and other methods of access should be used (e.g., HTTPS or SSH). If a vendor does not support a secure method of control for an access point, then connections to the access points should be made only over the wired network segment, as opposed to the wireless segment. The risk still exists that an attacker has compromised the network and is scanning for password, however, if that is the case, wireless access points are going to be a very low priority target.

Finally a scan should be periodically made of all access points to look for unauthorized traffic, and, more importantly, unauthorized access points. Occasionally a user , or a group within an organization, will set up a WLAN without informing the IT department. These may be set up in a lab, or as a way to add more computers to the network; there are many reasons. Chances are these users are not aware of the steps necessary to fully secure a WLAN, and may inadvertently be allowing unauthorized traffic into the network.

Oftentimes, security measures in place on the wired network will prevent an unauthorized access point from bridging a rogue WLAN to the network, but it is still possible that one may have slipped through. Software products from IBM (Wireless Security Auditor) and Netaphor Software (PDAlert) can be installed on handheld devices equipped with an 802.11b-compliant LAN card and used to monitor network activity. These software packages are specifically designed to audit WLAN networks and alert administrators to potential security holes.

This type of network audit will help WLAN administrators determine where security holes are and hopefully use that information to rectify the security problem. The information can also be used to determine how the problem was allowed to occur, so it can be prevented from recurring.