Case Studies

Throughout this section, we focus mainly on WLANs. We present several case studies that shape our discussions about security throughout the book. For the sake of clarity, it is helpful to revisit these case studies as you read the book.

Corporate WLANs may or may not provide access to the public Internet and usually have a range of 150 300 feet from the access points. In a corporate environment this is more than adequate in most situations. It allows employees to access the network from anywhere in a building or complex, including courtyards, lunch areas, and the like. The following case studies of this technology describe examples of where this mobility can be of benefit. We have identified four case studies where WLANs are used in place of a wired network: a hospital, an office complex, and a university campus for corporate or business application, and a personal or home WLAN. These case studies serve as the foundation for examining the security aspects of wireless systems in later chapters.

The Hospital

A hospital complex has installed a WLAN system. This hospital complex includes the hospital itself, external buildings housing doctors' offices, and buildings associated with external support facilities. Doctors see patients either in their own office or in the hospital and have complete access to the patients' records on a handheld PDA.

On a typical visit, a doctor, Anne, brings up a chart for her patient, Reggie, and sees that he is in for a follow-up because of an injury to his knee during a weekend bicycle mishap. Anne pulls up the radiologist's report from the preceding visit. The report indicates that the proximal end of the femur sustained a chip at the knee during the accident and that the cartilage is slightly separated from the connective tissue. The radiologist recommended surgery to repair the damage before it becomes worse. Anne approves and seconds the recommendation.

Reggie accesses his own PDA to query his schedule and receive information on his condition from the doctor's system. Anne's PDA system automatically queries her office to update any changes to her schedule, and she cross-references the schedule with that of the anesthesiologist and the hospital's surgery room. Within a matter of seconds, an acceptable date is identified and the surgery is scheduled. The doctor's office system contacts the insurance company and notifies the appropriate case manager of the surgery, and all relevant parties are notified of the event via e-mail while the doctor and patient are discussing the procedure. In the interim, Anne prescribes pain and anti-inflammatory medication for the patient. The prescription is filled out on her PDA and sent to her office computer. Reggie's preferred pharmacist is already in the system, so the prescription is sent to the pharmacy and will be waiting for him when he arrives.

Reggie leaves the examining room and walks to the receptionist's desk, where his record is brought up. The receptionist asks whether he would like the co-pay automatically charged to the credit card on file, to which Reggie responds yes. This is captured by the microphone on the counter and processed by the speech recognition system. The credit card is charged, and the insurance company is sent an electronic bill. Reggie picks up a receipt from the receptionist and is on his way.

Anne now travels to the hospital to make her rounds. She visits a patient, Chris, who is recovering from a car accident. She recommends a change to Chris's medication, inputting the change in her PDA. In turn, the PDA queries the hospital system and returns a potential harmful interaction between the suggested medication and something provided by the emergency room physician. The PDA displays alternatives, Anne selects one, and the change is indicated on Chris's chart and displayed on Anne's PDA while being transmitted to the hospital. Finally, the change is sent to Anne's office system, updating Chris's records.

The nurse who administers the medication carries a notebook, or PDA, on the medication cart. Even though she has already started her rounds, the change is reflected on her screen as she brings up Chris's chart, where the change is highlighted. The nurse smiles to herself (glad that she no longer has to read the doctors' illegible handwriting) and greets Chris warmly as she enters his room.

The Office Complex

An advertising corporation, AdEx Inc., has installed a wireless LAN system throughout its multistory building in Reston, Virginia. It has installed access points at key locations to provide complete coverage throughout the building. Employees are provided laptop computers with docking stations at their work areas. Both the docking stations and the laptops are equipped with wireless LAN access devices. The conference rooms are equipped with projection systems connected to the LAN so that employees can take their laptop to a conference room, connect to the projection system over the network, and control the presentation via their laptop.

An AdEx sales team, headed by Kathleen, is proposing a new marketing campaign to a potential new client, NitroSoft. The team has been working on the presentation for several weeks. Before the presentation, Kathleen takes the NitroSoft group to lunch. During lunch, the NitroSoft people receive a message on their PDAs announcing a new acquisition that has relevance to the team's presentation. One of the people in the NitroSoft group, Louis, mentions the announcement to Kathleen, who takes out her PDA and asks him to send her a copy of the announcement. Louis sends the copy, along with additional background, to her PDA. Kathleen forwards the information to one of her staff members, with instructions on how to incorporate the new information into the presentation.

After lunch, Kathleen and the NitroSoft group return to AdEx and head to the conference room for the presentation. On the way, Kathleen checks her PDA and receives word that her team will be able to incorporate the new information but that it will take 20 more minutes. They inform her that the changes fit well in the second half of the slides. Kathleen tells them that she will begin with the original presentation and then switch to the new presentation halfway through, if they complete it and are satisfied with the results. Otherwise, she will stick with the original presentation.

Kathleen and the NitroSoft group arrive at the conference room and settle in for the presentation. The AdEx sales team continues working as Kathleen begins the presentation. She monitors her PDA and receives confirmation that the team has incorporated the new information and is satisfied with the result. At a convenient point in the presentation, Kathleen loads the updated slides and continues. The NitroSoft group is impressed by the efficiency and speed with which the team was able to incorporate new information. AdEx and NitroSoft close the deal that day.

The University Campus

A university has implemented a campuswide wireless network through which students and faculty can conduct university business. Having prepared his lecture in his office, a professor, Steve, grabs his laptop and heads to the classroom. On arriving at the classroom, he places his laptop on the podium and accesses the lecture hall's projector over the network so that his notes are projected onto the screen at the front of the classroom.

Students have the option of turning in assignments traditionally (on paper) or electronically (which Steve prefers). Assignments are due at the start of class, and Steve has his graduate student teaching assistants (TAs), Brian and Jessie, look over the assignments during the class. Near the end of the lecture, Steve checks his e-mail and receives feedback from the TAs on which parts of the assignment gave the most problems or warrant discussion. Steve expands on these aspects while the assignment is still fresh in the students' minds. As class comes to a close, Steve posts the next assignment, that day's lecture notes, and an answer sheet for the preceding assignment to the class Web page. Students who have a wireless device or laptop can check the page immediately and ask Steve any questions they have, or they can access it at their leisure and e-mail the TAs or him for assistance, if necessary.

One night a week, Brian and Jessie hold a campuswide NetMeeting, where they discuss previous assignments and answer students' questions. Brian and Jessie each have a NetMeeting-enabled wireless laptop, so they can participate and respond to students' questions, regardless of where they are, enabling them to be more productive with their time.

The Home

A home or private WLAN using 802.11b technology has the same range as corporate WLANs, so home users can access their network from anywhere in their house, yard, or, in most cases, their own neighborhood. Home or private WLANs using HomeRF technology have a coverage area up to approximately 150 feet. For this example, it does not matter which system is used because the general capabilities are the same.

Imagine a family in a single-family house in a Chicago suburb. The father, Doug, is a financial advisor for a local credit union. The mother, Emily, holds a part-time job doing online research for a local law firm and volunteers at the local day care. They have two children, an 11-year-old son, Joe, and a 14-year-old daughter, Rachel. They own three desktop computers, and Doug has a laptop, which he uses at home for work. They have a laser printer for printing reports and newsletters for the day care center, a photo-quality ink jet printer, and a cable modem, obtained through a special offer with the local cable service.

The printers and cable modem are connected to the parents' desktop, located in the den/office. A wireless access point is also connected to this computer so that the children's computers and Doug's laptop can make use of the printers and high-speed Internet access. Joe and Rachel each have a desktop in their rooms for doing homework and research on the Web for school. Joe's best friend, who lives across the street, has a wireless adapter in his desktop, so he can connect into the network to utilize the high-speed Internet access for school research, as well as play the occasional network game with Joe. Doug is the only one who can make use of true mobility with his laptop and access the network while lounging in bed, on the couch, or on the back deck. However, the entire family benefits from their computers' capability to utilize the same printers and the cable modem without the need for running cables throughout the house.

With these case studies in mind, let us next investigate the security concepts necessary for building a robust security solution throughout the development of a wireless system. Chapter 2, "Security Principles," presents industry-accepted and widely adopted security concepts and practices. These practices help shape our discussion and investigation into the specific security issues associated with wireless systems, devices, and applications.