Enabling wireless security

Wireless technology is increasingly used by companies that want to enhance

their agility and increase productivity by enabling mobile, remote and flexible

working. However, BT's business continuity, security and governance practice

believes that a vast number of organisations and their users do not fully

understand the associated security implications and are leaving themselves very

vulnerable.

To make matters worse, wireless capability is being added to more and more

devices, and the tools to locate and hack wireless networks are easy to find and

download from the Internet - so this situation can, and will, only get worse.

The first and most important step to using wireless technology securely is to

find out exactly what equipment is in use.  Ian Hughes at BT says: “In our

experience companies who believe they have 100 per cent control of all wireless

technology always have something unaccounted for.  Even businesses that believe

they don't have any wireless connectivity at all are usually wrong. These

'rogue' devices can put the entire network at risk.  It is, therefore, essential

they secure the wireless network they know they have — as well as monitor for

and identify the one(s) they don't yet know about.”

The reason there is often so little knowledge about the actual number of

wireless devices in the enterprise is that nearly all new laptops and PDAs come

with WiFi, infra-red or Bluetooth capabilities enabled and turned on as

standard, which many users are unaware of.  Individuals can also use devices

with the wireless capability deliberately turned on, or add wireless

connectivity through USB ports, which are relatively cheap, readily available

and easy to install, without fully appreciating the risks this entails. 

Ian Hughes says: “Most large organisations find they have a number of

unofficially installed pieces of equipment that are outside the control of the

IT department, which represents a major security risk.  People like wireless

because it is easy — but it's not so easy when a hacker brings down your entire

network. We have seen plenty of examples of employees taking company laptops

home and connecting to wireless broadband, and then leaving that connection open

when they return to the office, or use their laptop or PDA on the train, in a

hotel room, and even when parked in a motorway service station.  The device

continues to look for a base station or other wireless-enabled appliance to

connect to, thus advertising its presence to any scanning apparatus within a

fairly wide radius — often many hundreds of metres or more. It's then relatively

straightforward for an unscrupulous individual to intercept those connections

and hack into the device. Some products can connect directly to others, without

needing a base station, so direct device-to-device transfers can occur without

either user being aware.” 

Hughes continues, “At the very least, organisations have got to run some form

of wireless intrusion detection system (WIDS) to identify and locate rogue

devices. No security policy can be effective if there are unknown elements on

the network, so security teams need to remain on constant look out for new

devices, and ensure that users follow policies on how they should, and should

not, be used.”

Companies also need to ensure that specific measures for wireless networking

are included in the wider security policy.  Focussing on protecting the virtual

and physical boundaries of an organisation is no longer sufficient. Mobile

devices, by their very nature, have effectively broken down these borders and

created an open environment that is more vulnerable to attack. The previously

accepted “Inside/Outside” (or “Redside/Greenside”) model, relying on physical

security and firewalls to protect the network, do not work when wireless is

added. Everything becomes “Oneside” and is accessible to all within range of the

wireless signal.

Authentication and identity management are also essential — from both sides

of the connection. Hughes says: “With wired networks the onus is on the user to

prove their identity to the server — usually through a username and password. Â

The physical connection has traditionally been accepted as providing a

sufficient guarantee that the network is what it claims to be.  However, in the

wireless world, the user and the network now need to prove their mutual

identities to each other, without divulging any sensitive credentials in the

process.”

Ian Hughes concludes: “Establishing connectivity to wireless networks no

longer requires a great deal of expertise, but neither does hacking them. It is

obvious that wireless security needs to be taken seriously. The technology may

be there in terms of data encryption and user authentication, and the

development of standards such as IEEE 802.11i.  But for these to be effective,

all devices need to be fully identified and must be used in accordance with a

policy that is specifically designed for that purpose.”

© CIOL Bureau