Guideline for Securing Wireless LAN Deployment

Introduction

Wireless LAN (WLAN) is now widely deployed in Hong Kong. You can find hotspots in shopping centres, Internet cafes, hotels and Airport now. It is not surprised to see WLAN accessible along the street in the near future. Due to the flexibility in cabling and the low cost, home and corporate adoption of the technology is booming. WLAN, however, has its disadvantage in terms of security. If not properly deployed, it can bring about great security risks.

What is 802.11b and Wi-Fi?

Wireless LAN can be considered as an extension of the current LAN technology. Instead of using copper wired as the physical connection, high frequency radio wave is used to transmit signals. PCs equipped with a wireless LAN adapter can connect to each other in a network through the air. The most common WLAN standard is IEEE802.11b (also named Wi-Fi). It works on a bandwidth of maximum 11 Mbps on one of the 15 channels (in Hong Kong, use is limited to the first 11 channels) of the unlicensed 2.4GHz band. The negotiated bandwidth can fall back from 11 Mbps to 5.5 Mbps and 2 Mbps when the signal is weak or the environment is noisy. The signal-to-noise ratio can be improved by attaching an antenna to the AP or the client. WLAN uses a shared medium so you can expect collisions exist that lower the effective bandwidth.

There are two modes of communication: ad-hoc mode specifying the client-to-client communication and infrastructure mode specifying client-to-hub communication. In the infrastructure mode communication, the hub or the Access Point connects all clients up to form a wireless network. Each network has a Service Set Identifier (SSID) to differentiate itself from the others. By default the Access Point broadcasts the SSID periodically to let users to locate the network.

IEEE 802.11b includes an optional security feature called the Wired Equivalent Privacy (WEP) to encrypt the traffic between the client and the AP. The standard defines the 64-bit WEP key (with 40-bit secret key). Currently a stronger 128-bit WEP (with 104-bit secret key) is commonly available. The client and the AP must agree on a shared key before communication can be established.

Vulnerabilities and Risks of Wireless LAN

The greatest vulnerability of WLAN network is the lack of physical security. Unlike wired network, intruders do not need to enter your premise to connect to your wireless network and you have no good way of tracking who is connecting at any time.

The second security vulnerability comes from the default settings of the WLAN devices. The default settings are there for ease of deployment and compatibility. These settings allow non-technical users to connect and use WLAN without difficulty. Most users and companies do not change the default settings right after the deployment. Intruders can make use of these ¡§convenience¡¨ to connect your network as well. These are the well known default settings in a WLAN access point (AP):

No encryption (WEP) used or using a default encryption key

Default SSID (e.g. WaveLAN Network, default, wireless)

Default administrator name & password (and SNMP community string as well)

DHCP enabled by default, automatically assign IP address to all connected devices

The third vulnerability comes from the current WLAN technology 802.11b. Firstly the 802.11b incorporates no authentication mechanism and its encryption protocol, the Wired Equivalent Privacy (WEP) protocol has no automatic encryption key change mechanism. Besides, WEP is known to have a flaw that allows collection of enough packets to break the encryption.

The last vulnerability is the weakest link - human. Without a careful study of the risks associated with the current WLAN technology, some people are deploying WLAN for sensitive services. Some companies do not have control on their staff plugging in APs to their internal network, opening a backdoor to intruders and making the perimeter firewall and internet antivirus gateway useless.

The consequences of any intruder connecting to your WLAN network are:

Network resources (e.g. Internet bandwidth) being misused and productivity being affected.

Information leakage due to network sniffing by intruders outside your premise where you have no control of access.

Virus infection due to injected viruses by intruders.

Damage to confidentiality, integrity and availability when systems penetrated by intruders.

The damages might transform to financial, trust and reputation loss. You might have legal liability by allowing this to happen (e.g. violation of agreement of usage, and claim of loss when your network being used for hacking attack).

Wireless LAN Security Checklist

Here is a checklist to secure your WLAN deployment.

General Checklist to Home and Business Use of WLAN

1. Physical Security
   
   1. Do not put the WLAN Access Point (AP) close to window or door.
   2. Power-off when the access point not in use.


2. Encryption of communication
   
   1. Turn on WEP encryption. The 128-bit key WEP is preferred over the 64-bit key.
   2. To further improve the security over time, change the WEP periodically.
3. Securing SSID
   
   1. Change the default SSID to something else for your network.
   2. If possible, turn off SSID broadcast (some AP manager GUIs provide such function, sometimes called ¡§closed network¡¨). You need to tell individual users the SSID.
4. Controlling access to authorized WLAN card
   
   1. Turn on MAC Address filter to allow only authorized WLAN card to make connection. This is effective if the list of WLAN cards is manageable.
5. Controlling the IP network
   
   1. Disable DHCP service on the AP. Use static IP address on wireless LAN client. Client without valid IP address cannot connect.
6. SNMP configuration
   
   1. If your AP is configured using SNMP, make sure you change the default SNMP name and community string. Use a longer SNMP community string with mix of numerals and alphabets
   2. Enable SNMP access control list (ACL) to control who can configure the AP
   3. For security over time, change the SNMP community string periodically
7. Mobile Computing Security
   
   1. Most probably you are using WLAN with mobile devices. Make sure you observe other mobile security issues (e.g. theft of hardware, lack of protection from corporate antivirus gateway and firewall) and deploy appropriate protections.
8. Human Security
   
   1. Do not reveal your password, SSID, WEP key and other security configurations to the third party. When in doubt, change these settings.
9. Legal and Ethical Responsibility
   
   1. Unauthorized access of information system is a criminal offense. Do not try to connect to others¡¦ wireless networks and systems for curiosity, research or other intents. If you find out your neighbour¡¦s WLAN is insecure, please inform them to get it fixed. As a responsible person, please do not disclose this vulnerability with owner name and location to a third party.

Additional Checklist for Corporations

1. 1.use of technology: For very sensitive and serious services, you have to assess the risk of WLAN before taking it as an option. Put in your budget the extra cost of management and security strategies in WLAN security protection before deploying WLAN.
2. 2.Management Policy: Do not allow the staff to build their own access point. Carry out periodic check to audit if this policy is enforced.
3. 3.Perimeter Protection: Treat WLAN as untrusted network. Segment wireless traffic in a separate network. Install a properly configured firewall between the wired infrastructure and the wireless network to manage traffic going into the internal network or service network.
4. 4.Switched network connection:Connect APs to network switches (instead of hubs) to avoid communication sniffing.
5. 5.Stronger Encryption: WEP protocol has it flaw. Intruder can collect enough packets to break the encryption. It is advisable for corporation to deploy Virtual Private Network (VPN) technology on top of WEP to encrypt wireless communications.
6. 6.Authentication: Consider other forms of authentication for the wireless network (such as RADIUS and Kerberos which currently are available for some products.)
7. 7.Use Upgradeable Solution:WLAN technology is evolving quickly. When choosing a WLAN solution, ensure AP and wireless card can update the firmware. Keep WLAN devices firmware update periodically.

Next Step of Wireless LAN Security

Two of the major security issues of WLAN are the lack of authentication and the weakness in the WEP. Some proprietary WLAN implementations, like Cisco and Lucent, have included client authentication from the 802.1x standard that is used in traditional Ethernet network. Some go a step further to do mutual authentication of client and server by adopting PKI. The Temporal Key Integrity Protocol (TKIP), initially termed as WEP2, was attempted to strengthen the encryption by using dynamic WEP keys which changes every 10,000 packets. These security enhancements will be available in the coming WLAN standards.

Wireless LAN Security Guide

Security for any organization large or small

Introduction

One of the most common questions that people ask me about Wireless LANs is "are Wireless LANs really safe?" immediately followed up by "what kind of security do I need for my Wireless LAN?" The answer to the first question is "yes, if you implement good security measures" but the second question forces me to resort to the old "it depends". It depends on what level of risk is acceptable to your home or organization. It depends on what level of management and cost you are willing to bear. To simplify this extremely complex topic, I've come up with four arbitrary levels of WLAN (Wireless LAN) security as a general guideline that is designed to suit everyone's needs from the home to the military.

• Level 1: Home and SOHO WLAN security
• Level 2: Small Business WLAN security
• Level 3: Medium to large Enterprise WLAN security
• Level 4: Military grade maximum level WLAN security

Level 1: Home and SOHO WLAN security

Unfortunately, many home users are either using some old equipment, old drivers, or older operating systems that don't natively support WPA so they are still using WEP if anything at all. WEP encryption was thought to be good for a week for most light traffic home wireless networks because the older WEP cracking tools needed 5 to 10 million packets to recover a WEP key, but the newest WEP cracking techniques can break WEP in minutes. Even if there isn't that much traffic, the attacker now has ways to artificially generate traffic and accelerate WEP cracking. Because of this, consumers should avoid any product that doesn't support WPA TKIP mode at a minimum but preferably WPA AES capable or WPA2 certified devices. If they have WEP only devices, check with the vendor to see if there are any firmware and/or driver updates that will upgrade the device to WPA mode. If not, anyone who cares about privacy should throw out those devices. As harsh as that may sound, it is comforting to know that newer Access Points and Client Adapters that do support WPA can be purchased for as little as $30. Client side Wireless LAN software (officially known as Supplicants) also need to be updated to support WPA or WPA2. Windows XP SP1 with the WPA patch can suffice, but Windows XP SP2 is highly recommended.

The home or SOHO (Small Office Home Office) environment is very unlikely to have any kind of Authentication and PKI in place. This may change when TinyPEAP gets launched, but that is currently in BETA phase and is not ready for prime time yet. TinyPEAP puts a PEAP authentication server and PKI Certificate Authority in your home's Wi-Fi enabled Linksys Router which was once the exclusive domain of large organizations with dedicated authentication servers. For the time being, the only viable option for this environment is WPA PSK (Wi-Fi Protected Access Pre-Shared Key) mode. WPA mode mandates TKIP at a minimum but also has an optional AES encryption mode. AES mode is highly recommended because it has a rock solid pedigree in cryptanalytic resistance whereas TKIP may be under attack in the near future. Note that AES in WPA2 (fully ratified version of 802.11i) is no longer optional and is mandated today. Since most home users would be lucky if all of their equipment and software was TKIP capable, most homes will have to be content with TKIP mode for now.

WPA PSK mode can be an effective security mechanism but leaves a lot to be desired in terms of usability. This is because WPA PSK can be cracked with offline dictionary attacks so it relies on a strong random passphrase to be effective. Unfortunately, humans are very bad at memorizing long random strings of characters and will almost always use simple to remember words and phrases or some slight variation of that. This lends itself to dictionary attacks where a hacker will try every variation of every combination of words in the dictionary. To make this very difficult to hack, use a 10 digit string of random characters comprised of a-z, A-Z, 0-9 or use a very long word phrase made up of 20 or more characters. Unfortunately, this will force many users to write down their passphrases which in itself may lead to passphrase theft. WPA PSK is not a good long term security solution and leaves Level 1 security with much to be desired, but it can be safe when used correctly.

Level 2: Small Business WLAN security

Small businesses must move beyond Level 1 by incorporating authentication in to their Wireless LAN access controls. The standardized method for doing this is 802.1x and PEAP or TTLS authentication. 802.1x restricts access to the Datalink layer of a network by only permitting access to the network if a user proves their identity through the EAP (Extensible Authentication Protocol) mechanism. There are many forms of EAP, but the two forms of EAP that is most appropriate for Level 2 security is PEAP (Protected EAP) and TTLS (Tunneled Transport Layer Security). Note that PEAP in the general context refers to PEAP-EAP-MSCHAPv2 mode, which only requires a Server Side Digital Certificate and a Client Side Username/Password. There are stronger forms of PEAP which we'll cover later in the higher security levels. TTLS is actually a little better in security than PEAP-EAP-MSCHAPv2 because it does not divulge the username in clear text. However, both forms of authentication do a good job of protecting passwords because the MSCHAPv2 password challenge session is protected inside an encrypted tunnel. This is why PEAP or TTLS is so much better than Cisco's LEAP mechanism which transmits the MSCHAPv2 session in the clear lending itself to easy offline password dictionary cracking.

To implement PEAP or TTLS, the organization needs to implement a RADIUS Authentication Server. There are many ways to do this no matter what your software preference is. There are options for Microsoft Windows 2003 Server with IAS, 3rd party applications such as Funk Odyssey (needed for TTLS mode) that run on Windows, Open Source solutions with FreeRADIUS. However, in order to run in PEAP or TTLS mode, the RADIUS server must have a server side x.509 digital certificate. This certificate can be purchased from a 3rd party Certificate Authority such as Verisign, or it can be issued from an organization's internal Certificate Authority. These two options are conventional wisdom but neither option is particularly appealing to small businesses since they won't like paying $500/year for a 3rd party Digital Certificate and they most likely don't have a PKI in place which requires a Certificate Authority server. An excellent way to get around this problem is to use a Self Signed Certificate on your RADIUS server. Self Signed Digital Certificates violates all best practice concepts for PKI, but I say be damned with them if the alternative is to use no Digital Certificates at all on your RADIUS server and run a completely vulnerable EAP mechanism such as LEAP. Running a secure EAP mechanism such as PEAP or TTLS is too important to let PKI be an obstacle. A newer protocol from Cisco called EAP-FAST promises to solve this problem by claiming that you don't need PKI and Digital Certificates but if you read the fine print from Cisco, that's clearly not the case. Self Signed Certificates would solve the problem for PEAP, TTLS, or EAP-FAST for organizations too small to run a dedicated PKI Certificate Authority infrastructure.

The easiest method by far if you're a Microsoft Windows 2003 Server shop is to use the built in RADIUS server of Windows 2003 called IAS (Internet Authentication Server). For a small business, there is nothing wrong with adding the IAS service to an existing Windows 2003 server even if it's their only server which also happens to be the Active Directory server. You can, either convert that server in to a Certificate Authority as well and grant yourself a digital certificate for the RADIUS server or simply Self Sign a digital certificate. With this in place, the Root Certificate (the public key of the Digital Certificate) for the RADIUS server must be installed in all of the client's computers. With Active Directory, this can be easily be pushed out via Group Policy. All of the clients also need to configure their wireless settings on the WZC (Wireless Zero Configuration) service built in to Windows XP SP1 or SP2. However, Active Directory allows you to configure this globally for all your users with Active Directory Group Policy. Using the Microsoft method, a secure wireless network can be deployed throughout an organization big or small in hours. If you don't have IAS, it comes with Windows 2003 Standard Edition which costs around $500 per copy. IAS in my experience is extremely robust, reliable, and secure.

For those who wish to implement TTLS, they will need to either purchase Funk Software's Odyssey server (in the $2000 range) or implement FreeRADIUS on Linux which is Open Source. Note that Windows does not have a built in TTLS client built in, you will need to purchase a wireless Supplicant (AKA Client software) for your end users. MDC has an Open Source version for Linux, but you'll need to purchase one for Windows which is what most people are using. You'll either need to implement the Root Certificate on the Clients manually or you'll need to purchase a 3rd party Digital Certificate which has its Root Certificate already preinstalled. As for client side configuration, you'll need to find some other method to automate the installation process since Active Directory does not support the automation of 3rd party clients.

While 802.1x and PEAP or TTLS addresses the authentication half of the equation when it comes to security, encryption must also be addressed. Up until recent months, it was thought that "Dynamic WEP" where WEP keys are rotated often (commonly 10 minutes) was considered to be "good enough" encryption. With the next generation of WEP cryptanalysis tools, this is no longer the case and TKIP is the new bare minimum. The WPA standard implements TKIP which is a rewrite of the WEP protocol which will hold against current cryptanalysis techniques for now, but newer methods of attacking TKIP are on the horizon. The reliable long term solution from the IEEE standards body is the 802.11i standard which mandates AES. The recommendation for Level 2 through 3 is that you should be using WPA with TKIP at a minimum and upgrade to AES as soon as possible. Note that some WPA devices already support AES encryption while all WPA2 certified devices must support AES encryption. To be on the safe side, only buy products that support 802.11i and are WPA2 certified.

From a vulnerability standpoint, the only way to break this security level is to steal a user credential by either looking over someone's shoulders to see what password they are typing, coaxing them in to telling you what the password is (this is easier than you think), or installing a key logger on to a user's computer so you can record their key strokes as they type in the password. Barring password theft, it would be far easier to break in to your premise and tap in to a Wired LAN than to attempt to crack Level 2 Wireless LAN security. Level 2 is a good choice for most small businesses but organizations where security is a high priority should seriously consider the next two levels because a single lost password could compromise the entire system..

Level 3: Medium to large Enterprise WLAN security

Level 3 Wireless LAN security builds on the same principles of Level 2, but you're not allowed to use the "cheats" such as bolting on the RADIUS server on to an existing server or using Self Signed Digital Certificates. PEAP-EAP-MSCHAPv2 is also disallowed because of its sole dependency on passwords which would be classified as "single factor" authentication. EAP-TLS or PEAP-EAP-TLS using "soft" Digital Certificates (certificates that are stored on the user's hard drive) would be the recommended authentication method for this security level. PEAP-EAP-TLS is an improved version of the original EAP-TLS protocol that goes further to encrypt client digital certificate information. Both PEAP-EAP-TLS and EAP-TLS have the same server and client side digital certificate requirements, but PEAP-EAP-TLS may not be compatible with some older Supplicants (Client Software) or some non-Microsoft client side implementations.

To implement EAP-TLS or PEAP-EAP-TLS, not only does the server require a Digital Certificate but the users as well. This means you will need a full blown Certificate Authority to issue a proper Server Digital Certificate on a pair of dedicated RADIUS servers and not just a Self Signed Certificate on a makeshift RADIUS Server. For this security level, the proper PKI best practices should be followed. There should be at least a single dedicated PKI Root Certificate Authority, but preferably it should at least be a 2 or 3 tier PKI design. A two tier chain for a medium Enterprise organization would have an offline Root Certificate Authority and an online Issuing Certificate Authority. A large Enterprise should implement the three tier design with offline Root Certificate Authority, offline subordinate Certificate Authority, and online Issuing Certificate Authority. The reason for this is that if a Certificate Authority is ever compromised, you can revoke it and create a new one from the higher offline Certificate Authorities without having to start your PKI deployment from scratch. Building a PKI from scratch because of a compromised Certificate Authority would be completely unacceptable in a large scale environment.

To deploy Digital Certificates to the user community, a PKI management infrastructure must be deployed and permanent human resources must be allocated to manage end user certificates if your user base numbers in the thousands or more. Medium size Enterprises can add PKI management to their current hire/termination procedure. Microsoft Active Directory with an Enterprise Root Certificate Authority (a PKI that is completely integrated in to an Active Directory) can issue digital certificates automatically, but be warned that this is not a substitute for proper management. Lost or stolen laptops or terminated employees must have their digital certificates revoked and this is not an automatic process even if a user account is disabled or deleted. After the certificates are revoked, they must be published in a CRL (Certificate Revocation List) and be applied to all Authentication servers or else the revoked certificates are still usable. If Active Directory auto-enrollment is used, it is highly recommended that you do not just apply the policy to the entire domain by default so that everyone will automatically get a user digital certificate. The policy should be set on just a particular OU (Organizational Unit) so that users who need user certificates and Wireless LAN access must be manually moved to that Certificate enabled OU. Automatic enrollment should be used as a way to simplify management, not substitute management.

As for encryption, the same requirements and recommendations from the previous 2 levels apply. TKIP at a minimum but AES is recommended as soon as possible. Level 3 organizations should probably be the first to jump to the next level of encryption. The size of these organizations that would select Level 3 wireless LAN security can make upgrading difficult, but it's too important to ignore. The good news is that once AES is achieved, it is expected to hold for some time.

From a vulnerability standpoint, Level 3 is reasonably secure. The only way to compromise this security level is if the hacker can not only steal a user's password, but also steal that user's Digital Certificate which is much more difficult than just stealing a user's password. To steal a "soft" Digital Certificate, either the laptop needs to be stolen in which case it would be obvious and the certificate could be revoked, or a malicious program like a backdoor, virus or worm would have to be installed on the laptop to "harvest" the private key of the digital certificate. The latter option is much more sinister because a theft could occur totally undetected and the certificate would not be revoked. The same malicious code could also "log" the user's keystrokes and the user's password would be compromised as well. At this point, Level 3 security would be totally defeated hence the need for an even stronger solution in Level 4. Discriminating Enterprises should seriously consider the next security level.

Level 4: Military grade maximum level WLAN security

Level 4 builds on Level 3 but aims to solve the key logging certificate stealing malicious code threat. From a PKI Certificate Authority standpoint, not only is a 3 tier architecture required but the use of FIPS 140-2 Level 3 compliant HSMs (Hardware Security Modules AKA Cryptographic Modules for server side applications) are mandated. These modules cost thousands of dollars in the form of a tamper resistant external module. All Certificate Authorities should use one of these modules to ensure maximum security. Even a malicious code compromise on the Root Certificate Authority cannot compromise the Root CA's private key although such a compromise on a Certificate Authority would still be very serious. This is why the top two tiers of the PKI chain are never connected to the network as an extra precaution so that all interactions between the PKI tiers must be hand carried.

On the user side, the Digital Certificate cannot be stored on the hard drive so EAP-TLS or PEAP-EAP-TLS with "hard" tokens are mandatory. The certificates must be stored inside an HSM (these are called Cryptographic Tokens on the client side) which are typically in the form of a USB dongle the size of two fingers carried on a person's key chain or a smartcard. USB dongles are usually much more practical because they can be used by notebooks without a smartcard reader. Some newer Notebook computers have a built in HSM called a TPM (Trusted Platform Module) but it can't be separated from the computer. If an HSM empowered computer is infected with malicious code, the password can be logged and stolen but the digital certificate cannot. This is because the HSM never divulges the private key of the digital certificate to its host computer because all asymmetric cryptographic operations happen inside the HSM and not on its host computer. This makes it nearly impossible to steal a private key unless the TPM Notebook or USB dongle is physically stolen. If that were to occur, it would be fairly obvious and the Digital Certificate stored inside the stolen HSM could be easily revoked by an administrator as part of the PKI management process. To further enhance security, more expensive USB dongles and smartcards have built in finger print readers so that they are useless unless they have your living finger or they can figure out some extremely complex method of fooling the finger print reader. But the biometrics portion is just a last defence meant to buy you enough time to revoke a certificate before unauthorized access is gained. With biometrics enabled HSMs, you have the strongest 3-factor authentication system possible.

From an encryption standpoint, AES is the only encryption algorithm permitted for Level 4 and it also happens to be mandated for federal government and military applications. AES was created by the NIST and its encryption algorithm was selected from a list of finalists that represented the best encryption algorithms in the world. To comply with the AES requirement, 802.11i (AKA WPA2) compliant Wi-Fi gear is required on all Access Points, client Adapters, and software. Most consumer Wi-Fi products sold do not support 802.11i while most newer business class Wi-Fi products do. You'll have be look for the 802.11i or WPA2 logo on any Wi-Fi products you buy. Many organizations may already own products that are AES compliant if they would simply update their firwares and drivers on their Access Points and Client Adapters. Cisco products are a perfect example of this because it is probably the most dominant player in the enterprise Wireless LAN market yet most of their customers are not running the latest firmware. Upgrades on such a large scale are very difficult but corporations cannot afford to put off good security because not only is it good business, it may be the law because of SOX and HIPAA compliance.

From a vulnerability standpoint, Level 4 is rock solid and extremely difficult to compromise. The hacker would have to not only steal a user's password, but also physically steal that user's cryptographic token or a TPM notebook and take advantage of it before the user realizes anything wrong and reports the theft. With 3-factor authentication, it is practically impossible to break in to the Wireless LAN from the wireless side. The attacker will have to try some other means of compromising the network and a crowbar would be far more effective at that point.

Conclusion
Contrary to popular belief, a Wireless LAN can indeed be secure. Depending on the level of risk versus cost trade off you are willing to take, you will need to decide if you need to implement Level 1, 2, 3 or 4. Fortunately, most of the security measures that you need to implement can also serve you in other aspects of IT infrastructure. The same RADIUS, PKI, and Cryptographic Tokens can be used to secure your VPN and Remote Access solution. PKI, Digital Certificates, and Cryptographic Modules are the fundamental building blocks of strong authentication and there is no way around that. You can make the best of it by leveraging the hefty investment for all your security needs.

Understanding Basic WLAN Security Issues

A wireless LAN is the perfect way to improve data connectivity in an existing building without the expense of installing a structured cabling scheme to every desk. Besides the freedom that wireless computing affords users, ease of connection is a further benefit. Problems with the physical aspects of wired LAN connections (locating live data outlets, loose patch cords, broken connectors, etc.) generate a significant volume of helpdesk calls. With a wireless network, the incidence of these problems is reduced.

There are however, a number of issues that anyone deploying a wireless LAN needs to be aware of. First and foremost is the issue of security. In most wired LANs the cables are contained inside the building, so a would-be hacker must defeat physical security measures (e.g. security personnel, identity cards and door locks). However, the radio waves used in wireless networking typically penetrate outside the building, creating a real risk that the network can be hacked from the parking lot or the street.

The designers of the IEEE 802.11b or Wi-Fi tried to overcome the security issue by devising a user authentication and data encryption system known as Wired Equivalent Privacy, or WEP.

Unfortunately, some compromises that were made in developing WEP have resulted in it being much less secure than intended: in fact a free program is now available on the Internet that allows a hacker with minimal technical knowledge to break into a WEP-enabled wireless network, without being detected, in no more than a few hours.

The IEEE standards group is working on an improved security system that is expected to overcome all of WEP's known shortcomings but it is unlikely that products incorporating the new technology will be widely available before late 2002 or early 2003.

In the meantime, security experts agree that all sensitive applications should be protected with additional security systems such as Internet Protocol Security (IPsec). However, if excessive security measures are forced on users of non-sensitive applications, the wireless network becomes cumbersome to use and system throughput is reduced.

A good wireless networking system should therefore provide a range of different user authentication and data encryption options so that each user can be given the appropriate level of security for their particular applications.

Another point to bear in mind is that each access point in a Wi-Fi network shares a fixed amount of bandwidth among all the users who are currently connected to it on a first-come, first-served basis. It is therefore important to make sure that sufficient access points are installed for the expected volume of users and traffic. Even then there is a tendency in a first-come, first-served kind of network for a small number of wireless devices (typically those who are physically closest to the access point) to grab most of the available bandwidth, resulting in poor performance for the remaining users. The best way to resolve this issue is to choose a system which has quality of service (QoS) features built into it.

Since one of the major benefits of wireless networking is user mobility, another important issue to consider is whether users can move seamlessly between access points without having to log in again and restart their applications. Seamless roaming is only possible if the access points have a way of exchanging information as a user connection is handed off from one to another.

Furthermore, most large corporate data networks are divided into a number of smaller pieces called subnets for traffic management and security reasons. In many instances wireless LAN vendors provide seamless roaming within a single subnet, but not when a user moves from one subnet to another.

There are a number of ways of dealing with the issues described above. Several of the best-known networking equipment vendors have developed their own product ranges to include special access points and wireless LAN interface cards, central firewall and security components, and routers with built-in QoS capabilities.

When all these elements are used together, the result is a secure, high-performance wireless network. However, such solutions are expensive and integrating the various components requires a considerable amount of patient networking expertise.

Another approach that is often advocated is the use of virtual private network (VPN) hardware. VPN hardware is designed to enable remote users to establish a secure connection to a corporate data network via an insecure medium, namely the Internet. On the face of it this is a very similar problem to connecting via a wireless link.

However there are drawbacks to using existing VPN products in a wireless LAN environment. For starters, a VPN solution on its own does not address the requirement for QoS and seamless roaming between subnets.

Also, a VPN solution imposes the same high level of security on all users whether or not their applications warrant it. In order to achieve this they require special VPN software to be installed on each user's computer. In a wireless network with large numbers of users, this translates to a major headache.

What network managers are asking for is an architecture that offers different levels of security to meet varying user needs, ranging from simple user name access with no encryption through to a full IPsec implementation for sensitive applications. Ideally, the solution should deliver up to 100 Mbps of throughput. Other features should include QoS features to allocate bandwidth fairly among users, and seamless roaming both within and between subnets.

The objective is to deploy and maintain secure, high performance wireless LANs with a minimum amount of time, effort and expense.

Securing Your Wireless Network

Now that I have explained why it is so important to secure your wireless network, I want to spend the rest of this article explaining the steps that you should take in doing so. Unfortunately, I can’t give you the exact step-by-step procedure because every manufacturer of wireless hardware uses a different interface for configuring the device. Even so, the things that I will be discussing are nearly universal and will be valid for almost all Wi-Fi networks.

Use Encryption
By far the most important thing that you can do to secure your wireless network is to use encryption. Almost every wireless access point has some type of encryption mechanism built in. Most older access points offer WEP encryption, and newer access points offer a choice between WEP and WPA.

You are much better off using WPA than WEP. The WEP encryption method is flawed because if someone is able to capture enough data, it is possible to decipher WEP. Even so, it takes most home users weeks to do enough Web surfing to produce enough traffic for WEP to be compromised.

My advice would be that if your wireless hardware doesn’t support WPA, then you should upgrade to hardware that does offer WPA support. If an upgrade just isn’t in the budget, then you should go ahead and turn on WEP encryption. Sure, WEP is flawed, but flawed encryption is better than no encryption. Besides, there are enough people with insecure wireless networks that most of the time if a hacker sees that your network is encrypted with WEP, they will move on to an easier target than spending weeks trying to capture enough data to decrypt WEP.

The only other drawback to using encryption on your access point is that it can be a little complicated to set up if you aren’t the technical type. If you can’t figure out how to set up wireless encryption, then invite the neighbourhood nerd over for dinner and have them enable encryption. Do whatever you have to do, but get encryption enabled.

Don’t Announce Yourself
Wi-Fi access points use a mechanism called identifier broadcasting to announce themselves. The problem with identifier broadcasting is that you already know that you have a wireless network, so there is no need in announcing it to you. The only people that the broadcast really benefits are hackers. Not all wireless access points allow you to disable identifier broadcasting, but if yours does allow you to disable it, then you should.

While you are at it, you should also change your SSID or ESSID. The SSID or ESSID is basically just a name that’s assigned to the wireless access point. The reason why it is important to change the SSID or ESSID is because you don’t want your access point to have an out of the box name. Think about it for a minute. Wireless hardware manufacturers assign the same SSID or ESSID to every access point that rolls off of the assembly line. Even if you aren’t broadcasting your access point’s identification to the world, it isn’t that hard to figure out that you have an access point in your house. If the access point isn’t broadcasting an SSID or an ESSID then the first thing that a hacker will usually try is to attach to the access point by using common default SSID or ESSID names.

It is also important that you change your access point’s default password for the same reason. You don’t want a hacker to be able to take control of your access point just because it still has the default password assigned to it. If a hacker were to take control of the access point, they could actually lock you out of your own network.

Limit Access To Your Access Point
Another thing that you can do to help secure your wireless access point is to limit which computers are allowed to use it. Every network interface card (including wireless cards) has what’s known as a Media Access Control (MAC) address associated with it. Most wireless access points contain a mechanism that you can use to tell the access point that only network cards with these specific MAC addresses are allowed to use the network.

You can determine a machine’s MAC address by opening a command prompt window on the workstation and entering the command IPCONFIG /ALL. This command is designed to display the machine’s TCP/IP configuration. However, it will list the machine’s MAC address under the Physical Address heading.

Limiting access to the access point by MAC address isn’t a perfect security mechanism. A hacker can use a protocol analyzer to determine which MAC addresses are in use on your network. They can then spoof a valid address and bypass your address filter. Even so, it is important to use address filtering. The reason is because none of the wireless security mechanisms that I’ve shown you are perfect, but all of the mechanisms that I’ve shown you provide relatively good security