Research

Making Sense Of Wireless IPSs

Forrester Research says that choosing the right intrusion prevention system is not a case of one size fits all.

By Paul Stamp

Page 3

Recommendations: One Size Does Not Fit All

Finding the right wireless IPS for your environment depends on a number of factors, such as users connection methods, corporate security standards, and the size of your budget.

Establish your wireless priorities. The best product for you will depend on your wireless policy.⁶ If you have a no-wireless policy, or if you run an open wireless network that requires a VPN client to connect to corporate resources, then you must make rogue access point detection your top priority. For a locked-down WLAN that acts as part of the corporate network, you should instead worry most about mitigating attacks on clients and access points.
Choose a system that fits your network and physical environment. Evaluate the technical strengths and weaknesses of products relative to your environment. An office in a crowded urban environment will require a more sophisticated solution for distinguishing neighboring wireless network activities from genuine attacks than a suburban campus environment will. Also, if interoffice network traffic is already crowding your wide-area network (WAN), choose a more decentralized solution.
Consider hidden costs. When comparing costs of different wireless IPS solutions, remember to include the cost of installing new network hardware. If the solution requires separate IPS sensors, installation costs can be significant because the sensors often need to be deployed in inaccessible places. In these hard-to-reach places, power over Ethernet (PoE) can bring costs down significantly.⁷ You should also consider the cost of hardware and software youll need to support any central server-based data processing the solution requires.

Endnotes

¹The term data link layer refers to the Layer 2 of the International Organization for Standardizations (ISO) 7 Layer Open System Interconnect (OSI) Model. For more information on the OSI Model, see www.webopedia.com/quick_ref/OSI_Layers.asp.

²There are a number of methods for identifying rogue access points, ranging from handheld devices to existing network components performing regular scans. See the May 12, 2003, IdeaByte Identifying Rogue Access Points And Protecting The Wireless LAN.

³Wireless attacks are one of the biggest threats facing businesses today. See the June 5, 2002, Planning Assumption Building Wireless LAN Security: Tier By Tier.

⁴Authentication, authorization, and encryption are also essential components in a comprehensive wireless security architecture. See the December 18, 2003, Planning Assumption Wireless LAN Security: Best Practices.

⁵Once a client has disassociated from an access point, the clients system will automatically continue to try to reconnect. To minimize the effort needed on an ongoing basis to stop the client from reconnecting, more complex solutions customize the method they use to terminate the connection depending on the devices involved.