5 Essentials to Wireless Security

Wireless networks carry risks, but understanding what you need from your network, and what you don't, will help you limit those risks and gain benefits from the popular technology

April 01, 2005 — CSO — Conventional wisdom on wireless networks goes like this: They are inherently dangerous. They can leak your secrets to the outside world, through easily accessible radio waves. You'd be better off carrying around your corporate treasure in a sieve.

That's been the common view among IT and network managers for several years, supported by analysts' reports that warn of vulnerabilities, published exercises in "wardriving" that uncover porous access points and the occasional case bringing criminal charges against a defendant for allegedly swiping corporate data or consumer IDs. The view persists, but it's fading. In fall 2004, a survey of more than 400 companies by research firm NOP World showed that security concerns were a "significant barrier" to wireless adoption for 44 percent of respondents and a "moderate barrier" for another 33 percent. Richard March, NOP World Technology senior vice president, says his recent conversations with enterprises show they are now less concerned about the theoretical risks of a wireless deployment and more focused on specific deployment concerns.

The good news for CSOs is that this danger-fraught view is fading, not because the conventional wisdom is wrongwireless networks do carry risksbut because network implementers are getting more sophisticated and better able to weigh those risks against what they want to accomplish. The security and technology executives in this article, who have overseen implementations in a variety of industries, agree that whatever the environment, securing wireless networks requires five essential tasks: authenticating users so that only authorized people gain access, managing the access privileges of those allowed to connect, limiting network traffic to only what is needed, ensuring that mission-critical traffic is maintained and enforcing security of end users' resources.

Here, we're laying out the questions to ask and the risks to assess, and how different organizations have addressed them and exploited the benefits of wireless technologies.Ask the right questionsAs with other areas of security risk assessment, there is no single way to secure wireless networks. So organizations considering wireless local area network (LAN) deployments need to answer these questions to determine which security strategies and tactics are right for them.

* Where will the wireless network be available? Will its signal extend beyond my control? The issues are different for a business sharing a building than for one with a suburban headquarters surrounded by fenced-in parking lots.

* What data will the network carry? A general-purpose network that carries e-mail, corporate applications and database traffic will require more complex security methods than one carrying snippets of data for specialized devices such as bar codes.

• Print