Basics

Wireless Security: The Basics

Encryption and authentication are the fundamentals of wireless security - here's your guide.

By Galen Gruman

The Basics for Protection

Wireless users face one key threat: having their data, passwords, and so on intercepted during transmission. The venues for such interception can vary, such as from a Wi-Fi eavesdropper or through a rogue access point. Similarly, mobile users face the similar threat: having their devices' data exposed to someone who hacks into them if lost or stolen.

In both cases, encryption of data (both at rest and during transmission) and authentication of user access (to data, devices and networks) are the key security methods. These techniques should be coupled with commonsense security techniques for any network or computer, such as requiring strong passwords, imposing user access control policies, and segregating traffic through techniques such as VPNs and virtual LANs.

The trick is ensuring that these methods are applied throughout the network and the devices using them, so any individual breach has limited impact.

Any wireless network should authenticate users via an encrypted "handshake," 'which means using the WPA protocol or the newer, slightly more secure version called WPA2. Both are based on the 802.11i standard, but WPA was based on a draft version, while WPA2 was based on the final version. WPA and WPA2 also come in two flavors: personal and enterprise. The personal version uses a pre-shared key (PSK), meaning all users are given the same credentials. The enterprise version uses an 802.1x server to create unique credentials for each user, making it more secure, since if one credential is discovered, the others are still secure. But the enterprise version does require more work for IT, notes Paul Kocher, president of the consultancy Cryptography Research. "It's not a great solution for a large company with lots of users," he says.

That's why WPA should be only the first line of defense in a wireless network. The next line of defense should be the use of virtual LANs, to segregate traffic and users from each other. This is the same principle as using subnets in a wired network. By confining users to specific VLANs, you can use access control policies to monitor wireless activity and determine role-based access, Kocher says, even if an unauthorized person gets past the WPA authentication step.

IT should also ensure that wireless users follow the same security approaches  as in any remote connection, Maiwald says, including ' using SSL or other forms of encryption for email and server access, as well as VPNs to create secure connection tunnels. This last recommendation is particularly critical when users access the corporate system from public wireless hot spots, adds 'Carey, because their access points tend to not use SSL in the connections to the user's' laptops.

• Email
• Print
• Comments
• Digg This
• SlashDot

• Network Security: The Basics
• The Deperimeter Problem
• A Field Guide to Spotting Bad Cryptography
• Risk Assessment: Are You Overlooking Wireless Networks?