June 07, 2004 (Computerworld) -- I'm a parasite. I didn't pay for the bandwidth I'm using right now. I didn't ask for permission to use it -- I don't even know whom to ask. But I'm on holiday, I have a few bits of work to finish up before I can relax, and I need to send my e-mail.
The broadband service in the rented house doesn't work, so I stuck in my wireless LAN card and found two WLANs covering the house. One has a Secure Set Identifier of "lopez" and has Wired Equivalent Privacy turned on; the other has an SSID of "default" and no WEP.
My wireless card has automatically associated with the "default" base station, which gave me a Dynamic Host Configuration Protocol address. Now I'm connected to the Internet at 11Mbit/sec. with no fee and no restrictions on what I can do.
When WLANs hit the mainstream a few years ago, the security focus was on confidentiality, and vendors included WEP to encrypt data in the air. WEP has flaws -- it might not stop a snooper in your parking from reading your data -- but just the fact that "lopez" had it turned on was enough to turn my attention elsewhere. Why hack "lopez" when "default" is sending in the clear?
But having data sniffed from the air isn't the real threat that wireless poses. That problem is easily solved by using cryptography. A bigger worry is "de-perimeterization," which is a fancy way of saying that the walls of the normal fortress model are falling away, thanks in part to wireless. In the good old days, you inventoried all external connections and put firewalls in front of them. Now, nearly every organization has so many connections to the outside that it isn't feasible to set up firewalls to control access to all of them. If your wireless users need access to all of the internal services, what can you block with a firewall?
And if you're a hacker, why bother trying to intercept data from the traffic flying about when you can just connect to the network and pretend to be a legitimate client? Once you become a full node on the network, you don't have to wait for a client to connect to download the information you want and sniff it. Instead, you can just waltz right in and take what you want. This is a lot less covert, but unless the target has a hair-trigger intrusion-detection system configuration and very good triangulation equipment, you probably won't be discovered.
My company's authorized wireless access points have strong authentication, so only legitimate clients can connect, but all our exterior defenses might be for naught if a staff member plugs in a $99 access point.
To protect against this, my team and I run regular sweeps to check for illegitimate access points that might allow unauthorized users to connect. We had a few early run-ins with staff when we began the sweeps, but now the authorized service is so good that everyone is happier using that than they would be trying to sneak new equipment into the office.
Insecure Access
In these sweeps, we've detected many access points that are transmitting from outside the company walls.
Download this white paper, free, compliments of Citrix. (Source: Citrix) Adoption of virtualization is concentrated among large enterprises, while adoption by mid-sized companies has been much slower. For these companies, the cost and complexity of server virtualization solutions has been a barrier.
In this paper, we'll discuss how Citrix XenServer" provides simple, economical server virtualization for any size company. Download now!
Long Tail Supplier Collaboration - What's In It For You?
Long Tail Supplier Collaboration - What's In It For You?
Download this webcast, free, compliments of Sterling Commerce
Go to the webcast
Computerworld Report: Virtual Reality
Download this Computerworld Report, free for a limited time, compliments of HP. (Source: Computerworld) The data center is real, but storage is turning virtual at many organizations that need to manage exploding storage needs. Learn how virtualizing your enterprise will save you money in this Computerworld Report, a $49.95 value, available free for a limited time, compliments of HP.
Download this executive briefing
White Papers
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
HP StorageWorks EVA4400
Before now, midsize customers settled for either an expensive and complex array or low cost solution that lacked functionality. Now experience virtual storage with enterprise class functionality at an affordable price. View this product demo now
Subscribe to
Computerworld 
or
Other Wireless Trends and Technologies Stories
Download this white paper, free, compliments of Citrix. 
Long Tail Supplier Collaboration - What's In It For You? 
Download this Computerworld Report, free for a limited time, compliments of HP.
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
IThis briefing looks at the basics of network management, which tend to get lost in the dizzying array of products and processes. It also examines new tools that are on the way to help IT executives deal with management in the new era of automation.
Columnist Bert Latamore digs deep to analyze the latest networking trends.
Computerworld