Computerworld - Normally, when you mention "mobile," information security people think of the Wireless Application Protocol (WAP) with its Wireless Transport Layer Security, or perhaps 802.11b wireless LANs using the Wired Equivalent Privacy standard. But technical acronyms aside, in my attempts to secure a new mobile office, I'm finding the state of the art lacking.
We recently won some business overseas, so we must very quickly set up an office that can be rapidly deployed and moved. The remote office will be in apartment blocks and other organizations' offices. Network wiring won't be possible, so we'll be using wireless LANs. Deploying a telephone exchange is also too time-consuming and complicated, so we'll use mobile phones for a quick deployment. To reduce airtime costs, we'll use voice over IP for normal calls back to the office.
THISWEEK'SGLOSSARY
Wireless Transport Layer Security (WTLS): This protocol supports security on mobile devices running WAP. WTLS is based on Secure Sockets Layer but is modified to support User Datagram Protocol and TCP transport protocols to deal with the long transmission times and the low processing power of mobile devices.
Wired Equivalent Privacy (WEP): This algorithm is the encryption mechanism for protecting data transmitted over 802.11b wireless LANs. The standard is based on a 40-bit RC4 algorithm to encrypt data prior to transmission. The proposed WEP2 standard will address some of the vulnerabilities by implementing 128-bit encryption. But WEP2 is still based on RC4 encryption.
LINKS:
Worried that WEP doesn’t cut it? You’re right! Read this list of frequently asked questions for the details, and buy properly secure VPN clients for all your machines that are going to communicate via a wireless LAN.
Ian Goldberg, a cryptologist at Montreal-based security and privacy software developer Zero-Knowledge Systems Inc., along with researchers at the University of California, Berkeley, uncovered flaws in the IEEE 802.11 standard. Goldberg published this paper on the subject.
I don't like wireless products. They may be quick to deploy and easy to scale, but they're designed with security bolted on as an afterthought. Much of my career has been devoted to ensuring that systems and networks are secure. Traditionally, I begin by identifying the boundary of the problem and then work my way in, adding layers of security until I reach the protected core. Wireless and mobile systems don't fit this model: The boundary of the problem is the edges of the universe.
Does that sound like hyperbole? Talk to the designers of the Russian microwave towers built to send data across Siberia. The strength of microwave transmission, from a security perspective, is its tightly focused beam. To intercept the signal, you would have to get within the line of sight. The Russians could be fairly confident that no secret listening posts had been constructed in the middle of their steppes.
Free Insider GuideCopyright © 1994 - 2012 Computerworld Inc. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of Computerworld Inc. is prohibited. Computerworld and Computerworld.com and the respective logos are trademarks of International Data Group Inc.
