Opinion
How to build a secure WLAN
By James Liu
February 6, 2003 12:00 PM ET
Computerworld - Real-time network protection required for wireless networking
Wireless LANs have experienced tremendous growth since the introduction of the 802.11b wireless networking standard spurred the development of a wide range of "Wi-Fi" solutions developed by network equipment vendors. Flexibility, ease of deployment and low component costs constitute three major drivers for the popularity of WLANs. However, the same flexibility and mobility provided by wireless networking also introduces new security vulnerabilities in addition to those that threaten conventional LANs. For real-time communications like Wi-Fi, a comprehensive real-time network protection strategy is required to enable pervasive, widespread deployment.
WLAN security threats inhibit build-out
Because WLANs use publicly available radio spectrum as the medium to carry data, unauthorized access and eavesdropping are key concerns. Major security threats to WLANs include the following:
- WLAN access points can be probed by anyone within reach of the network's radio signal, thus constituting physically unbounded entry points from which to launch intrusions, viruses and all other types of attacks that threaten landline networks.
- WLAN access points are often deployed inside corporate networks behind conventional firewalls, making these access points even more attractive as points for launching attacks.
- WLANs are extremely vulnerable to denial-of-service attack and interruption. Any malicious hacker with a laptop and a wireless Network Interface Card can transmit wireless signal interrupters in close proximity to company sites where WLANs are deployed and effectively jam a Wi-Fi signal.
- Internal employees can set up their WLAN interface cards to operate in peer-to-peer (P2P) mode to communicate directly with people outside of the company.
Naturally, the framers of the 802.11b wireless standards were aware of these vulnerabilities and designed a number of security features into the technology to address them. These include the following:
The use of Service Set Identifier (SSID): The SSID is a shared secret (typically an ASCII string) that has to be configured by network administrators into all access points and wireless terminals (e.g., PCs) that share a common WLAN. The weakness of the SSID is that it's a relatively simple password, common to all devices on the WLAN, and once the SSID is compromised, any device with the SSID can gain unrestricted access. Furthermore, the default setting of SSID is often not changed in WLAN deployments, and access points are typically configured to broadcast their SSID, further degrading security because intruders can get the SSID through easily obtainable tools.
Media Access Control (MAC) address filtering: Since every WLAN terminal's network card has a unique MAC address, it's possible to manually maintain a set of allowed MAC address lists for
Free Insider Guide