Securing the airways

Internet security is a lot more than just protecting your networks from direct attacks.With more federal applications connected to the Web'and users accessing data via remote, mobile and wireless devices'network administrators have a lot more to worry about than just configuring agency firewalls. Every mobile device can theoretically be compromised to gain access to sensitive data, or to deface or destroy it.Mobile and wireless devices give federal agencies a lot of flexibility and are good tools for increasing productivity. They let users communicate anytime, anywhere. Wireless technology lets them get voice mail and e-mail messages on the road without having to plug into a hotel phone line.But all that potential comes with risk. Mobile PC users and telecommuters can connect by way of a virtual private network but will be vulnerable to attacks via the Internet if they're not properly guarded.E-mail attachments can deliver viruses or Trojan horses that expose sensitive data to hackers'even e-mail it to them. Wireless Access Protocol (WAP) sessions conducted through public application gateways can be intercepted just like any other Web traffic.The proliferation of wireless LANs has created yet another avenue for intruders to gain access to systems, including mobile PCs or devices when they're not connected to a protected network.The portability of these devices constitutes perhaps the biggest security threat. All small devices, from cell phones to notebook PCs, are vulnerable to loss or theft. A Treasury Department report in January, for example, revealed that the IRS had lost or misplaced 2,332 notebook computers over the last three years, potentially compromising taxpayer data.Personal digital assistants and handheld computers can be a security problem even if they're not stolen or lost. If a PDA user synchronizes with more than one computer, and if one of those computers is a notebook or home PC, the data can be left exposed. And with the growing power of handhelds, they can become targets of rogue application attacks, just as any PC can.To protect against theft or attack, these devices need what wired networks have had for years: strong security systems that guard all the possible routes to the data they store .A number of vendors have written such software for both the Palm OS and Pocket PC operating systems for PDAs, among them Asynchrony Software Inc. with its PDA Defense Enterprise. On commercial wireless networks, much of that threat can be addressed at the architectural level by encryption on digital cellular phones and at service providers' wireless gateways.But some current cellular network technologies, such as Code Division Multiple Access, still are fairly vulnerable to identity attack, or 'spoofing''that is, configuring a device to pose as someone else's phone, and potentially getting access to the network services available to that phone.Many of the security threats to cellular networks are mostly mitigated by digital cellular service. Networks based on Global System for Mobile communications technology and other new digital cellular standards are fairly secure. They're vulnerable mainly to denial-of-service attacks through jamming or interference. GSM phones use a subscriber identity module (SIM), a very small smart card, to identify the phone's user to a network.Other wireless technologies such as WiFi'also known as wireless Ethernet or IEEE 802.11b'and Bluetooth demand greater vigilance from users and administrators. As WiFi devices have multiplied like rabbits, and the cost of setting them up has plummeted, the risks of using them have grown.The Wired Equivalency Privacy protocol for encrypting WiFi networks has proved highly vulnerable to attack. Many wireless networks often lack even that level of protection, letting any device connect without authentication.WEP was never intended to be the sole security measure on wireless networks, but most of the risks associated with WiFi can be reduced by the same sorts of measures used to protect conventional networks.Apple Computer Inc. and other WiFi equipment makers integrate Kerberos or RADIUS'Remote Authentication Dial-In User Service'authentication into their access points.You can also use an IP Security protocol-enabled firewall in conjunction with VPN software on wireless clients, or use device-based authentication such as a SIM card.VPN clients are common for PCs, but now they're available for PDAs as well. Microsoft's Pocket PC 2002 OS for handhelds includes VPN software; Certicom Corp. of Hayward, Calif., makes a VPN client called MovianVPN for the Palm OS and Windows CE.Bluetooth, the short-range wireless technology for connecting peripherals, is also vulnerable. The protocol, designed for communication between portable PCs and peripherals, opens avenues for attack via eavesdropping on the data stream between two devices and impersonating the peripheral. It's also open to direct attack by hackers using software to guess the personal identification number used to access a computer through Bluetooth.Bluetooth developers are revising the standard to patch some of these holes. And Bluetooth's short range offers some built-in protection against anonymous snooping.It's also important to protect notebook PCs logging in to wireless LANs'especially when they're connecting on the road to unsecured networks. Personal firewalls, such as Symantec's Desktop Firewall 2.0, can shield notebooks from attacks on a wireless network or over a modem connection.Network intrusion detection software can also help with wireless network attacks.Systems administrators have to worry about the back door. Protecting against e-mail viruses has been a big burden over the last few years, particularly for organizations using Microsoft's Outlook e-mail client.Products such as GFI Software USA's Mail Security and Marshall Software's MailMarshal perform policy-based filtering on both external and internal traffic. They can prevent the spread of viruses and e-mail worms, or the mailing of data that matches specific keywords.Ultimately, the best defense against the risks of mobile and wireless devices is to apply the security policies of your hard-wired networks and desktop computers. By making sure your network is secure to start with, you reduce the risks to mobile assets. When your users understand the security risks posed by that WiFi card in their notebook PCs or the data they synchronize to their handhelds, they'll be more likely to help you bar the door.