How to secure a wireless network? Very carefully

By William Jackson

Connecting state and local government leaders

| August 9, 2002

"Wireless is a leaky environment," said Ken Evans, vice president of marketing for Fortress Technologies Inc. of Tampa, Fla. "It's impossible to stop the radio frequency signals."

"Wireless is a leaky environment," said Ken Evans, vice president of marketing for Fortress Technologies Inc. of Tampa, Fla. "It's impossible to stop the radio frequency signals."It is so leaky that the Army last year called a moratorium on wireless LANs, delaying deployment of its Combat Service Support Automated Information System Interface until security concerns could be addressed.But security for wireless networks has improved, and the first of 11,000 CAISI gateways now are being deployed. They eventually will give 85,000 users wireless connections to the Defense Department's wired networks for maintenance, logistics and supply chain management.Protocols for wireless networking are correcting some early security problems, and companies such as Fortress and Internet Security Systems Inc. of Atlanta are helping to plug the remainder of the holes."The technology is there to secure a wireless network," said ISS product manager Patrick Wheeler. "But there needs to be a conscious effort and investment" in security to make it work.The IEEE 802.11 family of standards demonstrates many of the weaknesses that exist in wireless networking. The wireless Ethernet standard uses the 2.4-GHz band at data rates up to 11 Mbps. But with the Wired Equivalent Privacy protocol used in 802.11b, all users on an access point share one encryption key that can be easily deciphered. Also, wireless access depends on a user device's media access control layer address, which is easy to discover and spoof.A later standard, 802.11a, still uses WEP and does not represent a significant increase in security, Wheeler said. A still later version, 802.11g, uses the Advanced Encryption Standard and is a large improvement. But neither version is perfect.There are two major challenges to deploying a wireless network, whether it uses 802.11 or any other protocol. The first is that these networks are subject to many security breaches, according to a study by ISS:The second challenge is that even if a wireless LAN has been properly secured, unauthorized access points can provide back doors to the network. Hackers and even legitimate users seeking remote access to the network could set up such rogue access points."Security would be so much easier if it weren't for the users," Wheeler said. "In some ways, wireless is where Internet and Web server security was five years ago. We learned the hard way in wired networking, and we're correcting those problems."Virtual private networks can be deployed to secure wireless LANs. But VPNs make users authenticate with each access point as they roam, complicating configuration and limiting mobility.The Army is using AirFortress from Fortress Technologies to secure the 802.11b CAISI networks. Launched in December, AirFortress in July became the first 802.11 security product to receive FIPS 140-1 certification.Federal Information Processing Standard certification was a requirement for its deployment by the Army. Its proprietary wireless Link Layer Security protocol replaces WEP, and it uses AES encryption.AirFortress consists of Wireless Security Gateways that enforce network access rights and encrypt communications across the wireless LAN; Secure Clients that encrypt transmissions from desktop, notebook and handheld computers; and an Access Control Server to monitor and manage authentication and access. Access through the gateway to the wired network requires an AirFortress client and an established secure session.Products such as ISS Internet Scanner provide additional protection for wireless networks by searching for unauthorized or misconfigured access points. ISS RealSecure, deployed between an access point and the network, detects and reacts to attacks and misuse on the network.Once the technology has been deployed to secure a wireless network, maintenance is key to keeping it secure. Resources must be allocated to monitor for and correct problems and to ensure security policies are followed.

"Wireless is a leaky environment," said Ken Evans, vice president of marketing for Fortress Technologies Inc. of Tampa, Fla. "It's impossible to stop the radio frequency signals."

Related Links