4 threats to wireless security
Connecting state and local government leaders
Untethered computing can offer flexibility and improved productivity to an increasingly mobile workforce, but it comes with security problems.
Every rose has its thorns, and every useful technology has its vulnerabilities. Cutting the wires to let employees work anywhere and connect remotely to information resources from increasingly powerful mobile devices can provide an attractive work environment and increase productivity. But it does not come free.
“With every advance comes new challenges,” said Amit Sinha, Motorola Enterprise Mobility Solutions’ chief technologist for enterprise wireless local-area networks. “With every major advance in networking technology comes new ways to exploit it.”
The risks of mobile computing flow in both directions, into and out of an enterprise.
“People are carrying enterprise information outside” on mobile devices, Sinha said. “Policies are needed on laptops and, very soon, on smart phones as well.” In the other direction, mobile devices can become infected with malware while outside the network perimeter. “The compromised machines eventually get inside the enterprise network” and provide a vector for infection in the network. Agencies need access policies to prevent that.
Related story:
Mobile management lags behind explosion of smart devices
Sinha outlined some of the principal threats presented by wireless access and mobile computing.
1. Rogue access points. “That continues to be a problem,” he said. Unsanctioned, unknown and unmanaged devices inside the network become wide-open back doors, providing easy routes for malware to come in and information to leave the network.
The first step in countering this problem is to enforce no-wireless zones, ensuring that access points do not appear where they are not allowed. Banning wireless access completely has been the typical first reaction to this problem in most agencies. In some sensitive areas, such as military networks and the Federal Aviation Administration, “they still tend to have no-wireless zones,” Sinha said.
However, “over the last six or seven years, the trend is toward wireless,” he said. “Almost everyone demands it.”
The problems with rogue access do not stop there. After administrators have the policies and tools in place to manage approved access points, rigorous monitoring is necessary.
2. Misconfiguration. “Misconfiguration of switches and access points still represents a major problem because wireless is a new technology, and administrators have less experience than with wired networks,” Sinha said. As with most other equipment, default settings often are a no-no, and devices need to be tuned to conform to policies and best practices.
3. Unmanaged use of wireless outside the enterprise. “More and more employees are becoming mobile,” using devices on outside, open networks, Sinha said. That can leave them vulnerable to malicious traffic. That is especially true with Windows 7 support for Virtual WiFi, which allows neighbors to share access to a laptop.
Without Windows 7, laptops typically act only as a client on wireless networks. But Virtual WiFi allows the client to also act as an access point and provide services for other clients, creating ad hoc, peer-to-peer networks that can put users at risk.
4. Hackers. Active attacks on wireless links are a growing problem as mobile and wireless computing offers increasingly attractive targets to hackers. After a device becomes powerful enough and the information they contain becomes valuable enough, they attract the attention of bad guys and are likely to fall victim to exploits.
A good defense against hackers is educational and technical, Sinha said. “More enterprises are realizing they need to have a 24/7 monitoring system” for wireless. As adoption increases, various sensitive markets, such as the Defense Department and payment card industry, are becoming more prescriptive in their security, with requirements for best practices in procuring and managing the technology.
“The industry has evolved,” he said.
NEXT STORY: Cyber chief slams security efforts