How to close the gaps in your wireless network
Connecting state and local government leaders
We've all heard the proverb: Play with fire and sooner or later you get burned. In the IT world, getting burned can mean losing important data or, worse, compromising sensitive information.
We've all heard the proverb: Play with fire and sooner or later you get burned. In the IT world, getting burned can mean losing important data or, worse, compromising sensitive information.The GCN Lab staff has reported often on the importance of securing a wireless network. The urgency is underscored by an experiment I conducted driving from Washington's Union Station toward the Maryland state line.The mission: to see how much drive-by connectivity I could get from wireless access points in buildings along the way.IEEE 802.11b and, most recently, 802.11g access points broadcast a wireless network identifier, similar to a network domain, called the service set identifier (SSID).The identifier and the access points are the doors to your network. When a wireless PC Card such as the one in my notebook PC detects a network, it tells you the SSID of the network it found and asks you whether you want to join.If the merger is successful and no other security features are enabled, the access point releases an IP address to your client letting you access the IP's range of numbers and, more commonly, the Internet.My goal was to see how many SSIDs I could pick up over a 2.5-mile distance. I then tried to connect to those networks and get an IP address.Once the wireless signal was detected, I would click on a box in the default wireless network manager that connects to the found network. Then with the command prompt open, I would type ipconfig to see if I'd been given an IP address. If no new address was registered I typed ipconfig/renew to get an IP address from the computer on the other end of the access point.I used a Dell Computer Corp. wireless notebook with an embedded Intel 802.11b wireless chip. The lab's tests have shown that wireless proficiency tends to decrease with internal wireless clients, but I was still able to see eight wireless access points and automatically gain four different IP addresses.It's important to remember that simple steps can secure a wireless LAN. First and foremost, change your SSID from the default name to an uncommon name. We were relieved to see that most of the networks we saw did just that. Unfortunately they didn't follow the second step.After you change your SSID, disable its open broadcasting. If your access point doesn't have that feature, get one that does. Many from Cisco Systems Inc. and 3Com Corp. do.If you take these steps, anybody looking for a signal outside your door won't find one. And if you've also changed the SSID name, a would-be hacker can type the usual domain-name suspects all day and get nowhere.The next step is to make sure wireless access cannot be granted to the Admin profile of the access point and that the profile has a password feature.Furthermore, enable Media Access Control addressing, which gives clients a number that can be verified by the corresponding access point.Finally, enable Wired Equivalent Privacy, which encrypts data. WEP is highly flawed, but nevertheless adds another layer of security.Combine all of these steps and you'll have an almost airtight wireless platform. At worst, it will prevent people from using your wireless network to surf the Internet for free; at best, it will protect your most valuable data.
Get an IP address
Carlos A. Soto, GCN associate editor for reviews
Get an IP address