During the Windows XP beta phase, Microsoft Senior Vice President Brian Valentine told a humorous story about visiting various high-tech companies worldwide and hacking into their wireless networks by using XP-enabled laptops from his rental cars in the companies' parking lots. In one humorous instance, something in this technology actually set off a car alarm in the Oracle parking lot, which Valentine found somewhat appropriate given the competition between the two companies. "I guess it was incompatible with XP," Valentine joked.
Although Valentine warned those companies that had left their wireless networks open to attack, since that time, many more companies have implemented wireless networks and haven't taken the time to properly protect their assets from wireless-based attacks.
The problems are twofold. First, protecting a wireless network requires a different set of configurations than does security for standard wired networks. Second, despite the fact that most IT departments are up-to-date on security concerns and can properly configure Windows-based networks, an alarming number of these companies are simply plugging in wireless Access Points (APs) and setting a few security options.
These steps aren't enough. Wireless networks aren't secure and might never be secure until the invention of technologies that rethink the architecture of the current technology. But if you want to get on the wireless bandwagon now, take more than a cursory look at wireless security. Obviously, you need to apply all your hard-won security knowledge to wireless networks, but I've outlined some wireless-specific things you can do now to better secure your wireless networks.
Segregate Wireless Access
Don't connect your wireless networks to the networks that contain your crucial data. Instead, segregate your wireless connection and make it available for Internet access only if possible. This setup will let employees access Internet services such as Web, email, VPN, Microsoft Outlook Web Access (OWA), and other similar corporate services.
Use WEP
The primary security model that today's Wi-Fi, the 802.11b wireless standard, networks employ is called Wired Equivalent Privacy (WEP). Basically, WEP is a set of algorithms that provide authentication and data-encryption services in 40-bit and 128-bit variants. Unfortunately, attackers have already broken WEP, but if you turn off wireless network broadcasting and require specific media access control (MAC) addresses, you can augment WEP enough to make it suffice in many situations.
Turn Off Wireless Network Broadcasting
By default, wireless APs broadcast their names, or Service Set Identifiers (SSIDs), so that wireless-enabled clients can more easily identify the names and access them seamlessly. Modern OSs such as XP rely on this feature to provide users with the simplest possible wireless functionality. Turn it off. A network broadcast is an easy way for intruders to discover a way in to your network or steal your precious bandwidth. You'll have to manually configure clients to access specific broadcasts, but the benefits outweigh the effort.
Require Specific MAC Addresses
Rather than let any wireless client access your wireless network, set up your wireless APs to work only with specific wireless clients. Configure this by hard-coding the MAC address of each wireless network adapter you provide to users into an access list in the AP's configuration console. Again, manually configuring this access could be painful in large enterprises, but you don't want outsiders accessing your network, right?
Don't become a statistic. Only through a common-sense approach to security can you adequately protect your network from a wireless-based attack.
