AirDefense Walks the WLAN Wire

While the wireless LAN industry is gearing up for the wide adoption of the next generation of equipment—promising significantly improved performance and enabling more diverse applications and opportunities—enterprises and some vertical markets are tasked with effectively locking down their wireless networks for the purpose of regulatory compliance. These twin conditions present wireless intrusion prevention and monitoring vendors such as AirDefense with a golden opportunity to prove their worth by helping customers address performance, availability and security issues for these increasingly mission-critical networks.

Senior Technical Analyst Andrew Garcia recently spoke with AirDefense Chief Technology Officer Amit Sinha. Sinha discussed the current wireless threat landscape, the near-term future of 802.11n technology in the enterprise and the ramifications of patent action in the WLAN market.

What important things happened with WLAN security in 2007? Are there any new attacks gaining in prominence, or is it the same collection of things that have been talked about for a few years now?

Large enterprises are realizing that wireless is the Achilles’ heel when it comes to network security, and, from a hacker’s perspective, it is the lowest-hanging fruit. There were some very high-profile data breaches—particularly in retail sector—where lots of credit cards and personal account numbers were compromised. In many cases, those compromises have resulted from wireless security issues.

Click here to read more about a VeriWave tool that tests the performance of 802.11n WLAN equipment.

In the last 12 to 18 months, there are not substantially dramatic new forms of attack that have surfaced. But tools have gotten smarter and hackers have evolved from a classic guy sitting in mother’s basement to more organized criminals. The types of attacks we have seen involve rogue access points or other unauthorized wireless devices that are connected to an enterprise network, and, in turn, these devices have been offering backdoor access into corporate secrets.

While there have been a couple of newer attacks that have been talked about in the DefCon-type conferences—like the wireless fuzzing attacks that exploit weak driver implementations—these are not the type of attacks that organized crime is using, to the best of my knowledge. There is other lower-hanging fruit out there that results in substantial damage from the enterprise perspective, and you don’t have to be that sophisticated a hacker to breach these networks.

What will be the over-arching wireless security themes for 2008?

You will see more regulatory enforcement. For instance, the Payment Card Industry data security standard that went into effect last January has become more stringent about scanning retail environments on a quarterly basis for rogue wireless devices. They have also become much more stringent about WEP [Wired Equivalent Privacy] encryption, mandating retailers either move away from WEP or secure WEP with other layers of protections.