How Much Wireless Security Is Enough?

 
 
By John Taschek  |  Posted 2002-03-25 Email Print this article Print
 
 
 
 
 
 
 

Because 802.11 wireless is a broadcast signal, security problems are exacerbated.

This is a multiple-choice question: if people are so concerned about 802.11 wireless security, why have they deployed $1.5 billion worth of the stuff?

(A) Theyre idiots; (B) theyre ignorant; (C) they believe its secure enough; (D) they dont care.

The answer most likely is C, and, chances are, theyd be right, especially on limited-use deployments such as a home network. In a business, however, direct access to a corporate network can never be too secure, and 802.11 provides less-than-minimal protection. But its really not much different from cabled networks in that regard.

Think about it. Cables can be tapped. Authentication is usually based on who sits where at any particular workstation, and data access at the Layer 2 level is usually done simply by subnetting the network. The same issues have surfaced with wireless, but because it is a broadcast signal, the problems and security risks are exacerbated.

Recently, 802.11 has come under fire for inherent flaws—beyond the normal WEP flaws that were accustomed to—that may never be fixed. A paper published last month by University of Maryland computer scientists states that 802.11 "does not provide a sufficient level of security, nor will it ever without significant change."

That paper diagrams two types of attacks: session hijacking and the man-in-the-middle attack, which is best described as wireless authentication forgery. The paper specifically attacks current 802.11 standards for authentication, but it also thrashes the more elaborate wireless proposals that include the Robust Security Network and RADIUS servers.

The RADIUS servers integrate with 802.11 via Extensible Authentication Protocol, or EAP, which itself has multiple facets. The University of Maryland paper challenges EAP but not necessarily its offshoots, EAP-TLS (Transport Level Security) and PEAP (Protected EAP).

I, for one, believe RADIUS (www.funk.com) offers adequate protection because it requires authentication into a network. Additionally, Vernier Networks (www.verniernetworks.com) solutions, which will be implemented in SMCs wireless security products, offer more than adequate protection.

Sure, there are risks, as with everything, but wireless with 802.11 can be secured at least as well as the company office door.

Is lack of security holding you back? Write to me at john_taschek@ziffdavis.com.

 
 
 
 
As the director of eWEEK Labs, John manages a staff that tests and analyzes a wide range of corporate technology products. He has been instrumental in expanding eWEEK Labs' analyses into actual user environments, and has continually engineered the Labs for accurate portrayal of true enterprise infrastructures. John also writes eWEEK's 'Wide Angle' column, which challenges readers interested in enterprise products and strategies to reconsider old assumptions and think about existing IT problems in new ways. Prior to his tenure at eWEEK, which started in 1994, Taschek headed up the performance testing lab at PC/Computing magazine (now called Smart Business). Taschek got his start in IT in Washington D.C., holding various technical positions at the National Alliance of Business and the Department of Housing and Urban Development. There, he and his colleagues assisted the government office with integrating the Windows desktop operating system with HUD's legacy mainframe and mid-range servers.
 
 
 
 
 
 
 

Submit a Comment

Loading Comments...
 
Manage your Newsletters: Login   Register My Newsletters























 
 
 
 
 
 
 
 
 
 
 
Rocket Fuel