Wireless IDSes Defend Your Airspace

eWEEK Labs advises every enterprise that is considering deployment of a wireless network or maintaining an existing one to seriously consider investing in a wireless intrusion detection system. A wide variety of these products stands ready to help identify and troubleshoot security and performance issues related to wireless technology.

However, based on our tests of a range of these solutions, we believe companies should carefully assess their wireless security needs because their existing infrastructure devices may already fulfill them.

Wireless IDS solutions range from handheld products that are designed for on-the-spot troubleshooting at a point in time, to capabilities integrated into existing access points and managing switches, to distributed fleets of sensors that provide round-the-clock coverage.

In tests, weve found that defensive overlay networks, such as those from AirMagnet Inc., AirDefense Inc. and Network Chemistry Inc., provide best-of-breed capabilities. Defensive overlay products enable a host of security and performance monitoring capabilities and have strong policy options that alert administrators to any signs of trouble.

Defensive overlay network vendors are rapidly adding features that not only alert but also can be configured to isolate and block wayward connections over the wire or over the air. These vendors also are increasingly tuning their products to use location findings to make policy decisions.

Click here to read about how CBK, a wholesaler of home accents, is using AirMagnets overlay product to detect unauthorized intrusions and shut down rogue access points.

Despite recent reports of vulnerabilities in the RADIUS (Remote Authentication Dial-In User Service) authentication mechanism upon which 802.11i is based, 802.11i goes a long way toward equalizing the security of known, managed devices on wireless networks and on wired ones. 802.11i does so by delivering strong standards-compliant encryption via AES (Advanced Encryption Standard) and port-based 802.1x authentication to WLANs (wireless LANs).

Click here to read more about 802.11i.

However, many threats remain outside the scope of 802.11i, including access points and client nodes that are loosely maintained (or are completely outside ITs control). Poor configuration practices and unauthorized usage can lead to fundamental network headaches or nefarious intrusions.

The threat of rogue access points has been well-publicized. Employees installing their own unsecured access points on a corporate network leave a wide-open vector for LAN attacks that bypass network firewalls and wireless security measures implemented by IT.

But misconfigured and unsecured client devices also represent a significant threat. With the proliferation of WLAN hot spots and wireless devices in the home, users are leveraging their wireless connections in a multitude of locations. To ease migration between these disparate networks, WLAN client configurations are often left in a default—and insecure—state. When first enabled, the clients probe constantly for open WLAN networks, often attaching to nearunknown access points without user knowledge or interaction.

Man-in-the-middle attacks exploit these circumstances. A simple sniff of the air can determine a clients network name and channel information, allowing a hacker to similarly configure a rogue access point. A spoofed deauthentication packet gets the wireless client to drop its association with its known access point, and the client can then associate with the rogue, allowing an intruder to potentially capture data and passwords. If bridging between the WLAN and Ethernet adapters is enabled on this client, the two networks are suddenly connected, bypassing network perimeter security.

In tests, eWEEK Labs has encountered interesting results from a misconfigured client bridging the internal wired network and an unknown wireless network. Weve witnessed other wired clients receiving their DHCP (Dynamic Host Configuration Protocol) address from the remote wireless networks server. Weve also seen the offending client used as a launching pad for attacks on the protected network.

Wireless IDS products must effectively patrol the airwaves for unknown access points and open client connections. Preferably, the solution should be able to determine whether a rogue is connected to the protected network or is simply occupying the same airspace, and it should also provide the granularity of policy definition to be able to define legitimate connections and be alert for those that arent.

Next page: Hardware closes the gap.