How Much Wireless Security Is Enough?

This is a multiple-choice question: if people are so concerned about 802.11 wireless security, why have they deployed $1.5 billion worth of the stuff?

(A) Theyre idiots; (B) theyre ignorant; (C) they believe its secure enough; (D) they dont care.

The answer most likely is C, and, chances are, theyd be right, especially on limited-use deployments such as a home network. In a business, however, direct access to a corporate network can never be too secure, and 802.11 provides less-than-minimal protection. But its really not much different from cabled networks in that regard.

Think about it. Cables can be tapped. Authentication is usually based on who sits where at any particular workstation, and data access at the Layer 2 level is usually done simply by subnetting the network. The same issues have surfaced with wireless, but because it is a broadcast signal, the problems and security risks are exacerbated.

Recently, 802.11 has come under fire for inherent flaws—beyond the normal WEP flaws that were accustomed to—that may never be fixed. A paper published last month by University of Maryland computer scientists states that 802.11 “does not provide a sufficient level of security, nor will it ever without significant change.”

That paper diagrams two types of attacks: session hijacking and the man-in-the-middle attack, which is best described as wireless authentication forgery. The paper specifically attacks current 802.11 standards for authentication, but it also thrashes the more elaborate wireless proposals that include the Robust Security Network and RADIUS servers.

The RADIUS servers integrate with 802.11 via Extensible Authentication Protocol, or EAP, which itself has multiple facets. The University of Maryland paper challenges EAP but not necessarily its offshoots, EAP-TLS (Transport Level Security) and PEAP (Protected EAP).

I, for one, believe RADIUS (www.funk.com) offers adequate protection because it requires authentication into a network. Additionally, Vernier Networks (www.verniernetworks.com) solutions, which will be implemented in SMCs wireless security products, offer more than adequate protection.

Sure, there are risks, as with everything, but wireless with 802.11 can be secured at least as well as the company office door.

Is lack of security holding you back? Write to me at john_taschek@ziffdavis.com.