eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Wireless broadband Internet access via hotspots is convenient for both the casual surfer and the Internet-dependent teleworker. Unfortunately, current security technologies integrated into wireless LAN products offer insufficient protection here, and mobile users must be wary when accessing the central company network via a hotspot.
What is necessary is a security solution that protects the teleworkers’ place in all phases of connection construction on hotspots-without risky, foreboding configurations and without the help of users or administrators. This article will illuminate the effectiveness of VPN security mechanisms, data encryption, strong authentication and personal firewalls. Plus, it will show how optimal protection can be achieved by dynamically integrating each of these technologies.
Risks in the WLAN
Each user can access public WLANs with correspondingly equipped terminals. The terminals automatically obtain an IP address, in the sense that they recognize the SSID (service set identifier) of the WLAN. Thus, they put themselves within range of the access points and are able to gain access permission onto the WLAN. Data security, or protection of participating devices from attacks, is not guaranteed by the WLAN operator. Security is limited to monitoring authorized network access in order to eliminate misuse of the server administration. User identification serves solely for the acquisition and the accounting of time online.
However, how does it look regarding the protection of sensitive information during data transmission? How can the PC optimally seal itself off from attacks from the WLAN and the Internet? Because the actual security risk on the hotspot originates from having to register with the operator outside the protected area of a VPN, as a rule it has to take place by means of the browser. During this time frame, the terminal device is unprotected. This stands in opposition to a company security policy that prohibits direct surfing on the Internet and that only permits certain protocols.
Basically, VPN mechanisms and data encryption serve to protect confidentiality. The corresponding security standards are IP Security tunneling and AES (Advanced Encryption Standard) encryption for data, and X.509 v3 for access protection. Additional security mechanisms such as certificates in a PKI (public-key infrastructure) or onetime password tokens complement or replace the usual user ID and password. A personal firewall offers the required protective mechanisms against attacks from the Internet and from the public WLAN. Here, stateful packet inspection is critical. If this is not provided, it is not advised to use a hotspot for mobile computing.
VPN client and external personal firewall
For a VPN solution with a separately installed firewall, the ports for HTTP/HTTPS data traffic to the personal firewall must be activated during hotspot registration. This can take place in three different ways:
1. The firewall rules for HTTP/HTTPS are firmly preconfigured in order to guarantee the functionality with the desired hotspots.
2. The configuration allows that the ports are opened for HTTP/HTTPS as needed for a certain time window (such as 2 minutes).
3. The user has administration rights and independently changes the firewall rules.
In all three cases there exists the risk that the user may surf outside of the secure VPN tunnel on the Internet and encounter destructive software such as viruses, worms or Trojans. Temporarily opening the firewall creates the danger of deliberate misuse by the user on the basis of multiple actuations of the time window. If the personal firewall fundamentally permits no communication outside of the configuration, then the user has to activate the corresponding firewall rules for the duration of registration on the hotspot. This requirements-based opening of the personal firewall involves the greatest risk of misconfigurations. The user must have a firm grasp of the exact changes being made and the exact environment in which they are made. Employee security awareness and technical know-how determine the security level quality.
A large security risk also exists when user data (user ID and password) is spied out externally on the hotspot during the registration process. With the aid of a notebook computer, a hacker can simulate both the hotspot and the WLAN SSIDs. If a user then registers on a hotspot, he does not land at the access point of the provider but rather on the notebook of the hacker. Because of the previously mirrored access point Web pages, the user assumes that he is authenticated on the hotspot. However, in reality, he is on the notebook of the hacker and his personal registration data is now exposed.
Providers always attempt to protect the hotspot registration pages through SSL (Secure Sockets Layer) processing (HTTPS), but that does not always succeed. For example, a user who arrives at a manipulated hotspot obtains the following report from the browser: “A problem exists with the security certificate on the Web site.” In the background of this report, the attacker has only recreated the hotspot registration page and does not use the original certificate. For the lay person, this may not be recognizable at first glance, and it is incumbent to him to decide whether or not he should trust the certificate. To avoid placing a user in the position of having to make this decision, the hotspot registration should flow transparently before construction of the VPN. A solution that has proven itself in practice is the so-called registration script that takes over the transmission of registration and the inspection of the certificate at the hotspot.
The requirements for the functionality of a personal firewall with mobile computing on WLANs are multilayered. They also apply to the critical phases during the registration and sign-off process on the hotspot. Requirements must be known at the earliest possible time and should be in place from system start. They also must remain when no VPN connection exists or when it has been deactivated. Furthermore, the user should be safeguarded against arbitrarily reconfiguring or completely shutting off the personal firewall.
VPN Client with Integrated Personal Firewall
The dilemma of system requirements may be resolved by a VPN solution with a client-integrated personal firewall. The advantage of the integrated variant is that a personal firewall and VPN client are functionally linked to one another. In a quasi-teamwork fashion, the existing firewall rule statements are dynamically activated with dependence on the network environment. Fundamentally, three situations may be differentiated: known networks, unknown networks and VPN networks.
Automatic recognition of the network takes place by validating different network factors. In friendly networks, permissive firewall rules apply as they do in public environments such as the hotspot. The personal firewall must work with intelligent mechanisms that guarantee a secure activation of network access via the browser, as well as a secure registration on the hotspot. The user chooses the menu point “hotspot registration” in the welcome area of a public WLAN. Subsequently, the VPN client automatically searches the hotspot and opens the Web site for registration in a standard browser. For example, after successful entry of access data and activation by the operator, the VPN connection can connect to the company headquarters and communicate as securely as it would in an office.
In this manner, the PC is accessible in the WLAN in no time. Plus, there are ports dynamically assigned for HTTP/HTTPS for registration and logging off the hotspot. During this time, only data traffic is possible with the operator’s hotspot server. Unnecessary data packets are refused. In this way, it is guaranteed that a public WLAN can use the VPN connection at the central data network and no direct Internet access can take place.
Inspection of security-relevant parameters
Another important component of the implementation of companywide security directives for mobile computing on hotspots is central management of client software. With central security management, the administrator also fundamentally determines the client’s firewall rules. It can enforce adherence in which the user allows no on-site possibility of an intended or unintended change. Additionally, further security-relevant parameters such as the status of virus protection programs, operating system patch status and software release of the VPN client must be inspected upon connection to the company network. Access to the productive network is only authorized after the clearance of all security risks.
Be secure with a personal firewall and user authentication
A prerequisite for secure remote access in WLANs is end-to-end security, with dynamic interlocking security technology. The use of a VPN client with an integrated, intelligent personal firewall and strong user authentication is state-of-the-art in this scenario. The firewall rules must automatically adapt to registering onto and logging off the hotspot. They must be inspected within the framework of an integrated endpoint security system with each connection. Only in this way can administrators and users be consistently sure that they are securely sealing off terminal devices and data, and signing off the company network.