https://www.computerweekly.com/feature/How-to-secure-a-wireless-Lan
Stuart Okin and Ian Hellen at Microsoft UK give their opinion on how
different forms of data encryption can protect wireless Lan users and corporate data from unwelcome
snoopers
After more than a decade of unrealised promises, wireless networks are finally here. At home, in
the workplace, at public hotspots in hotels, airports, coffee bars and trains, wireless local area networks
pervade our world. Although WLans are providing organisations with unprecedented ease of access
to network data and services, are they safe to use? Too often the answer is no.
Many WLan deployments in businesses and homes are not secure. To compound matters, the basic
security defined in the Institute of Electrical and Electronics Engineers 802.11 WLan standards -
known as Wired Equivalent Privacy - is badly flawed in both concept and implementation. WEP was
designed for a more innocent age; one where viruses and hackers were a more distant threat than in
today's hostile cyberworld. Basic WEP protection of a WLan can now be broken in a matter of hours
with readily available tools and relatively little technical knowledge.
Although most of the security community agree that basic WEP is inadequate, there is not such clear
agreement on what is the best way to secure a WLan.
How to secure small wireless networks
The options available depend on the type of organisation you are trying to protect. In home
networks and small offices the cost of a sophisticated network security system is often not
financially viable. Until recently, the only option for smaller businesses was to use basic WEP
security and hope for the best.
The Wi-Fi Alliance - the industry consortium that governs wireless compatibility standards - has
produced a wireless security standard called Wi-Fi Protected Access. WPA includes an option to use
a simple shared key, or password to control access to the network. Unlike the use of a shared key
in WEP, WPA is not vulnerable to the same attacks. Because of its simplicity, it is ideal for
smaller installations of a few computers.
To use WPA in this mode, called a pre-shared key mode, wireless access points, network interface
cards and client operating systems all have to support WPA. Many Wi-Fi suppliers have released
firmware upgrades for their access points and network interface cards, which are published on their
websites. If you are buying new equipment, look for WPA support before you buy.
How to secure larger networks
Using WPA pre-shared keys becomes difficult to manage in networks with more than a few access
points or more than 100 users but there are several options for larger installations.
Although basic WEP has been discredited as a viable solution for corporate WLans, the WEP
encryption capabilities of existing network hardware can be leveraged to produce a robust security
solution. Using an IEEE protocol called 802.1x, users of the WLan can be securely authenticated
using either public key certificates or per-user passwords. Either of these methods give a much
higher level of security than basic WEP shared passwords.
Authentication by 802.1x requires the use of the Radius (Remote Authentication Dial-In User
Service) protocol and an authentication database such as Active Directory. Radius is a radio
frequency control standard implemented by a consortium of large suppliers.
Using 802.1x and Radius gives the ability to rapidly and automatically update the encryption keys
used to protect network data on the WLan. This removes the vulnerabilities of WEP while using the
same network hardware.
WPA provides stronger forms of data encryption and key management than existing WEP hardware and
can be used with Radius and 802.1x authentication to provide high-grade WLan security. WPA will
require firmware upgrades for network hardware and support for WPA on client computers.
A standard known as Robust Secure Networking is tipped to supersede WPA. RSN, otherwise known as
802.11i, is in the final stages of standardisation by the IEEE. It is essentially a superset of WPA
and promises to deliver higher levels of security.
Alternatives to WLan native security
Prior to the arrival of solutions based on 802.1x and WPA, analysts and suppliers proposed
solutions using virtual private networks or proprietary security schemes. Although these addressed
many of the security problems of early WEP security, they often proved to be expensive and
cumbersome to implement. With the advent of WPA and RSN, their future seems limited.
Security at public wireless hotspots
Commercial public wireless sites, known as hotspots, have appeared in airports, hotels, coffee bars
and numerous other locations. Although these are convenient, there are no standards and no
guarantee of security. Special precautions should be taken:
Stuart Okin is chief security strategist and Ian Hellen is principal consultant for the security solutions team at Microsoft UK. Okin will be speaking at Enterprise Wireless Technology 2003 at London's Olympia 2 on 19-20 November
13 Nov 2003