802.11 wireless LANs (WLANs) have become mainstream. Sales by U.S. resellers are growing rapidly. But - despite glowing forecasts - those sales may hit a plateau unless security questions are addressed.
Remember how the specter of credit-card security haunted e-commerce? The same thing is happening in wireless networking; offering the potential to stall demand and delay acceptance by the most demanding (and most profitable) clients.
What's the issue? Wireless LANs are vulnerable to eavesdropping and unauthorized access. The problem, says Chris Klaus, CTO of security firm ISS, is compounded by the proliferation of "rogue" WLANs: ad hoc setups in homes, on-the-cheap "semi-public" WLANs installed in shared office and rental space, unsanctioned WLANs in the enterprise. Rogue WLANs are rarely secured, and may compromise the security of conventional LANs to which they're attached.
Given this trend, it makes sense for resellers to avoid contributing to the proliferation of rogue WLANs, wherever practical. The most straightforward way of doing so - if customers are willing - is to package security as part of every wireless LAN engagement.
At present, the best way to secure a WLAN is to run a VPN across it. VPN technology - available from vendors like Cisco, 3Com, Agere and others - exploits encryption and tunneling to render network communications secure, regardless of the physical security of network segments. If your customer has a VPN set up, it may be possible to extend it to the new 802.11 wireless LAN you're installing. Building a full-scale VPN just to protect a small wireless network, however, may not be cost effective.
Bluesocket (Burlington, MA - 781-328-0888, www.bluesocket.com) offers a point solution in their WG-1000 Wireless Gateway, which provides for WLAN security without any changes to existing hardware or user software. "The WG-1000 gateway supports low, medium, and high access control methods and the method can vary from role to role," outlined David Juitt, chief security architect. "Data can be tunneled from the wireless device to the WG-1000 using standard industry tunneling protocols built into may popular operating systems so no additional software is needed on client devices."
Even if your client is running a standard VPN, that may not be the best solution for securing mobile assets. Regular VPN technology doesn't know about roaming, and will typically disrupt a session if a laptop owner moves from one 802.11 segment to another.
Ecutel Inc. (Alexandria, VA - 703-998-2588, www.ecutel.com) makes a wireless VPN, Viatores, that solves this problem. Viatores was developed under contract to the Department of Defense, to electronically exchange sensitive, mission-critical information between soldiers in the field; and is now in its first commercial release (v. 3.0). Ali Ershied, director of product marketing, says: "A legacy VPN takes away from the convenience of mobile computing. Viatores' VPN technology lets users roam from wired to wireless and between different wireless networks. The product includes an option for secure and seamless roaming from public networks." HP has already begun selling the product in Europe and other major players have recently come on board.
Resources
802.11 incorporates its own, built-in access control, data integrity and privacy subsystem, called WEP (Wired Equivalent Privacy). Learn more about it at www.ieeeusa.org.
WEP employs an RC4 strong encryption algorithm, developed by Ron Rivest of RSA Data Security (Bedford, MA - 877-RSA-4900, www.rsasecurity.com) in 1987. RC4 is a powerful algorithm - read more about it at www.encryption.com/rsalabs/faq/3-6-3.html. Unfortunately, WEP's developers implemented RC4 in a way that experts believe undercuts its security.
A widely publicized analysis of WEP's security was performed by a team of researchers at the University of California at Berkeley (www.isaac.cs.berkeley.edu/isaac/wep-faq.html). Read what they said.
Check out www.bluesocket.com/maginotLine.html to learn why Bluesocket takes a dim view of 802.11's WEP security subsystem.
To test your wireless security knowledge, check out www.iss.net/wireless/.
