SOHO Security Recommendations

Change default user/password Of the AP/router Typical  admin – admin  root – root  root – 1234  Admin - There are web site with this information Strong password  14 characters letters, numbers and symbols …… at least  Change it every 3 months ……. at least

Change the default SSID Service Set Identifier  Identifies the Wireless LAN The router has one from factory  LINKSYS6557  PRODIGY-2341  WIRENET4536 They give away mark/model  A search in google will give manufacturer and model  And configuration commands Eight characters long, minimum Alphanumeric and symbols Change the name “often”

Disable SSID broadcast Better to be anonymous  The attackers do not know of your existence They know there is network but the don't know the name The beacon frame carries the SSID

Enable WEP encryption …. at least WEP is not the best, but … it's better than not to have anything at all

Do not allow remote access Do not access your router remotely over the Internet  It is the default  Web server in the router (embedded) is dangerous If it is really needed  SSH or VPN (configure NAT)

Do not use default IP ranges Typical addresses are well known Network , Assign new ones manually The attacker will know less about your network Less information → more work OR Disable DHCP

Change the AP default IP address Everyone knows  , , , It is the most important device in your network  Hide its IP address

Logout after any configuration Logout from the router Some attacks work if an account is still authenticated  CSRF (Cross Site Request Forgery)

Do not enable WPS Wi-Fi Protected Setup Very easy to set up clients and repeaters But lately known flaws make it easier for attackers to find out your password

Enable MAC filtering Every one can enter the network If they cannot enter they cannot do anything They cannot receive anything Besides encryption not instead of But sometimes is the only viable solution  Big companies  ITESM

Adequate AP location Maximize internal reception  Get to every machine Minimize external reception  Machines from the outside cannot receive aproper signal

Enable the firewall You have MAC/IP addresses and port numbers  ……. and more Design good rules The AP/router is the first point of defense  And sometimes the only one

Monitor and Log Monitor wireless traffic  To identify unauthorized activity  WIDS  Review the logs Check for unknown devices Enable router logging  Device access, intrusions, attacks, etc Review the logs…………….periodically

Disable UPnP Universal Plug and Play Allows the discovery among devices and establish connections for data sharing Intended for residential networks  Connections from and to the Internet  Seamlessly Can you live without P2P?

Utilizar i Much more robust than WEP It is alittle more complicated (?), but ….....

Turn off the network when not in use Disable DMZ Disable unnecessary services Disable PING response

Don’t forget to update your router firmware PERIODICALLY