Securing Wireless LANs A Windows Server 2003 Certificate Services Solution Ian Hellen – Principal Consultant Stirling Goetz – Principal Consultant

Agenda Introduction to Solutions for Security Introduction to Solutions for Security Wireless LAN Security – selecting the right option Wireless LAN Security – selecting the right option Solution Architecture Solution Architecture RADIUS Design RADIUS Design PKI Design PKI Design Solution Guidance Solution Guidance

Trustworthy Computing Microsoft is committed to Trustworthy Computing: Microsoft is committed to Trustworthy Computing: Security Security Privacy Privacy Reliability Reliability Business Integrity Business Integrity Trustworthy computing can only be achieved through partnership & teamwork Trustworthy computing can only be achieved through partnership & teamwork Trustworthy Computing is a journey with a long term vision and highlights and obstacles along the road Trustworthy Computing is a journey with a long term vision and highlights and obstacles along the road

Trustworthy Computing Security Privacy Reliability Business Integrity Resilient to attack Protects confidentiality, integrity, availability and data Dependable Available when needed Performs at expected levels Individuals control personal data Products and Online Services adhere to fair information principles Vendors provide quality products Product support is appropriate

Microsoft Solutions for Security (MSS) Aimed at complex or difficult problem areas Aimed at complex or difficult problem areas Prescriptive guidance – one good way Prescriptive guidance – one good way Based on experience in field and from MS internal deployments Based on experience in field and from MS internal deployments Built and Tested in MS Labs Built and Tested in MS Labs Modular (PKI and RADIUS) Modular (PKI and RADIUS)

Wireless LANs Benefits of WLANs Benefits of WLANs Increased staff productivity Increased staff productivity Mobility and flexible working Mobility and flexible working Information access with lower cost Information access with lower cost Problems Problems Early security standards had issues Early security standards had issues Some people dont even take basic precautions Some people dont even take basic precautions Proliferation of solutions cause confusion Proliferation of solutions cause confusion

Solution Options 802.1X with WLAN protection 802.1X with WLAN protection The native route The native route VPN or IPsec VPN or IPsec Dont deploy WLANs Dont deploy WLANs But prepare for rogue WLANs But prepare for rogue WLANs Use basic security Use basic security …and hope for the best …and hope for the best

802.1X with WLAN protection 802.1X 802.1X Ratified by the IEEE Ratified by the IEEE Embraced by the WLAN vendor community Embraced by the WLAN vendor community EAP-TLS EAP-TLS Strong credentials Strong credentials Mutual authentication Mutual authentication WLAN encryption key generation WLAN encryption key generation WLAN security WLAN security WEP (128 bit) and WPA (TKIP) WEP (128 bit) and WPA (TKIP) Pending: TGi work on RSN (802.11i) Pending: TGi work on RSN (802.11i)

WLAN Solution Architecture RADIUS Infrastructure Services PKI

Head Office Branch Office Solution Design

Scaling & Extension Scale Up Scale Down VPN Wired 802.1X

RADIUS Architecture Scale up or out

RADIUS Placement

PKI Architecture

Securing Wireless LANs Guidance Planning guide Planning guide Build guide Build guide Operations guide Operations guide Test guide Test guide Delivery guide Delivery guide Tools and Templates Tools and Templates

More Information… Download Securing Wireless LANs from: Download Securing Wireless LANs from: Microsoft Solutions: Microsoft Solutions: For a copy of this presentation visit: For a copy of this presentation visit: For regular information subscribe at: For regular information subscribe at: subscribeMe.asp?lcid=1033&id=155 For the MS security resource toolkit visit: For the MS security resource toolkit visit:

Additional URLs ?url=/technet/itsolutions/msm/swdist/pmsmsog.asp ?url=/technet/itsolutions/msm/swdist/pmsmsog.asp

Microsoft - Stand 670 Firewall and VPN Firewall and VPN Identity Management Identity Management Securing Windows Securing Windows Windows Server 2003 Security Windows Server 2003 Security Wireless LAN Security Wireless LAN Security

Microsoft Security Seminars

Call to action 1. For a copy of this presentation visit: 2. For regular information subscribe at: register.microsoft.com/subscription/subscribeMe.asp?lcid=1033&id= For the Microsoft security resource toolkit visit:

Questions? Visit the Microsoft stand. Well be there for 1 hour after this session. Thank You!

Trustworthy Computing Stirling Goetz – Principal Consultant Ian Hellen – Principal Consultant