Perceptions of Wi-Fi Security Requirements: A Stratified View Merrill Warkentin Xin (“Robert”) Luo Mississippi State University

The authors Samuel Luo !

Overview Growth in Access Points – the problem Existing and emerging protocols Security threats Perception of Wi-Fi security threats Research plan Discussion

Access Points Found (Worldwide Wardrive,2004) Total AP found in WWD4: 228,537 1 = Sept = June 2004

Existing & Emerging Protocols , a, b, g Four standards for Wireless LANs Ranging from 1M to 54M bit/sec. EAP – Extensible Authentication Protocol e QoS (quality of service) h Power usage and transmission power n Improve the bandwidth f inter access point s Mesh networking r fast roaming

Security Protocols: WEP and WPA WEP relies on unchanging, shared encryption keys addresses confidentiality instead of authentication WPA (early version of the i) includes Temporal Key Integrity Protocol (TKIP) and 802.1x mechanisms provide dynamic key encryption and mutual authentication poorly chosen short human-readable passphrases can be cracked with a robust dictionary attack offline and without access to the network.

Interoperable Protocols Interoperability problem Cisco’s proprietary version of 801.1x authentication--the Lightweight EAP (LEAP)  doesn’t function with a variety of hardware clients Protected EAP (PEAP)  combining an administrator-specified authentication and confidentiality protocol with EAP Adoption problem most organizations reluctant to embrace standards that have yet to be standardized

Security Threats Viruses and Trojans Eavesdropping Man-in-the-middle attacks Denial of Service attacks

Top Seven Security Problems 1. Easy Access 2. Rogue Access Points 3. Unauthorized Use of Service 4. Service/Performance Constraints 5. MAC Spoofing, Session Highjacking 6. Traffic Analysis and Eavesdropping 7. Higher Level Attacks Source: Bitpipe

IEEE i Security Protocol ratified in June 2004 WPA2 with Advanced Encryption Standard (AES) address all known WEP deficiencies via a new mode called CCM provide confidentiality and integrity bring stronger encryption reduce key management overhead minimize the time spent computing key schedules (Cam-Winget, 2003)

Wi-Max broadband wireless connections over long distances used for "last mile" broadband connections hotspot and cellular backhaul high-speed enterprise connectivity based on IEEE standard provides metropolitan area network connectivity at speeds of up to 75 Mb/sec can transmit signals as far as 30 miles (average = 3-5 miles) Source: Intel

Stakeholder Groups executive-level (top) management IT Directors (CIO, CSO, Netword Admins) staff, end users other stakeholders? (external) Research Question: “Do they have the same perceptions of Wi-Fi security?”

Perceptions of Wi-Fi Security Is it safe? Who can read? How to use? Each stakeholder group has influences. Who views as secure? How does this influence actions?

Research Plan investigate similarities and dissimilarities in terms of perception of wireless security issues among stakeholder groups discuss implications of any differences research methodology lit review, develop research hypotheses survey – pilot study (at MSU)  deans, directors, IT directors, faculty, staff, students survey – hospitals, hotels, cafes, etc.

Stakeholder Discussion