Center of Excellence Wireless and Information Technology CEWIT 2003 Keys To Secure Your Wireless Enterprise Toby Weiss SVP, eTrust Computer Associates International

Center of Excellence Wireless and Information Technology 2 CEWIT 2003 Agenda Overview of Wireless Networks Security Issues Keys to a Secure Wireless Environment

Center of Excellence Wireless and Information Technology 3 CEWIT 2003 Wireless Networks Today WPAN (Wireless Personal Area Network) –Bluetooth WLAN (Wireless Local Area Network) –802.11b, a,g,i,… WWAN (Wireless Wide Area Network) –Through wireless operators using GPRS, CDMA, etc.

Center of Excellence Wireless and Information Technology 4 CEWIT 2003 Wireless Enterprises WWAN WLAN Existing Infrastructure

Center of Excellence Wireless and Information Technology 5 CEWIT 2003 Wireless LANs Wireless ethernet Wireless access point (AP) connected to a desktop or server or an existing network Mobile devices with compatible network cards are required

Center of Excellence Wireless and Information Technology 6 CEWIT 2003 IEEE WLAN Specifications Specification FrequencyThroughput Range (in meters) b2.4 GHz11 MB/sec50 – a/h5 GHz54 MB/sec~ g2.4 GHz54 MB/sec50 – 100

Center of Excellence Wireless and Information Technology 7 CEWIT 2003 Hotspots Public Access WLANs The ones you find at airports, hotels, and other public places On the rise, but still many issues to deal with –Billing –Roaming –Security

Center of Excellence Wireless and Information Technology 8 CEWIT 2003 WWANs Service offered by wireless operators like Vodafone, NTT DoCoMo, Verizon Wireless, Cingular and others Data transfer over cellular networks Cover global geography Use technologies like GPRS, CDMA, and others

Center of Excellence Wireless and Information Technology 9 CEWIT 2003 What’s Available Today Most infrastructure is either 2G or 2.5G, not quite 3G yet 3G promises throughputs of: –~384 Kbps for semi-stationary devices –~128 Kbps when in a car –~ 2Mbps in fixed applications

Center of Excellence Wireless and Information Technology 10 CEWIT 2003 The #1 Barrier Security is the #1 issue for enterprises deploying wireless environments

Center of Excellence Wireless and Information Technology 11 CEWIT 2003 Network Security Integrate with existing infrastructure Rogue access points Vulnerable WLANs –Intrusions Sniffing Spoofing Session hijacking Man in the Middle –Obstructions Jamming Denial-of-service –War-driving, war-chalking

Center of Excellence Wireless and Information Technology 12 CEWIT 2003 Too Much Soup & Chips Build-it-yourself Wi-Fi antenna amplifiers a.k.a. “Cantennas” Pringles can (5 miles) Campbell’s Soup can (7 miles) Instructions available on the Web

Center of Excellence Wireless and Information Technology 13 CEWIT 2003 Nothing Better To Do?

Center of Excellence Wireless and Information Technology 14 CEWIT 2003 WLAN Security WEP (Wired Equivalent Privacy) –Provides encryption based on RC-4 cipher WPA (Wi-Fi Protected Access) –Uses dynamic keys and advanced encryption 802.1x –Provides authentication using EAP (Extensible Authentication Protocol) i –Advanced encryption and authentication

Center of Excellence Wireless and Information Technology 15 CEWIT 2003 Wireless Encryption (WEP) RC4 40 Bits 0.7 Seconds GSMA5 56 Bits (NATO) 12 Hours Time To CrackKey Length AlgorithmSystem 40 Bits (friendly) 0.7 Seconds 0 Bits (world) 0 CDMA One 96 Bits (US) 1.5 Billion Yrs 32 Bits (world) 2.6 milliseconds Oryx UMTSKasumi 128 Bits 6.5 million trillion years (TKIP Or WPA) RC4/Kerberos 128 Bits 3 Seconds Example Open Source Utilities: WEPCrack (Perl), Airsnort (Linux)

Center of Excellence Wireless and Information Technology 16 CEWIT 2003 Device Security Protection of mobile information Configuration control Virus attacks Recovering from the effects of lost and stolen devices

Center of Excellence Wireless and Information Technology 17 CEWIT 2003 User Security Integrate mobile users into existing security policies Context-based access control Identity management Authentication Provisioning Location-based security

Center of Excellence Wireless and Information Technology 18 CEWIT 2003 Security Best Practices Get your wired security in order first Take an enterprise-wide perspective Define clear goals and security policies for your wireless environment –Networks –Devices –Users Identify and audit the wireless users Research the technology thoroughly and choose what best meets your business objectives Partner with trusted business and technology advisors

Center of Excellence Wireless and Information Technology 19 CEWIT 2003 Basic WLAN security Use WEP or AES for encryption Maintain an updated MAC list Do not broadcast the SSID If you can, don’t use DHCP for wireless devices Use WPA so that the keys are dynamically rotated Use 802.1x to authenticate your users Require WLAN users to log in through VPN

Center of Excellence Wireless and Information Technology 20 CEWIT 2003 Take No Chances

Center of Excellence Wireless and Information Technology 21 CEWIT 2003 CA’s Wireless Solutions eTrust ™ Antivirus eTrust ™ Admin eTrust ™ Intrusion Detection eTrust ™ Web Access Control eTrust ™ Security Command Center CleverPath ™ Portal BrightStor ® Mobile Backup ManageDeliverSecure Storage Unicenter ® Wireless Network Management Option Unicenter ® Asset Management Unicenter ® Software Delivery Unicenter ® ServicePlus Service Desk

Center of Excellence Wireless and Information Technology CEWIT 2003 Keys To Secure Your Wireless Enterprise Toby Weiss SVP, eTrust Computer Associates International