This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed.

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. NETW 05A: APPLIED WIRELESS SECURITY Functional Policy: Guidelines & Baselines By Mohammad Shanehsaz

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Objectives Explain the purpose and goals of the following wireless LAN security policies: Password policy User training On-going review ( auditing ) Acceptable use & abuse policy Consistent implementation procedure Centralized implementation and management guidelines and procedures

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Objectives Explain necessary items to include in the creation and maintenance of a wireless LAN security checklist Describe and recognize the importance of asset management and inventory procedures for wireless LANs Explain the importance of including wireless LANs in existing change management programs

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Functional policy Policy Essentials General Guidelines Baseline practices

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Policy Essentials Every security policy should implement the following topics : Password policies Networking staff and end user training requirement Acceptable use Consistent implementation / staging procedures Readily available implementation and management procedures Regular audits and penetration tests by independent professionals

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Password policies Passwords are the most widely used method of authentication and authorization; however there are number of ways to compromised it such as : Eavesdropping Dictionary attack against a network authentication server Borrowing a user password Easy to guess password Getting it from users who leave them out in the open ( the sticky note approach )

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Practicing good password procedures Use a password that is mixed case, has punctuation, and uses alpha and numeric digits Use something that can be remembered without being written down Force periodic password changes Lockout accounts after 5 unsuccessful login attempts Make sure all passwords are at least 8 characters in length Do not allow passwords to be reused

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Networking staff and end user training Network staff responsible for wireless LAN security need to understand many subject areas including intrusion techniques, wireless security policy, and solutions, in addition to having a solid grasp on basic wireless LAN functionality and technology. End user must have adequate training in order to properly implement security controls on their computers and that it only takes one person not following policy to create a large security hole that can be exploited by an attacker

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Acceptable use Wireless LANs are a half-duplex medium, therefore bandwidth intensive applications such as FTP, peer-to-peer file sharing, and streaming video should only performed over the wired LAN, otherwise it may cause DOS on APs with many stations To prevent this, there should be a section in the policy regarding acceptable use of the wireless LAN that define what scenarios constitute proper use as well as abuse

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Consistent implementation / staging procedures It is common for a network administrator to place a wireless LAN infrastructure device onto the network without having first staged and configured the device to meet the organization’s security policy, which is in effect like placing a rogue AP on the network, to battle this problem guidelines on how and when to stage and install devices should be part of functional policy

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Readily available implementation and management procedures It is important that network administrator have the information provided by the company security policy readily available so that they verify procedural steps while performing their daily tasks

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Regular audits and penetration tests by independent professionals In order to find security holes internal and external audits are a necessary part of wireless network security Internal audits will usually find most policy violation, but holes in security solution will usually require employing an independent wireless security professional It should be done unannounced

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. General Guidelines Wireless network segments should always be treated as unsecured means of data transit Follow the following rules when passing data wirelessly : Encrypt email Use HTTPS for web logins where possible Use SSH2 instead of telnet where possible Use secure FTP (SSH2 or SSL) for file transfers Verify the latest operating system updates or service packs are installed

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Security checklist It is advisable to make security checklists for use by network administrators that includes the following items: Access point and bridge configuration settings Client-side software installation and settings Physical security when mounting access points and bridges End user security solution training

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Available Network Resources Since wireless LANs present security risk, that added risk may be significantly reduced by eliminating the availability of certain services to wireless segment

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Asset Management Since enterprise class wireless LAN hardware can be quite expensive and since much of it is very small and lightweight, this equipment can be easily stolen if not secured, for this reason it is necessary to record all the wireless hardware for periodic inventory, and employee should be required to sign for the hardware they receive

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Periodic Inventory It is a good practice to periodically check infrastructure devices to make sure they are both present and are the correct unit In large organizations, this type of inventory might be impossible, so other solutions might have to be implemented

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Change Management Wireless LANs should be a part of the existing corporate change management procedures There are two things to consider: First the security policy itself should be periodically evaluated for relevance and modified when necessary second once a secure wireless is in place, any changes to it should be documented and approved by corporate authorities

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Spot-checks & Accountability Some of the most effective methods for ensuring properly implementing wireless LAN security may include: Thoroughly training end-users Spot checking for internal policy adherence Tying adherence and enforcement of policy to departmental compensation

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Baseline practices SSIDs MAC filters Static WEP Default Configuration settings Firmware Upgrades Rogue Equipment Outdoor Bridge Security RF Cell Sizing SNMP Community Strings

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Baseline practices continue Discovery protocols Remote Configuration Client Security IP Services Switches vs. Hubs Staging and Testing Equipment Installation

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. SSIDs The default SSID should be changed on all access points, to something cryptic and not something that could be used to determine the company to whom the AP belongs By default an AP broadcasts SSID, by not broadcasting SSIDs in beacons “Closing the system “ prevents intruders from passively locating the network

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. MAC Filters MAC address filtering is another method by which the IEEE 802.11 task group attempted to secure wireless networks, traffic is allow or deny based on MAC address It is both simple and common for a hacker to spoof the MAC address of another NIC

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Using Static WEP Static WEP may be appropriate for SOHO environment, but not for enterprise WLAN When implemented the largest key size available that is supported by the hardware should be used When static WEP is used, strong keys should be created that are unrelated to the following: Organization’s name, address, or phone number Wireless LAN’s SSID Access points’or bridges’ model number(s) or manufacturer’s name Manufacturer default WEP keys

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Default Configuration settings The default configuration settings on all APs should be changed, since an infrastructure reconfiguration attack can occurs if an attacker obtain management access To prevent attack the default username and password should be changed on all infrastructure devices

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Firmware Upgrades Firmware upgrades can provides new security functionality as well as bug fixes or security patches Firmware should be upgraded for the following devices: Access points Wireless Bridges Client devices Client or Workgroup Bridges Enterprise Wireless Gateways Enterprise Encryption Gateways

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Firmware Upgrades It is a good practice to test end-to-end functionality in a lab environment prior to rolling it out enterprise wide Firmware upgrades are suggested in order to gain the following features: TKIP (or similar key rotation protocol) support Kerberos support 802.1X/EAP(-TLS,-TTLS,-LEAP,-PEAP)support WPA compliance Advanced Encryption Standard (AES) support VPN support Rogue access point detection RADIUS or LDAP support Role-based access control

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Rogue Equipment Anytime rogue equipment is present in a network, the incident should be considered a serious breach of network security Eliminating rogue wireless equipment is a multi-step process which includes: Setting Corporate Policy Regarding Rogue Equipment Network Administrator Training Help Desk & End User Training Intrusion Detection Systems & Audits

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Outdoor Bridge security Outdoor WLAN bridge links may often span miles, this can allow an intruder the opportunity to remain undiscovered Bridges may act as both a bridge and an access point simultaneously, if possible client connectivity at the bridge should be disabled Clear text transmission should not be allowed to pass between bridges at any time. Wireless bridge installation can be compromised through rogue bridges

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Outdoor Bridge security Wireless bridge installation can be compromised through rogue bridges, which can be placed onto the network at a range of several miles To overcome this a good security must be chosen and implemented

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. RF Cell Sizing Accurate cell sizing can aid in preventing war drivers from being able to locate your network You can limit cell by reducing the output power of the access points and antennas After WLAN configuration administrator should attempt a footprint analysis to determine how easily the network can be targeted using omni and directional antennas

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. SNMP Community Strings SNMP community strings should be changed or disabled, because default read and write passwords are clearly documented in users manual Disable SNMP access if it will not be used, if used set the read and write community strings to complex, non-default values that are not related to network’s SSID, WEP, or organizational information Disable SNMP access from outside by using ACL or firewall filtering

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Discovery Protocols When discovery protocols (such as CDP) are not in use they should be disabled

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Remote configuration If manufacturer feature sets allow for it, configure APs and bridges so that they cannot be configured over wireless network segment, to prevent compromising authentication information, unless the wireless link is encrypted

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Client Security Wireless security policy should limit any sensitive data on the client machines that could damage the organization Shared folders should be limited or even prohibited on wireless client machine Using corporate PCs without protection on public access wireless networks are prohibited There are many tools such as personal firewalls, VPN technologies such as, IPSec, that can be used to protect wireless clients Make sure that clients don’t use unsecured wireless AP to VPN to corporate network

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. IP Services First step in securing IP services is to heighten general awareness of the possibility of rogue IP services such as DHCP servers. Use data-link security mechanisms such as 802.1X/EAP solution to authenticate user prior to receiving an IP address Earmarking IP ranges for WLAN segment is another way to speed location of hacker and to ease network management

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Switches vs. Hubs Using switches to connect to the wired segment has the following benefits: Support for security and network management tools such as VLANs Support for 802.1q VLAN tagging SSIDs are tied to VLANs as means of logically separating groups of wireless users Allows for segmented network design and secure management over a particular VLAN Allows for full-duplex connectivity. Hubs broadcast every frame to all ports, so hacker can see all the traffics

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Staging and Testing Staging and testing should occur prior to deployment, wireless infrastructure devices should be staged and configured in an isolated environment for a secure deployment Administrator should use approved security configuration checklists to assure that no security holes are created due to lack of following configuration procedures

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Equipment Installation To prevent theft of wireless network equipment, devices should be: Mount out of reach Bolted down or secured in locked steel boxes Kept out of plain site

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Summary Guidelines and baselines of the functional policy was discussed Policy cover password policies, training, usage, implementation and staging, procedures and audits General guidelines cover the security checklist, available network resources, asset management, change management, and spot-checks and accountability

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Summary Baseline practices consist of several strategic areas such as a basic SSID changes, MAC filtering inadequacies, WEP versus EAP/802.1x solutions, detecting rogue equipment, and wireless bridge security, that must be considered when implementing the wireless LANs

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect those of the National Science Foundation. Resources CWSP certified wireless security professional, from McGrawHill

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed.

Similar presentations

Presentation on theme: "This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed."— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed.

Similar presentations

Presentation on theme: "This work is supported by the National Science Foundation under Grant Number DUE-0302909. Any opinions, findings and conclusions or recommendations expressed."— Presentation transcript:

Similar presentations

About project

Feedback