1. Hosted by IDS for WLANs The Mansfield Group, LLC 802.11 Security for Enterprise Networks www.itvshop.com Wireless LAN Security Workshop Wash DC Honolulu The Mansfield Group, LLC http://www.itvshop.com Brian Mansfield Chief Security Consultant The Mansfield Group, LLC Is your WLAN really protected? Is your WIRED network really protected?

2. Hosted by Should you care? The Mansfield Group, LLC http://www.itvshop.com

3. Hosted by The number of frequent WLAN users in North America will grow from 4.2 million in 2003 to... more than 31 million by 2007 Gartner Symposium/ITxpo 2003 The Mansfield Group, LLC http://www.itvshop.com

4. Hosted by Enterprise Market Drivers: Wi-Fi client ubiquity Centrino market penetration 95% of new laptops include Wi-Fi by 2004 WLAN “Switch” technology Vendor neutral deployment options Effective network security & mgmt solutions Range of infrastructure investment options Wi-Fi’s “Secret Weapon” - VoWLAN Voice & data through single device One-number connectivity on campus The Mansfield Group, LLC http://www.itvshop.com

5. Hosted by Infonetics Research - www.infonetics.com Worldwide WLAN Hardware Forecast

6. Hosted by “…but our company has no plans to deploy a WLAN…” Guess what? You still need a WIDS strategy! The Mansfield Group, LLC http://www.itvshop.com

7. Hosted by HostAP Airjack AirSnarf ROGUE AP’s Kismet Wallenreiter Airsnort Netstumbler YOUR EMPLOYEES! Knoppix File2air cqure AP Why? Soft APs The Mansfield Group, LLC http://www.itvshop.com Accidental associations Malicious associations

8. Hosted by Risk Points within the Enterprise Employees install unauthorized APs Employees share files via Ad-Hoc mode Employees carry Wi-Fi enabled clients Employees connect to WAN via home WLAN Employees are vulnerable to attack APs The Mansfield Group, LLC http://www.itvshop.com Employees connect to WAN via public Hotspots

9. Hosted by Likely Sources of Attack CSI/FBI 2003 Computer Security Survey

10. Hosted by Security Stragegy for Companies with NO WLAN Draft WLAN Security Policy Monitor Your Airspace Enforce Security Policy, Update & Refine The Mansfield Group, LLC http://www.itvshop.com Conduct WLAN Security Assessment

11. Hosted by RF BROADCAST OVERFLOW

12. Hosted by Survey airspace inside your organization What protocols/data is being transmitted? Where are they located? Are any connected to your LAN? Sweep airspace around perimeter What protocols/data is being transmitted? Where are they located? How are they configured? What external sources are penetrating environment? What devices are broadcasting in your environment? The Mansfield Group, LLC http://www.itvshop.com 1. Conduct WLAN Security Assessment

13. Hosted by 2. Draft WLAN Security Policy Extension to Existing IT Security Policy Protect assets that require integrity (financial, medical) Configuration, Systems Use & IRP Policy Protect assets that need confidentiality (payroll, HIPPA) Protect assets that need high availability (order, transact) Prohibit unsanctioned APs / ad-hoc networking? Incident response procedure (IRP) Policy for public Hotspot & home WLAN use Configuration standards - Wi-Fi enabled? XP, WEP, SSID The Mansfield Group, LLC http://www.itvshop.com

14. Hosted by 3. Monitor Your Airspace - Verify policy adherence Internal monitoring Perimeter monitoring Unsanctioned APs / rogue AP detection Machine/device configuration violations External systems broadcasting availability? Network intrusions or attacks Use violations - ad hoc networking The Mansfield Group, LLC http://www.itvshop.com

15. Hosted by 4. Enforce Policy, Update & Refine The Mansfield Group, LLC http://www.itvshop.com Active response: Reset device Reconfigure device Disconnect device Passive response: SNMP Syslog Audit trail / forensic database

16. Hosted by Security Technologies Used CSI/FBI 2003 Computer Security Survey The Mansfield Group, LLC http://www.itvshop.com

17. Hosted by MANUAL DISTRIBUTED INTEGRATED MANAGED WIDS Product Mix The Mansfield Group, LLC http://www.itvshop.com

18. Hosted by MANUAL Handheld/laptop scanner “Snapshot” view Rogue AP & client detection Performance statistics Security alarms RF analysis & site survey GPS logging The Mansfield Group, LLC http://www.itvshop.com

19. Hosted by DISTRIBUTED Radio sensors 24 x 7 monitoring Policy enforcement Stateful analysis Centrally managed Email & paging alerts IPS capabilities (SNMP) The Mansfield Group, LLC http://www.itvshop.com HQ - Washington DC Sensor Chicago Sensor Boston Management Server Sensor Rogue AP DoS Attack Unauthorized AP User Security Violation

20. Hosted by INTEGRATED “Wireless-aware” switch IDS module in AP Rogue AP location ID Dynamic site surveys Security policy monitoring Radio resource mgmt Enhanced IPS The Mansfield Group, LLC http://www.itvshop.com L2/L3 Switch or Mgmt Server AP Rogue AP

21. Hosted by MANAGED Dedicated team of IDS experts Maintain system access & control while outsourcing daily monitoring tasks Customization of services - rogue AP, reporting, custom signature sets, forensics, etc. Escalation procedure management - incident response, notification and mitigation actions Long-term TCO benefits - Lease vs. buy option Integrate & correlated w/wired IDS or IPS The Mansfield Group, LLC http://www.itvshop.com

22. Hosted by WLAN Attack Scenarios The Mansfield Group, LLC http://www.itvshop.com Layer 1 - Denial of Service Layer 2 - Rogue AP Layer 3 - IP Hi-jack

23. Hosted by

24. Airsnort SAME SSID CH1 & CH3 The Mansfield Group, LLC http://www.itvshop.com

25. Hosted by DIFFERENT SUBNETS Kismet The Mansfield Group, LLC http://www.itvshop.com

26. Hosted by CRC DoS ALARM The Mansfield Group, LLC http://www.itvshop.com

27. Hosted by The Mansfield Group, LLC http://www.itvshop.com

28. Hosted by AiroPeek The Mansfield Group, LLC http://www.itvshop.com Rogue AP

29. Hosted by NEW IP SUBNET

30. Hosted by Do you telecommute or connect to your company network from home? 1. Yes 2. No

31. Hosted by Do you use a Wi-Fi network at home? 1. Yes 2. No

32. Hosted by IDS for WLANs The Mansfield Group, LLC 802.11 Security for Enterprise Networks www.itvshop.com Wireless LAN Security Workshop Wash DC Honolulu The Mansfield Group, LLC http://www.itvshop.com Brian Mansfield Chief Security Consultant The Mansfield Group, LLC Is your WIRED network really protected?