It finally happened. An employer forced me to get a broadband connection. While most people think I would have been one of the early adopters of fast connections, I fought it for years. One issue was that I would have to find a way to connect the different computers throughout my house. However, the main reason I fought broadband connections was security. Sadly for security managers and professionals, my experiences showed that I am one of the few people who respect the problem. They also show why your employees and even your network technicians, are leaving your company much more vulnerable than it has to be.
With a broadband connection, systems are usually always connected to the Internet, unless you turn them off. I do know how to secure the connections. The issue is that security is an ongoing battle. Unless users can devote enough time to the effort and regularly maintain and update the connections, their system(s) will be vulnerable at some points in time – and so will your corporate data.
While the situation creates a dangerous but acceptable risk for most people, it might not be for your company. It would be especially embarrassing for me if my home network was hacked, as I am a supposed security expert. Anyway, the company made the decision for me and at least took on the responsibility of maintaining my firewall. That handles most security risks from the Internet, however I then had to deal with the connectivity issue.
I had most of the connectivity problem handled several years ago when my basement was finished. I had the contractor run Cat 5 (Ethernet) cables to the rooms of my house. When I started mentioning patch panels and the stringent requirements for the actual wiring of the jacks, the contractors wished me luck in finishing the project. So with the pending activation of my broadband connection, I had a deadline to finish up the wiring.
MORE INFORMATION ON WIRELESS LAN SECURITY:
- Join us on June 8 at noon EDT for a live Webcast with guest speaker and Information Security contributor Jon Edney on new developments in wireless LAN access control.
- Get an overview of WEP, 802.1X and 802.11i in part one of the tip Strategies for securing your wireless LAN.
- Get an overview of Web authentication and IPsec in part two of the tip Strategies for securing your wireless LAN.
I went to Home Depot to find the equipment and guidance I needed. I found someone who seemed to know what he was talking about. When I got home, I followed the advice in wiring the Ethernet wall jacks. The next day, I started wiring the patch panels (which allow for easier and cleaner connections of wires to networking devices). I soon found a discrepancy in the "guidance" I received. I then had to rewire all of the wall jacks I wired the day before.
I soon learned that confident but wrong advice extended to the security realm as well. The next day, I went to a large computer superstore to buy a couple of Ethernet hubs. I had a quick question and found the department manager for the network gear. To see if I could trust his judgment, I asked the manager what the difference is between hubs and switches. He couldn't come up with a good answer, so I used my own judgment on my equipment choices.
When the manager asked why I needed two hubs, I told him that I was installing an Ethernet in my house. He asked me why I didn't just buy a wireless hub and forget about the wiring. I told him simply that I was concerned about security. He responded very confidently and obnoxiously, "Well all you need is a firewall router and turn on wireless encryption," and he walked away. Later that night, it hit me that he was offering his "expert" security advice to dozens of people a week.
To the average Internet user -- your end users -- I bet the notion that encryption solves all security problems sounds logical. It actually does an acceptable job of preventing eavesdropping on your connection. However, the problem is that encryption just secures your data in transmission. To put it simply, it does nothing to prevent outsiders from logging into your wireless network.
A friend gave me a great real-world example you can pass on to your users. His daughter was over at a friend's house and wanted to connect her computer to her friend's home wireless network. She had problems and called her father. When she did finally connect, she gave him the details about the connection. He soon realized that based upon the brand of router she was connected to, she was actually connecting to a neighbor's home network. It turned out that her friend's wireless network hub was not even active and that her family has been using their neighbor's wireless network for more than a year. And yes, the neighbors have encryption turned on.
After going through the aggravation of wiring my house for Ethernet, I fully understand the desire to use wireless networks. It does present a greater security risk, however the risk can be acceptable for most people with the proper security in place. Having a firewall into your home is important. For that matter, activating wireless encryption is also extremely important. However there is much more to it.
Given that wireless encryption is here to stay, and it will likely be used in your company and at your employees' homes, you should create some standard guidance that goes beyond the "encryption solves all" delusions. Here are some basic guidelines you may want to pass on to your network department and employees in general, particularly those who connect their company-owned laptop to their home network. How to implement the recommendations that follow depend upon the hardware you buy. Your documentation should provide those details.
Wireless security recommendations
- Change your system defaults – everyone knows them. Change the Admin and SNMP passwords. Change the IP network range. Also change the Server Set ID (SSID). The SSID is a unique identifier for your wireless hub/router. The default SSID is set in the factory is definitely not unique.
- Don't broadcast the SSID. While you can change the default ID, that does little if your hub or router broadcasts that SSID.
- Enable Wireless Encryption. WEP or something similar can be compromised, but it makes it significantly more difficult to compromise your information. The larger the key length, the better.
- Enable Shared Key Authentication. The default Open System setting lets anyone connect to your network with very minimal effort.
- Change your SNMP Community String. Create a Community String like it is a strong password.
- Enable MAC Address Codes. Again, this makes it more difficult for a hacker to compromise your home network.
- Set Wireless LAN cards to Infrastructure Mode. Most cards have the default Ad Hoc mode, which is less secure.
- Don't rely only on the broadband firewall. A firewall at your home's Internet entry point is critical. However, you should still have personal firewalls on all computers on your network, in case something makes it through your home's firewall or a hacker does make it onto your network.
About the author
Ira Winkler, CISSP, CISM has 20 years or so of experience in the security and intelligence fields. Ira consults many of the largest companies in the world, assisting them in cost effectively and realistically securing themselves. He is author of several books, including the forthcoming book Spies Among Us. As always, Ira's opinions are his own and do not necessarily represent those of any organization he is associated with.
