It finally happened. An employer forced me to get a broadband connection. While most people think I would have been one of the early adopters of fast connections, I fought it for years. One issue was that I would have to find a way to connect the different computers throughout my house. However, the main reason I fought broadband connections was security. Sadly for security managers and professionals, my experiences showed that I am one of the few people who respect the problem. They also show why your employees and even your network technicians, are leaving your company much more vulnerable than it has to be.
With a broadband connection, systems are usually always connected to the Internet, unless you turn them off. I do know how to secure the connections. The issue is that security is an ongoing battle. Unless users can devote enough time to the effort and regularly maintain and update the connections, their system(s) will be vulnerable at some points in time – and so will your corporate data.
While the situation creates a dangerous but acceptable risk for most people, it might not be for your company. It would be especially embarrassing for me if my home network was hacked, as I am a supposed security expert. Anyway, the company made the decision for me and at least took on the responsibility of maintaining my firewall. That handles most security risks from the Internet, however I then had to deal with the connectivity issue.
I had most of the connectivity problem handled several years ago when my basement was finished. I had the contractor run Cat 5 (Ethernet) cables to the rooms of my house. When I started mentioning patch panels and the stringent requirements for the actual wiring of the jacks, the contractors wished me luck in finishing the project. So with the pending activation of my broadband connection, I had a deadline to finish up the wiring.
MORE INFORMATION ON WIRELESS LAN SECURITY:
I wen
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
t to Home Depot to find the equipment and guidance I needed. I found someone who seemed to know what he was talking about. When I got home, I followed the advice in wiring the Ethernet wall jacks. The next day, I started wiring the patch panels (which allow for easier and cleaner connections of wires to networking devices). I soon found a discrepancy in the "guidance" I received. I then had to rewire all of the wall jacks I wired the day before.
I soon learned that confident but wrong advice extended to the security realm as well. The next day, I went to a large computer superstore to buy a couple of Ethernet hubs. I had a quick question and found the department manager for the network gear. To see if I could trust his judgment, I asked the manager what the difference is between hubs and switches. He couldn't come up with a good answer, so I used my own judgment on my equipment choices.
When the manager asked why I needed two hubs, I told him that I was installing an Ethernet in my house. He asked me why I didn't just buy a wireless hub and forget about the wiring. I told him simply that I was concerned about security. He responded very confidently and obnoxiously, "Well all you need is a firewall router and turn on wireless encryption," and he walked away. Later that night, it hit me that he was offering his "expert" security advice to dozens of people a week.
To the average Internet user -- your end users -- I bet the notion that encryption solves all security problems sounds logical. It actually does an acceptable job of preventing eavesdropping on your connection. However, the problem is that encryption just secures your data in transmission. To put it simply, it does nothing to prevent outsiders from logging into your wireless network.
A friend gave me a great real-world example you can pass on to your users. His daughter was over at a friend's house and wanted to connect her computer to her friend's home wireless network. She had problems and called her father. When she did finally connect, she gave him the details about the connection. He soon realized that based upon the brand of router she was connected to, she was actually connecting to a neighbor's home network. It turned out that her friend's wireless network hub was not even active and that her family has been using their neighbor's wireless network for more than a year. And yes, the neighbors have encryption turned on.
After going through the aggravation of wiring my house for Ethernet, I fully understand the desire to use wireless networks. It does present a greater security risk, however the risk can be acceptable for most people with the proper security in place. Having a firewall into your home is important. For that matter, activating wireless encryption is also extremely important. However there is much more to it.
Given that wireless encryption is here to stay, and it will likely be used in your company and at your employees' homes, you should create some standard guidance that goes beyond the "encryption solves all" delusions. Here are some basic guidelines you may want to pass on to your network department and employees in general, particularly those who connect their company-owned laptop to their home network. How to implement the recommendations that follow depend upon the hardware you buy. Your documentation should provide those details.
Wireless security recommendations
About the author
Ira Winkler, CISSP, CISM has 20 years or so of experience in the security and intelligence fields. Ira consults many of the largest companies in the world, assisting them in cost effectively and realistically securing themselves. He is author of several books, including the forthcoming book Spies Among Us. As always, Ira's opinions are his own and do not necessarily represent those of any organization he is associated with.
