Securing wireless access against malware invasion

So, you've learned the lessons of SQL Slammer, Blaster and Welchia, right? You've deployed serious Internet firewall and e-mail filtering, thereby locking your front door. But, how are you defending

    Requires Free Membership to View

against malware zooming in through your wireless LAN access points? Your front door might be locked tight, but are your wireless LANs wide open to invasion by worms carried by employees or even casual passers-by?

To defend your wireless infrastructure from malware infection, start treating the radio frequencies around your buildings as one large inter-network DMZ, with possible intruders on the outside. All traffic going across the wireless hop should be carefully filtered before it is allowed into the internal network.

Apply filters at the router, firewall or VPN gateway just inside each access point to block all traffic except those services that have a defined business need. The wireless users in your buildings likely only need access to the internal network for a handful of services, such as HTTP and e-mail. Filter everything else out. If your users require NetBIOS or SMB access for Windows file and print sharing, or Microsoft Exchange services, consider deploying filters that limit such access to valid internal servers, blocking all other destinations. That way, malware that spreads via network shares will find a much less hospitable environment on your internal network.

To be even more thorough in securing your wireless infrastructure against such attacks, consider deploying a VPN gateway that requires strong authentication and encryption before allowing a connection to the internal network is allowed. A wireless solution that requires token-based authentication for a VPN is a particularly good idea. Token-based authentication might even allow you to leverage your existing authentication infrastructure that you originally deployed for Internet VPN access.

Finally, your organization's policy and procedures should require the installation of an antivirus tool on every wireless-equipped laptop or PDA. With such defenses, malicious code or a meddlesome attacker will not be able to easily compromise a wireless device, hijack a connection or otherwise jump into the internal network.

About the author
Ed Skoudis is a security consultant with International Network Services, and the author of the books Malware: Fighting Malicious Code and Counter Hack: A Step-by-Step Guide to Computer Attacks and Effective Defenses.

This was first published in February 2004

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.