WLAN Security

WLANs provide an effective solution for hard-to-reach locations and enable mobility to a level that was previously unattainable. However, WLANs without any encryption present a security risk, because publicly available software can obtain the SSIDs. The productivity improvements with WLANs are just beginning, however. The Wired Equivalent Privacy (WEP) security protocol, used in the IEEE 802.11b standard, is considered faulty and vulnerable to numerous attacks. The 802.11b protocol is the most commonly deployed wireless protocol, and although it has the ability to use 64-bit or 128-bit encryption, readily available software can crack the encryption scheme.

In June 2004, the IEEE 802.11i standard was ratified to provide additional security in WLAN networks. IEEE 802.11i is also known as Wi-Fi Protected Access 2 (WPA2). The 802.11i architecture contains the following components:

■ 802.1X for authentication (entailing the use of Extensible Authentication Protocol [EAP] and an authentication server)

■ Robust Security Network (RSN) for keeping track of associations

■ Advanced Encryption Standard (AES) for confidentiality, integrity, and origin authentication

Unauthorized Access

A problem that confronts WLANs comes from the fact that wireless signals are not easily controlled or contained. WEP works at the data link layer, sharing the same key for all nodes that communicate. The 802.11 standard was deployed because it allowed bandwidth speed up to 11 Mbps and it is based on DSSS technology. DSSS also enables APs to identify WLAN cards via their MAC addresses. Because traditional physical boundaries do not apply to wireless networks, attackers can gain access using wireless from outside the physical security perimeter. Attackers achieve unauthorized access if the wireless network does not have a mechanism to compare a MAC address on a wireless card to a database that contains a directory with access rights. An individual can roam within an area, and each AP that comes into contact with that card must also rely on a directory. Statically allowing access via a MAC address is also insecure, because MAC addresses can be spoofed.

Some APs can implement MAC address and protocol filtering to enhance security or limit the protocols used over the WLAN. With hundreds of WLAN clients, MAC address filtering is not a scalable solution. Again, attackers can hack MAC address filtering. A user can listen for transmissions, gather a list of MAC addresses, and then use one of those MAC addresses to connect to the AP.

WLAN Security Design Approach

The WLAN security design approach makes two assumptions, which this chapter describes. The assumptions are that all WLAN devices are connected to a unique IP subnet and that most services available to the wired network are also available to the wireless nodes. Using these two assumptions, the WLAN security designs offer two basic security approaches:

■ Use of Lightweight Extensible Authentication Protocol (LEAP) to secure authentication

■ Use of virtual private networks (VPN) with IP Security (IPsec) to secure traffic from the WLAN to the wired network

Considering WLAN as an alternative access methodology, remember that the services these WLAN users access are often the same as those accessed by the wired users. WLAN opens a new world of access for the hacker, and you should consider the risks before deployment.

To enhance security, you can implement WLANs with IPsec VPN software, use the IEEE 802.1X-2001 port-based access control protocol, and use dynamic WEP keys.

IEEE 802.1X-2001 Port-Based Authentication

IEEE 802.1X-2001 is a port-based authentication standard for LANs. It authenticates a user before allowing access to the network. You can use it on Ethernet, Fast Ethernet, and WLAN networks.

With IEEE 802.1X-2001, client workstations run client software to request access to services. Clients use EAP to communicate with the LAN switch. The LAN switch verifies client information with the authentication server and relays the response to the client. LAN switches use a Remote Authentication Dial-In User Service (RADIUS) client to communicate with the server. The RADIUS authentication server validates the client's identity and authorizes the client. The server uses RADIUS with EAP extensions to make the authorization.

Dynamic WEP Keys and LEAP

Cisco also offers dynamic per-user, per-session WEP keys to provide additional security over statically configured WEP keys, which are not unique per user. For centralized user-based authentication, Cisco developed LEAP. LEAP uses mutual authentication between the client and the network server and uses IEEE 802.1X for 802.11 authentication messaging. LEAP uses a RADIUS server to manage user information.

LEAP is a combination of 802.1X and EAP. It combines the capability to authenticate to various servers such as RADIUS with forcing the WLAN user to log in to an access point that compares the login information to RADIUS. This solution is more scalable than MAC address filtering.

Because the WLAN access depends on receiving an address, using Dynamic Host Configuration Protocol (DHCP), and the authentication of the user using RADIUS, the WLAN needs constant access to these back-end servers. In addition, LEAP does not support one-time passwords (OTP), so you must use good password-security practices. The password issue and maintenance practice are a basic component of corporate security policy.

Controlling WLAN Access to Servers

In the same way you place Domain Name System (DNS) servers accessible via the Internet on a demilitarized zone (DMZ) segment, you should apply a similar strategy to the RADIUS and DHCP servers accessible to the WLAN. These servers should be secondary servers that are on a different segment (separate VLAN) from their primary counterparts. Access to this VLAN is filtered. Such placement ensures that any attacks launched on these servers are contained within that segment.

You should control network access to the servers. Consider the WLAN an unsecured segment and apply appropriate segmentation and access lists. Such a step ensures that WLAN access is controlled and directed to only those areas that need it. For example, you might not want to permit WLAN access to management servers and HR servers.

You must also protect these servers against network attack. The criticality of these servers makes them an ideal target for denial-of-service (DoS) attacks. Consider using host-based intrusion detection systems (IDS) to detect network attacks against these devices.

Continue reading here: Cisco UWN Architecture

Was this article helpful?

0 0