DESIGNING AND DEPLOYING SECURE WIRELESS LANS. Karl McDermott Cisco Systems Ireland

Size: px
Start display at page:

Download "DESIGNING AND DEPLOYING SECURE WIRELESS LANS. Karl McDermott Cisco Systems Ireland kamcderm@cisco.com"

Transcription

1 DESIGNING AND DEPLOYING SECURE WIRELESS LANS Karl McDermott Cisco Systems Ireland 1

2 Agenda Wireless LAN Security Overview WLAN Security Authentication and Encryption Radio Monitoring Intrusion Detection Services Location Services and RFID Tracking 2

3 Why WLAN Security Is Important? Vulnerabilities: Hackers Employees Lessons: War Driving Do not rely on basic WEP encryption; Requirement for Enterprise class Security (WPA, EAP/802.1x protocols, Wireless IDS, VLANs/SSIDs, etc) Employees will install WLAN equipment on their own (compromises security of your entire network) Out of the box configuration of APs: All security features are disabled! Business impact due to stolen data: Potential financial and legal consequences (Laws to protect data confidentiality; Example: Healthcare) 3

4 WLAN Security Vulnerabilities and Threats Different forms of Vulnerabilities and Threats Exist Encryption Vulnerabilities: WEP Authentication Vulnerabilities: Shared-Key authentication, Dictionary attacks, and MITM attacks WLAN Sniffing and SSID Broadcasting Address Spoofing: Mac-address spoofing and IP address spoofing (both hostile/outsider attacks as well as insider attacks) Misconfigured APs and Clients Denial of Service (DoS) attacks: Using deauthentication/ disassociation frames, RF jamming, etc. 4

5 Bit Flipping Vulnerability Access Point Attacker ICV Bit Flipped Frame WEP Bit Flipped Frame Pass Layer 3 Receiver CRC Fail Ciphertext Error Msg WEP Plaintext Error Msg Predicted Plaintext Error Msg XOR Key Stream Ciphertext Error Msg 5

6 WLAN Sniffing and SSID Broadcasting Disabling SSID Broadcast should not be considered a security mechanism- Potential attackers can uncover your SSID by observing probe responses! 6

7 Unknown WLANS - Rogue AP Frustrated insider User that installs wireless AP in order to benefit from increased efficiency and convenience it offers Common because of wide availability of low cost APs Usually ignorant of AP security configuration, default configuration most common Malicious hacker Penetrates physical security specifically to install a rogue AP Can customize AP to hide it from detection tools Hard to detect more effective to prevent via 802.1x and physical security More likely to install LINUX box than an AP >99.9% of Rogue APs Jones from Accounting <.1% of Rogue APs 7

8 Agenda Wireless LAN Security Overview WLAN Security Authentication and Encryption Radio Monitoring Intrusion Detection Services Location Services and RFID Tracking 8

9 security approaches Open network SSID can be captured with passive monitoring MAC filtering WEP MACs can be sniffed/spoofed Can be cracked online/offline given enough traffic & time Change keys frequently Traffic can still be decrypted offline Place APs on DMZ Requires VPN access to get back into network Use VPN Doesn t handle roaming WPA and/or EAP 9

10 Authentication methods Open systems authentication Shared key authentication EAP / 802.1x 10

11 Open system authentication Required by Just requires SSID from client Only identification required is MAC address of client WEP key not verified, but device will drop packets it can t decrypt 11

12 Shared key authentication Utilizes challenge/response Requires & matches key Steps Client requests association to AP AP issues challenge to client Client responds with challenge encrypted by WEP key AP decrypts clients & verifies WEAK! Attacker sniffs plaintext AND cipher-text! 12

13 802.1x authentication Encapsulates EAP traffic over LAN (aka EAPoL) EAP: Standard for securely transporting authc data Supports a variety of authentication methods LEAP, EAP-TLS, etc. Port-based only access is to authentication server until authentication succeeds Similar to what s used on Ethernet switches Originally designed for campus-wired networks Requires little overhead by access point 13

14 802.1x authentication (cont.) 3 entities Supplicant (e.g., laptop w/wireless card) Authenticator (e.g., access point) Authentication server (e.g., RADIUS) Three Main Elements 1. Mutual authentication between client and RADIUS 2. Encryption keys dynamically derived after authentication 3. Centralized policy control, 14

15 EAP-FAST Authentication Overview Supplicant AP Enterprise Network RADIUS server EAPOL Start Start EAP Authentication EAP-Request/Identity Ask client for identity EAP -Response/Identity (EAP-ID) RADIUS Access request Access Request with EAP-ID key Client derives PMK EAP success WPA Key Management Protected DATA Transfer Secure Tunnel (via TLS & PAC) Client-side Authentication RADIUS Access Accept (Pass PMK to AP) Perform sequence defined by EAP-FAST key 15

16 Wired Equivalent Privacy (WEP) Part of specification 64-bit key Shared key 40 bits Initialization vector (IV) = 24 bits Uses RC4 for encryption Weaknesses/attacks FMS key recovery attack weak IVs Filter weak IVs to mitigate IV too short, gets reused after 5 hours IP redirection, MITM attacks Traffic injection attacks Bit-flip attacks WEP2 added, increases key length to 128 bits 16

17 TKIP/MIC to the rescue Fixes key reuse in WEP Same encryption as WEP (RC4) MIC Message Integrity Code TKIP Temporal Key Integrity Protocol Protects IV by removing predictability Per Packet keying 17

18 VPN Authentication Overview Alternative to 802.1X over WLAN IETF standardized IPSec implementation Key benefits Mutual authentication between client machine and VPN concentrator using Shared-Key or Digital Certificate Provides 3DES or AES Encryption Provides SHA/MD5 for data integrity protection Provides Centralized user authentication (such as OTP) and administration 18

19 VPN Deployment Requirements Two-Factor Authentication Client Machine IPSec VPN supplicant VPN supplicant & WLAN adapter supplicant integration (optional) Personal Firewall for Local Attack Mitigation Client Machine RADIUS/OTP Servers VPN Concentrator Access Point Packet Filtering VPN Concentrator Authenticate Remote Users Terminate IPSec DHCP services (DHCP pool or DHCP Relay) 19

20 Agenda Wireless LAN Security Overview WLAN Security Authentication and Encryption Radio Monitoring Intrusion Detection Services Location Services and RFID Tracking 20

21 What is Wireless IDS? Wireless Intrusion Detection permits the detection of malicious or non-malicious security events on the WLAN Rogue AP detection Denial-of-Service detection WLAN Exploit Signature Analysis RF Interference detection Detection of attempts to access WLAN network and attempts to attract managed clients (honeypot) 21

22 Radio (Air/RF) Monitoring Si NMS Si Si Network Core Wireless Controller or IDS Server WDS Service (aggregation point) Si Si Distribution RM RM Access Rogue AP Rogue AP RM 22

23 Rogue AP Detection & Suppression Real-time RF monitoring ALL channels scanned while offering service Can scan country channels only or all channels During Scan all packets are collected and characterized Rogue beacons, Rogue clients, interference Matched against IDS signatures. Rogue AP suppression techniques Trace the rogue AP over the wired network and shut-down the switch port Use of managed devices to disassociate clients from unauthorized AP and prevent further associations via deauthentication frames 23

24 Autonomous AP: Rogue AP Location 24

25 Wireless enabled Location Solutions ( Active RFID ) 25

26 Active RFID Location Solutions Provide Real time Asset information provide the answers to: What Do We Have? How Many Do We Have? Where Is It? What Is It s Status? Real-time Location Tracking Presence Choke-point Infant X is in room Y Pallet X is on the line Vehicle X entered the terminal 26

27 Example Asset Loss in Hospitals [Hospitals] cannot find 15-20% of the devices they own. Arthur Gasch, Medical Strategy Planning Infusion pumps simply disappear. When it comes time to do preventative maintenance, we cannot find them. Materials Manager, large US hospital Data from hospitals demonstrates magnitude of problem: 500-bed hospital: loses 40 of 500 pumps per year (8%) 150-bed hospital: loses 250 of 1500 pumps per year (17%) Loss= failure to locate the equipment in time for scheduled preventative maintenance 27

28 Applications for location information Location based trending RF Capacity Management Troubleshooting Security Visibility Asset Management Streamline Workflow Security Better rogue detection Perimeter security Policy enforcement Location/movement based alerts Voice Code Blue, Voice Alerts E911 Location Based Content Distribution LOCATION Telemetry Relevant information about tracked item 28

29 RF Location Architecture Browser Based Remote Console HTTPS NMS SOAP/XML 3 rd party Integrated Applications: E911, Asset Tracking, ERP, Workflow Automation Wireless Location Appliance APs collect RSSI from devices and tags RSSI Location information is aggregated by Controllers SOAP/XML Information is sent to the Location Appliance for computation Wireless LAN Controller Access Point Access Point Location information is visually displayed by NMS NMS provides immediate applications for RF capacity management, location based security & asset visibility. Rich location information can be used by Location Appliance API for integration & display by location based applications Wi-Fi 2003 Cisco Handsets, Systems, Inc. clients, All rights reserved. rogues & Wi-Fi Tags 29

30 Location services technologies Closest AP: Identify AP with strongest RSSI. Limited accuracy: an AP can easily cover several thousand feet. RF Triangulation: All APs identify the strength with which they hear a client. Intelligent algorithms triangulate responses to find probable location. More accurate than closest AP. But does not account for effect of building material and people on signal e.g. multi-path, attenuation, reflection RF Fingerprinting: RF prediction creates a grid that identifies how every single part of the floorplan looks to all APs. Real world information is gathered by APs is compared to these fingerprints to determine location to within a few meters. 30

31 Wi-Fi Active RFID Tags Interoperability: Interoperable with any standards based tag Proven interoperability with PanGo & Aeroscout tags Battery life: 3-5 years, depends on beacon/blink rates Unassociated tags promote battery life; intelligent motion detectors provide intelligent alerting only, preserving battery life Security mechanisms: i/WPA2 & VLANs Unassociated tags do not associate to network Rich Device Information Relay: Serial telemetry information capable Dimensions: Varies slightly by vendor but approximately 2.44 (2.61) x 1.57 (1.74) x 0.67 (0.88) /62mm (66.3) x 40mm (44.2) x 17mm (22.35) Weight:1.2oz (35g) -2.5oz (w/batteries) Various Mounting Options Environmental Durability: Operating Temperature: varies by vendor: -30 C to +75 C (-22 F to 167 F) to 32 to 130 F (0 to 54 C) Dirt/Dust/Water resistance, includes rubber lining IP-67, IP-68 31

32 Summary WPA, WPA2, with an EAP protocol solution is recommended for WLAN security deployment Segment wireless network along the same lines as wired network and use the same access restrictions Implement wired security features as well as Wireless IDS Radio Monitoring is a requirement even if you do not have a wireless network Radio Monitoring also delivers Location Services 32

12/3/08. Security in Wireless LANs and Mobile Networks. Wireless Magnifies Exposure Vulnerability. Mobility Makes it Difficult to Establish Trust

12/3/08. Security in Wireless LANs and Mobile Networks. Wireless Magnifies Exposure Vulnerability. Mobility Makes it Difficult to Establish Trust Security in Wireless LANs and Mobile Networks Wireless Magnifies Exposure Vulnerability Information going across the wireless link is exposed to anyone within radio range RF may extend beyond a room or

More information

Lecture Objectives. Lecture 8 Mobile Networks: Security in Wireless LANs and Mobile Networks. Agenda. References

Lecture Objectives. Lecture 8 Mobile Networks: Security in Wireless LANs and Mobile Networks. Agenda. References Lecture Objectives Wireless Networks and Mobile Systems Lecture 8 Mobile Networks: Security in Wireless LANs and Mobile Networks Introduce security vulnerabilities and defenses Describe security functions

More information

State of Kansas. Interim Wireless Local Area Networks Security and Technical Architecture

State of Kansas. Interim Wireless Local Area Networks Security and Technical Architecture State of Kansas Interim Wireless Local Area Networks Security and Technical Architecture October 6, 2005 Prepared for Wireless Policy Committee Prepared by Revision Log DATE Version Change Description

More information

Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 6. Wireless Network Security

Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 6. Wireless Network Security Security+ Guide to Network Security Fundamentals, Third Edition Chapter 6 Wireless Network Security Objectives Overview of IEEE 802.11 wireless security Define vulnerabilities of Open System Authentication,

More information

802.11 Security (WEP, WPA\WPA2) 19/05/2009. Giulio Rossetti Unipi Giulio.Rossetti@gmail.com

802.11 Security (WEP, WPA\WPA2) 19/05/2009. Giulio Rossetti Unipi Giulio.Rossetti@gmail.com 802.11 Security (WEP, WPA\WPA2) 19/05/2009 Giulio Rossetti Unipi Giulio.Rossetti@gmail.com 802.11 Security Standard: WEP Wired Equivalent Privacy The packets are encrypted, before sent, with a Secret Key

More information

WLAN Attacks. Wireless LAN Attacks and Protection Tools. (Section 3 contd.) Traffic Analysis. Passive Attacks. War Driving. War Driving contd.

WLAN Attacks. Wireless LAN Attacks and Protection Tools. (Section 3 contd.) Traffic Analysis. Passive Attacks. War Driving. War Driving contd. Wireless LAN Attacks and Protection Tools (Section 3 contd.) WLAN Attacks Passive Attack unauthorised party gains access to a network and does not modify any resources on the network Active Attack unauthorised

More information

Recommended 802.11 Wireless Local Area Network Architecture

Recommended 802.11 Wireless Local Area Network Architecture NATIONAL SECURITY AGENCY Ft. George G. Meade, MD I332-008R-2005 Dated: 23 September 2005 Network Hardware Analysis and Evaluation Division Systems and Network Attack Center Recommended 802.11 Wireless

More information

Configuring Security Solutions

Configuring Security Solutions CHAPTER 3 This chapter describes security solutions for wireless LANs. It contains these sections: Cisco Wireless LAN Solution Security, page 3-2 Using WCS to Convert a Cisco Wireless LAN Solution from

More information

The next generation of knowledge and expertise Wireless Security Basics

The next generation of knowledge and expertise Wireless Security Basics The next generation of knowledge and expertise Wireless Security Basics HTA Technology Security Consulting., 30 S. Wacker Dr, 22 nd Floor, Chicago, IL 60606, 708-862-6348 (voice), 708-868-2404 (fax), www.hta-inc.com

More information

Overview. Summary of Key Findings. Tech Note PCI Wireless Guideline

Overview. Summary of Key Findings. Tech Note PCI Wireless Guideline Overview The following note covers information published in the PCI-DSS Wireless Guideline in July of 2009 by the PCI Wireless Special Interest Group Implementation Team and addresses version 1.2 of the

More information

Wireless LAN Security with 802.1x, EAP-TLS, and PEAP. Steve Riley Senior Consultant MCS Trustworthy Computing Services

Wireless LAN Security with 802.1x, EAP-TLS, and PEAP. Steve Riley Senior Consultant MCS Trustworthy Computing Services Wireless LAN Security with 802.1x, EAP-TLS, and PEAP Steve Riley Senior Consultant MCS Trustworthy Computing Services So what s the problem? WEP is a euphemism Wired Equivalent Privacy Actually, it s a

More information

The following chart provides the breakdown of exam as to the weight of each section of the exam.

The following chart provides the breakdown of exam as to the weight of each section of the exam. Introduction The CWSP-205 exam, covering the 2015 objectives, will certify that the successful candidate understands the security weaknesses inherent in WLANs, the solutions available to address those

More information

Wireless Security Overview. Ann Geyer Partner, Tunitas Group Chair, Mobile Healthcare Alliance 209-754-9130 ageyer@tunitas.com

Wireless Security Overview. Ann Geyer Partner, Tunitas Group Chair, Mobile Healthcare Alliance 209-754-9130 ageyer@tunitas.com Wireless Security Overview Ann Geyer Partner, Tunitas Group Chair, Mobile Healthcare Alliance 209-754-9130 ageyer@tunitas.com Ground Setting Three Basics Availability Authenticity Confidentiality Challenge

More information

CISCO WIRELESS CONTROL SYSTEM (WCS)

CISCO WIRELESS CONTROL SYSTEM (WCS) CISCO WIRELESS CONTROL SYSTEM (WCS) Figure 1. Cisco Wireless Control System (WCS) PRODUCT OVERVIEW Cisco Wireless Control System (WCS) Cisco Wireless Control System (WCS) is the industry s leading platform

More information

Security in IEEE 802.11 WLANs

Security in IEEE 802.11 WLANs Security in IEEE 802.11 WLANs 1 IEEE 802.11 Architecture Extended Service Set (ESS) Distribution System LAN Segment AP 3 AP 1 AP 2 MS MS Basic Service Set (BSS) Courtesy: Prashant Krishnamurthy, Univ Pittsburgh

More information

Authentication in WLAN

Authentication in WLAN Authentication in WLAN Flaws in WEP (Wired Equivalent Privacy) Wi-Fi Protected Access (WPA) Based on draft 3 of the IEEE 802.11i. Provides stronger data encryption and user authentication (largely missing

More information

Industrial Communication. Securing Industrial Wireless

Industrial Communication. Securing Industrial Wireless Industrial Communication Whitepaper Securing Industrial Wireless Contents Introduction... 3 Wireless Applications... 4 Potential Threats... 5 Denial of Service... 5 Eavesdropping... 5 Rogue Access Point...

More information

Wireless security. Any station within range of the RF receives data Two security mechanism

Wireless security. Any station within range of the RF receives data Two security mechanism 802.11 Security Wireless security Any station within range of the RF receives data Two security mechanism A means to decide who or what can use a WLAN authentication A means to provide privacy for the

More information

Security Awareness. Wireless Network Security

Security Awareness. Wireless Network Security Security Awareness Wireless Network Security Attacks on Wireless Networks Three-step process Discovering the wireless network Connecting to the network Launching assaults Security Awareness, 3 rd Edition

More information

Cisco SAFE: Wireless LAN Security in Depth

Cisco SAFE: Wireless LAN Security in Depth White Paper Cisco SAFE: Wireless LAN Security in Depth Authors Sean Convery (CCIE #4232), Darrin Miller (CCIE #6447), and Sri Sundaralingam are the primary authors of this white paper. Mark Doering, Pej

More information

Cisco Wireless Control System (WCS)

Cisco Wireless Control System (WCS) Data Sheet Cisco Wireless Control System (WCS) PRODUCT OVERVIEW Cisco Wireless Control System (WCS) Cisco Wireless Control System (WCS) is the industry s leading platform for wireless LAN planning, configuration,

More information

Certified Wireless Security Professional (CWSP) Course Overview

Certified Wireless Security Professional (CWSP) Course Overview Certified Wireless Security Professional (CWSP) Course Overview This course will teach students about Legacy Security, encryption ciphers and methods, 802.11 authentication methods, dynamic encryption

More information

All vulnerabilities that exist in conventional wired networks apply and likely easier Theft, tampering of devices

All vulnerabilities that exist in conventional wired networks apply and likely easier Theft, tampering of devices Wireless Security All vulnerabilities that exist in conventional wired networks apply and likely easier Theft, tampering of devices Portability Tamper-proof devices? Intrusion and interception of poorly

More information

Integrated Health Systems. Enterprise Wireless LAN Security for Long Term Care. Integrated Systems, Inc. (866) 602-6100

Integrated Health Systems. Enterprise Wireless LAN Security for Long Term Care. Integrated Systems, Inc. (866) 602-6100 Integrated Health Systems Enterprise Wireless LAN Security for Long Term Care Integrated Systems, Inc. (866) 602-6100 Enterprise Wireless LAN Security This paper describes the challenges today s healthcare

More information

1.1 Demonstrate how to recognize, perform, and prevent the following types of attacks, and discuss their impact on the organization:

1.1 Demonstrate how to recognize, perform, and prevent the following types of attacks, and discuss their impact on the organization: Introduction The PW0-204 exam, covering the 2010 objectives, will certify that the successful candidate understands the security weaknesses inherent in WLANs, the solutions available to address those weaknesses,

More information

ACC-232 2002, Cisco Systems, Inc. All rights reserved.

ACC-232 2002, Cisco Systems, Inc. All rights reserved. 1 2 Securing 802.11 Wireless Networks Session 3 Session Information Basic understanding of components of 802.11 networks Please save questions until the end 4 Agenda Drivers for Wireless Security Wireless

More information

Enterprise A Closer Look at Wireless Intrusion Detection:

Enterprise A Closer Look at Wireless Intrusion Detection: White Paper Enterprise A Closer Look at Wireless Intrusion Detection: How to Benefit from a Hybrid Deployment Model Josh Wright Senior Security Researcher Introduction As wireless enterprise networks become

More information

White Paper. Wireless LAN Security. Copyright Madge Limited. All rights reserved.

White Paper. Wireless LAN Security. Copyright Madge Limited. All rights reserved. White Paper Wireless LAN Security Copyright 2002-2003 Madge Limited. All rights reserved. 1 Introduction As wireless LANs become widely deployed, and the business benefits become clear, concern has grown

More information

Wireless Security. New Standards for 802.11 Encryption and Authentication. Ann Geyer 209-754-9130 ageyer@tunitas.com www.tunitas.

Wireless Security. New Standards for 802.11 Encryption and Authentication. Ann Geyer 209-754-9130 ageyer@tunitas.com www.tunitas. Wireless Security New Standards for 802.11 Encryption and Authentication Ann Geyer 209-754-9130 ageyer@tunitas.com www.tunitas.com National Conference on m-health and EOE Minneapolis, MN Sept 9, 2003 Key

More information

Agenda. Wireless LAN Security. TCP/IP Protocol Suite (Internet Model) Security for TCP/IP. Agenda. Car Security Story

Agenda. Wireless LAN Security. TCP/IP Protocol Suite (Internet Model) Security for TCP/IP. Agenda. Car Security Story Wireless s June September 00 Agenda Wireless Security ผศ. ดร. อน นต ผลเพ ม Asst. Prof. Anan Phonphoem, Ph.D. anan@cpe.ku.ac.th http://www.cpe.ku.ac.th/~anan Computer Engineering Department Kasetsart University,

More information

Wireless Network Analysis. Complete Network Monitoring and Analysis for 802.11a/b/g/n

Wireless Network Analysis. Complete Network Monitoring and Analysis for 802.11a/b/g/n Wireless Network Analysis Complete Network Monitoring and Analysis for 802.11a/b/g/n Comprehensive Wireless Network Management Made Simple From deploying access points to baselining activity to enforcing

More information

Wireless Security and Healthcare Going Beyond IEEE 802.11i to Truly Ensure HIPAA Compliance

Wireless Security and Healthcare Going Beyond IEEE 802.11i to Truly Ensure HIPAA Compliance Going Beyond IEEE 802.11i to Truly Ensure HIPAA Compliance 339 N. Bernardo Avenue, Suite 200 Mountain View, CA 94043 www.airtightnetworks.net Wireless LANs are prevalent in healthcare institutions. The

More information

WEP Overview 1/2. and encryption mechanisms Now deprecated. Shared key Open key (the client will authenticate always) Shared key authentication

WEP Overview 1/2. and encryption mechanisms Now deprecated. Shared key Open key (the client will authenticate always) Shared key authentication WLAN Security WEP Overview 1/2 WEP, Wired Equivalent Privacy Introduced in 1999 to provide confidentiality, authentication and integrity Includes weak authentication Shared key Open key (the client will

More information

A Closer Look at Wireless Intrusion Detection: How to Benefit from a Hybrid Deployment Model

A Closer Look at Wireless Intrusion Detection: How to Benefit from a Hybrid Deployment Model A Closer Look at Wireless Intrusion Detection: How to Benefit from a Hybrid Deployment Model Table of Contents Introduction 3 Deployment approaches 3 Overlay monitoring 3 Integrated monitoring 4 Hybrid

More information

Observer Analyzer Provides In-Depth Management

Observer Analyzer Provides In-Depth Management Comprehensive Wireless Network Management Made Simple From deploying access points to baselining activity to enforcing corporate security policies, the Observer Performance Management Platform is a complete,

More information

Technical Brief. Wireless Intrusion Protection

Technical Brief. Wireless Intrusion Protection Technical Brief Wireless Intrusion Protection Introduction One layer of the multi-layer wireless security solution provided by Aruba Wireless Networks is the ability to lock the air using wireless intrusion

More information

WIRELESS SECURITY. Information Security in Systems & Networks Public Development Program. Sanjay Goel University at Albany, SUNY Fall 2006

WIRELESS SECURITY. Information Security in Systems & Networks Public Development Program. Sanjay Goel University at Albany, SUNY Fall 2006 WIRELESS SECURITY Information Security in Systems & Networks Public Development Program Sanjay Goel University at Albany, SUNY Fall 2006 1 Wireless LAN Security Learning Objectives Students should be able

More information

Lecture 24 Wireless Network Security. modified from slides of Lawrie Brown

Lecture 24 Wireless Network Security. modified from slides of Lawrie Brown Lecture 24 Wireless Network Security modified from slides of Lawrie Brown Wireless Security Overview concerns for wireless security are similar to those found in a wired environment security requirements

More information

Wireless LANs and Healthcare: Understanding Security to Ensure Compliance with HIPAA

Wireless LANs and Healthcare: Understanding Security to Ensure Compliance with HIPAA : Understanding Security to Ensure Compliance with HIPAA Healthcare is a natural environment for wireless LAN solutions. With a large mobile population of doctors, nurses, physician s assistants and other

More information

WHITE PAPER. Enterprise Wireless LAN Security

WHITE PAPER. Enterprise Wireless LAN Security WHITE PAPER Enterprise Wireless LAN Security Preface This paper describes the challenges today s administrators face when planning data protection for their wireless networks. Paramount in this discussion

More information

Developing Network Security Strategies

Developing Network Security Strategies NETE-4635 Computer Network Analysis and Design Developing Network Security Strategies NETE4635 - Computer Network Analysis and Design Slide 1 Network Security Design The 12 Step Program 1. Identify network

More information

Designing, Securing and Monitoring 802.11a/b/g/n Wireless Networks

Designing, Securing and Monitoring 802.11a/b/g/n Wireless Networks Designing, Securing and Monitoring 802.11a/b/g/n Wireless Networks The importance of Wireless today Increasingly in the Corporate Environment, Wireless is becoming an enabling technology to facilitate

More information

Wireless LAN Security Mechanisms

Wireless LAN Security Mechanisms Wireless LAN Security Mechanisms Jingan Xu, Andreas Mitschele-Thiel Technical University of Ilmenau, Integrated Hard- and Software Systems Group jingan.xu@tu-ilmenau.de, mitsch@tu-ilmenau.de Abstract.

More information

CS 356 Lecture 29 Wireless Security. Spring 2013

CS 356 Lecture 29 Wireless Security. Spring 2013 CS 356 Lecture 29 Wireless Security Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter

More information

WLAN Security Why Your Firewall, VPN, and IEEE 802.11i Aren t Enough to Protect Your Network

WLAN Security Why Your Firewall, VPN, and IEEE 802.11i Aren t Enough to Protect Your Network WLAN Security Why Your Firewall, VPN, and IEEE 802.11i Aren t Enough to Protect Your Network 339 N. Bernardo Avenue, Suite 200 Mountain View, CA 94043 www.airtightnetworks.net Executive Summary Wireless

More information

WHITE PAPER. The Need for Wireless Intrusion Prevention in Retail Networks

WHITE PAPER. The Need for Wireless Intrusion Prevention in Retail Networks WHITE PAPER The Need for Wireless Intrusion Prevention in Retail Networks The Need for Wireless Intrusion Prevention in Retail Networks Firewalls and VPNs are well-established perimeter security solutions.

More information

Topics in Network Security

Topics in Network Security Topics in Network Security Jem Berkes MASc. ECE, University of Waterloo B.Sc. ECE, University of Manitoba www.berkes.ca February, 2009 Ver. 2 In this presentation Wi-Fi security (802.11) Protecting insecure

More information

Deploying secure wireless network services The Avaya Identity Engines portfolio offers flexible, auditable management for secure wireless networks.

Deploying secure wireless network services The Avaya Identity Engines portfolio offers flexible, auditable management for secure wireless networks. Table of Contents Section 1: Executive summary...1 Section 2: The challenge...2 Section 3: WLAN security...3 and the 802.1X standard Section 4: The solution...4 Section 5: Security...4 Section 6: Encrypted

More information

Ebonyi State University Abakaliki 2 Department of Computer Science. Our Saviour Institute of Science and Technology 3 Department of Computer Science

Ebonyi State University Abakaliki 2 Department of Computer Science. Our Saviour Institute of Science and Technology 3 Department of Computer Science Security Measures taken in Securing Data Transmission on Wireless LAN 1 AGWU C. O., 2 ACHI I. I., AND 3 OKECHUKWU O. 1 Department of Computer Science Ebonyi State University Abakaliki 2 Department of Computer

More information

White paper. Testing for Wi-Fi Protected Access (WPA) in WLAN Access Points. http://www.veryxtech.com

White paper. Testing for Wi-Fi Protected Access (WPA) in WLAN Access Points. http://www.veryxtech.com White paper Testing for Wi-Fi Protected Access (WPA) in WLAN Access Points http://www.veryxtech.com White Paper Abstract Background The vulnerabilities spotted in the Wired Equivalent Privacy (WEP) algorithm

More information

Wireless Security for Mobile Computers

Wireless Security for Mobile Computers A Datalogic Mobile and Summit Data Communications White Paper Original Version: June 2008 Update: March 2009 Protecting Confidential and Sensitive Information It is every retailer s nightmare: An attacker

More information

All You Wanted to Know About WiFi Rogue Access Points

All You Wanted to Know About WiFi Rogue Access Points All You Wanted to Know About WiFi Rogue Access Points A quick reference to Rogue AP security threat, Rogue AP detection and mitigation Gopinath K. N. Hemant Chaskar AirTight Networks www.airtightnetworks.com

More information

Chapter 2 Wireless Networking Basics

Chapter 2 Wireless Networking Basics Chapter 2 Wireless Networking Basics Wireless Networking Overview Some NETGEAR products conform to the Institute of Electrical and Electronics Engineers (IEEE) 802.11g standard for wireless LANs (WLANs).

More information

Introduction to WiFi Security. Frank Sweetser WPI Network Operations and Security fs@wpi.edu

Introduction to WiFi Security. Frank Sweetser WPI Network Operations and Security fs@wpi.edu Introduction to WiFi Security Frank Sweetser WPI Network Operations and Security fs@wpi.edu Why should I care? Or, more formally what are the risks? Unauthorized connections Stealing bandwidth Attacks

More information

Attacking Automatic Wireless Network Selection. Dino A. Dai Zovi and Shane A. Macaulay {ddaizovi,smacaulay1}@bloomberg.com

Attacking Automatic Wireless Network Selection. Dino A. Dai Zovi and Shane A. Macaulay {ddaizovi,smacaulay1}@bloomberg.com Attacking Automatic Wireless Network Selection Dino A. Dai Zovi and Shane A. Macaulay {ddaizovi,smacaulay1}@bloomberg.com We made Slashdot! Hackers, Meet Microsoft "The random chatter of several hundred

More information

Network Access Security. Lesson 10

Network Access Security. Lesson 10 Network Access Security Lesson 10 Objectives Exam Objective Matrix Technology Skill Covered Exam Objective Exam Objective Number Firewalls Given a scenario, install and configure routers and switches.

More information

m-trilogix White Paper on Security in Wireless Networks

m-trilogix White Paper on Security in Wireless Networks m-trilogix White Paper on Security in Wireless Networks Executive Summary Wireless local area networks (WLANs) based on IEEE 802.11b (Wi-Fi) will ship, according to a Cahners- Instat study, 23.6 million

More information

ADDENDUM 12 TO APPENDIX 8 TO SCHEDULE 3.3

ADDENDUM 12 TO APPENDIX 8 TO SCHEDULE 3.3 ADDENDUM 12 TO APPENDIX 8 TO SCHEDULE 3.3 TO THE Overview EXHIBIT T to Amendment No. 60 Secure Wireless Network Services are based on the IEEE 802.11 set of standards and meet the Commonwealth of Virginia

More information

Chapter 6 CDMA/802.11i

Chapter 6 CDMA/802.11i Chapter 6 CDMA/802.11i IC322 Fall 2014 Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 Some material copyright 1996-2012 J.F Kurose and K.W. Ross,

More information

Wireless Networks. Welcome to Wireless

Wireless Networks. Welcome to Wireless Wireless Networks 11/1/2010 Wireless Networks 1 Welcome to Wireless Radio waves No need to be physically plugged into the network Remote access Coverage Personal Area Network (PAN) Local Area Network (LAN)

More information

Wireless security (WEP) 802.11b Overview

Wireless security (WEP) 802.11b Overview Wireless security (WEP) 9/01/10 EJ Jung 802.11b Overview! Standard for wireless networks Approved by IEEE in 1999! Two modes: infrastructure and ad hoc IBSS (ad hoc) mode Independent Basic Service Set

More information

WIRELESS NETWORK SECURITY

WIRELESS NETWORK SECURITY WIRELESS NETWORK SECURITY Much attention has been focused recently on the security aspects of existing Wi-Fi (IEEE 802.11) wireless LAN systems. The rapid growth and deployment of these systems into a

More information

WIRELESS NETWORKING SECURITY

WIRELESS NETWORKING SECURITY WIRELESS NETWORKING SECURITY Dec 2010 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without

More information

NETWORK ACCESS CONTROL AND CLOUD SECURITY. Tran Song Dat Phuc SeoulTech 2015

NETWORK ACCESS CONTROL AND CLOUD SECURITY. Tran Song Dat Phuc SeoulTech 2015 NETWORK ACCESS CONTROL AND CLOUD SECURITY Tran Song Dat Phuc SeoulTech 2015 Table of Contents Network Access Control (NAC) Network Access Enforcement Methods Extensible Authentication Protocol IEEE 802.1X

More information

Security in Wireless Local Area Network

Security in Wireless Local Area Network Fourth LACCEI International Latin American and Caribbean Conference for Engineering and Technology (LACCET 2006) Breaking Frontiers and Barriers in Engineering: Education, Research and Practice 21-23 June

More information

Computer Networks. Secure Systems

Computer Networks. Secure Systems Computer Networks Secure Systems Summary Common Secure Protocols SSH HTTPS (SSL/TSL) IPSec Wireless Security WPA2 PSK vs EAP Firewalls Discussion Secure Shell (SSH) A protocol to allow secure login to

More information

Recommended IP Telephony Architecture

Recommended IP Telephony Architecture Report Number: I332-009R-2006 Recommended IP Telephony Architecture Systems and Network Attack Center (SNAC) Updated: 1 May 2006 Version 1.0 SNAC.Guides@nsa.gov This Page Intentionally Left Blank ii Warnings

More information

Wireless Robust Security Networks: Keeping the Bad Guys Out with 802.11i (WPA2)

Wireless Robust Security Networks: Keeping the Bad Guys Out with 802.11i (WPA2) Wireless Robust Security Networks: Keeping the Bad Guys Out with 802.11i (WPA2) SUNY Technology Conference June 21, 2011 Bill Kramp FLCC Network Administrator Copyright 2011 William D. Kramp All Rights

More information

Table of Contents. Cisco Wi Fi Protected Access 2 (WPA 2) Configuration Example

Table of Contents. Cisco Wi Fi Protected Access 2 (WPA 2) Configuration Example Table of Contents Wi Fi Protected Access 2 (WPA 2) Configuration Example...1 Document ID: 67134...1 Introduction...1 Prerequisites...1 Requirements...1 Components Used...2 Conventions...2 Background Information...2

More information

Network security, TKK, Nov 2008 1

Network security, TKK, Nov 2008 1 Outline Network security: WLAN Security LAN technology Threats against WLANs Weak security mechanisms and WEP 802.1X, WPA, 802.11i Tuomas Aura, Microsoft Research, UK 2 LAN technology LAN (WLAN) standards

More information

WLAN - Good Security Principles. WLAN - Good Security Principles. Example of War Driving in Hong Kong* WLAN - Good Security Principles

WLAN - Good Security Principles. WLAN - Good Security Principles. Example of War Driving in Hong Kong* WLAN - Good Security Principles WLAN Security.. from this... Security Architectures and Protocols in Wireless LANs (Section 3) 1 2 WLAN Security.. to this... How Security Breaches Occur 3 War (wide area roaming) Driving/War Chalking

More information

Best Practices for Outdoor Wireless Security

Best Practices for Outdoor Wireless Security Best Practices for Outdoor Wireless Security This paper describes security best practices for deploying an outdoor wireless LAN. This is standard body copy, style used is Body. Customers are encouraged

More information

WIRELESS SECURITY TOOLS

WIRELESS SECURITY TOOLS WIRELESS SECURITY TOOLS Johanna Janse van Rensburg, Barry Irwin Rhodes University G01j202j7@campus.ru.ac.za, b.irwin@ru.ac.za (083) 944 3924 Computer Science Department, Hamilton Building, Rhodes University

More information

Securing end devices

Securing end devices Securing end devices Securing the network edge is already covered. Infrastructure devices in the LAN Workstations Servers IP phones Access points Storage area networking (SAN) devices. Endpoint Security

More information

The Importance of Wireless Security

The Importance of Wireless Security The Importance of Wireless Security Because of the increasing popularity of wireless networks, there is an increasing need for security. This is because unlike wired networks, wireless networks can be

More information

Running Head: WIRELESS DATA NETWORK SECURITY FOR HOSTPITALS

Running Head: WIRELESS DATA NETWORK SECURITY FOR HOSTPITALS Wireless Data Network Security 1 Running Head: WIRELESS DATA NETWORK SECURITY FOR HOSTPITALS Wireless Data Network Security for Hospitals: Various Solutions to Meet HIPAA Requirements. Jody Barnes East

More information

A Dynamic Extensible Authentication Protocol for Device Authentication in Transport Layer Raghavendra.K 1, G. Raghu 2, Sumith N 2

A Dynamic Extensible Authentication Protocol for Device Authentication in Transport Layer Raghavendra.K 1, G. Raghu 2, Sumith N 2 A Dynamic Extensible Authentication Protocol for Device Authentication in Transport Layer Raghavendra.K 1, G. Raghu 2, Sumith N 2 1 Dept of CSE, P.A.College of Engineering 2 Dept of CSE, Srnivas institute

More information

Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1

Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1 Industrial Network Security for SCADA, Automation, Process Control and PLC Systems Contents 1 An Introduction to Industrial Network Security 1 1.1 Course overview 1 1.2 The evolution of networking 1 1.3

More information

WHITE PAPER. Wireless LAN Security for Healthcare and HIPAA Compliance

WHITE PAPER. Wireless LAN Security for Healthcare and HIPAA Compliance WHITE PAPER Wireless LAN Security for Healthcare and HIPAA Compliance Wireless LAN Security for Healthcare and HIPAA Compliance Wireless deployments in healthcare institutions have accelerated as mobility

More information

Design and Implementation Guide. Apple iphone Compatibility

Design and Implementation Guide. Apple iphone Compatibility Design and Implementation Guide Apple iphone Compatibility Introduction Security in wireless LANs has long been a concern for network administrators. While securing laptop devices is well understood, new

More information

WHITEPAPER. Wireless LAN Security for Healthcare and HIPAA Compliance

WHITEPAPER. Wireless LAN Security for Healthcare and HIPAA Compliance WHITEPAPER Wireless LAN Security for Healthcare and HIPAA Compliance Wireless LAN Security for Healthcare and HIPAA Compliance Wireless deployments in healthcare institutions have accelerated as mobility

More information

TECHNICAL NOTE REFERENCE DOCUMENT. Improving Security for Axis Products. Created: 4 October 2007. Last updated: 11 October 2007. Rev: 1.

TECHNICAL NOTE REFERENCE DOCUMENT. Improving Security for Axis Products. Created: 4 October 2007. Last updated: 11 October 2007. Rev: 1. TECHNICAL NOTE REFERENCE DOCUMENT Improving Security for Axis Products Created: 4 October 2007 Last updated: 11 October 2007 Rev: 1.0 TABLE OF CONTENTS 1 INTRODUCTION 3 2 BEST-PRACTICE SECURITY POLICIES

More information

Beyond the Firewall No. 72 March, 2012 Wireless LAN Edition

Beyond the Firewall No. 72 March, 2012 Wireless LAN Edition Wireless LAN infrastructure is now an increasingly common part of corporate enterprises. With wireless LAN infrastructure, new productivity gains can be realized. With this infrastructure though comes

More information

Closing Wireless Loopholes for PCI Compliance and Security

Closing Wireless Loopholes for PCI Compliance and Security Closing Wireless Loopholes for PCI Compliance and Security Personal information is under attack by hackers, and credit card information is among the most valuable. While enterprises have had years to develop

More information

JK0 015 CompTIA E2C Security+ (2008 Edition) Exam

JK0 015 CompTIA E2C Security+ (2008 Edition) Exam JK0 015 CompTIA E2C Security+ (2008 Edition) Exam Version 4.1 QUESTION NO: 1 Which of the following devices would be used to gain access to a secure network without affecting network connectivity? A. Router

More information

WIRELESS SECURITY IN 802.11 (WI-FI ) NETWORKS

WIRELESS SECURITY IN 802.11 (WI-FI ) NETWORKS January 2003 January WHITE 2003 PAPER WIRELESS SECURITY IN 802.11 (WI-FI ) NETWORKS With the increasing deployment of 802.11 (or Wi-Fi) wireless networks in business environments, IT organizations are

More information

How Cisco Tracks RFID with Active RFID and Wireless LANs

How Cisco Tracks RFID with Active RFID and Wireless LANs How Tracks RFID with Active RFID and Wireless LANs Active RFID tags and WLANs ensure compliance with corporate finance and government regulations. IT Case Study / Wireless / RFID Solutions: Maintaining

More information

Ensuring HIPAA Compliance in Healthcare

Ensuring HIPAA Compliance in Healthcare The Intelligent Wireless Networking Choice WHITE PAPER Ensuring HIPAA Compliance in Healthcare Overview Wireless LANs are prevalent in healthcare institutions. The constant need for mobility among doctors,

More information

IT-Sicherheit: Sicherheitsprotokolle. Wireless Security. (unter Benutzung von Material von Brian Lee und Takehiro Takahashi)

IT-Sicherheit: Sicherheitsprotokolle. Wireless Security. (unter Benutzung von Material von Brian Lee und Takehiro Takahashi) IT-Sicherheit: Sicherheitsprotokolle Wireless Security (unter Benutzung von Material von Brian Lee und Takehiro Takahashi) ! 61 ints 5 2 Po ss e c Ac 3 Built in Security Features!!!!!! Service Set Identifier

More information

Wireless Threats To Corporate Security A Presentation for ISACA UK Northern Chapter

Wireless Threats To Corporate Security A Presentation for ISACA UK Northern Chapter Wireless Threats To Corporate Security A Presentation for ISACA UK Northern Chapter Introduction Who are we? Matt Moore, Senior Consultant @ PenTest Ltd. Mark Rowe, Technical Director @ PenTest Ltd. What

More information

WiFi Security: Deploying WPA/WPA2/802.1X and EAP in the Enterprise

WiFi Security: Deploying WPA/WPA2/802.1X and EAP in the Enterprise Michael Disabato Service Director Network & Telecom Strategies mdisabato@burtongroup.com Diana Kelley Senior Analyst Security & Risk Management Strategies dkelley@burtongroup.com www.burtongroup.com WiFi

More information

Implementing Security for Wireless Networks

Implementing Security for Wireless Networks Implementing Security for Wireless Networks Action Items for this session Learn something! Take notes! Fill out that evaluation. I love to see your comments and we want to make these better! Most important:

More information

Wireless Network Security. Pat Wilbur Wireless Networks March 30, 2007

Wireless Network Security. Pat Wilbur Wireless Networks March 30, 2007 Wireless Network Security Pat Wilbur Wireless Networks March 30, 2007 Types of Attacks Intrusion gain unauthorized access to a network in order to use the network or Internet connection Types of Attacks

More information

Wi-Fi Client Device Security and Compliance with PCI DSS

Wi-Fi Client Device Security and Compliance with PCI DSS Wi-Fi Client Device Security and Compliance with PCI DSS A Summit Data Communications White Paper Original Version: June 2008 Update: January 2009 Protecting Payment Card Information It is every retailer

More information

If security were all that mattered, computers would never be turned on, let alone hooked into a network with literally millions of potential intruders. Dan Farmer, System Administrators Guide to Cracking

More information

Wireless Network Security Challenges

Wireless Network Security Challenges Wireless Network Security Challenges SHARE Summer 2010 Boston Laura Knapp WW Business Consultant Applied Expert Systems (www.aesclever.com) laurak@aesclever.com laura@lauraknapp.com Networking - Connecting

More information

Wireless Authentication and Encryption: A Primer

Wireless Authentication and Encryption: A Primer Wireless Vulnerability Management Wireless Authentication and Encryption: A Primer Presented by: Hemant Chaskar, PhD Director of Technology AirTight Networks 2008 AirTight Networks, Inc. All Rights Reserved.

More information

BSc (Hons.) Computer Science with Network Security. Examinations for 2011/2012 - Semester 2

BSc (Hons.) Computer Science with Network Security. Examinations for 2011/2012 - Semester 2 BSc (Hons.) Computer Science with Network Security BCNS/09/FT Examinations for 2011/2012 - Semester 2 MODULE: WIRELESS NETWORK SECURITY MODULE CODE: SECU 3105 Duration: 2 Hours 15 Minutes Reading time:

More information

WHITE PAPER. WEP Cloaking for Legacy Encryption Protection

WHITE PAPER. WEP Cloaking for Legacy Encryption Protection WHITE PAPER WEP Cloaking for Legacy TM Encryption Protection Introduction Wired Equivalent Privacy (WEP) is the encryption protocol defined in the original IEEE 802.11 standard for Wireless Local Area

More information

Wireless Technology Seminar

Wireless Technology Seminar Wireless Technology Seminar Introduction Adam Worthington Network Consultant Adam.Worthington@euroele.com Wireless LAN Why? Flexible network access for your users? Guest internet access? VoWIP? RFID? Available

More information