Wireless Network Security Position Paper. Overview for CEO s

Transcription

1 Wireless Network Security Position Paper Overview for CEO s VERSION 1.1 December 2007

2 Acknowledgement This document was written with the assistance of the Department of the Premier and Cabinet.

3 Table of Contents 1. Purpose and Scope Position Statement Introduction What are the Risks? What Should be Done? Be aware of the technical and security implications Carefully plan the deployment of any wireless technology Recommendations...9 Recommendation 1 Develop a Strategy...9 Recommendation 2 Develop a Business Case...9 Recommendation 3 Develop Policies and Ensure Compliance...9 Recommendation 4 Monitor for Wireless Devices...10 Recommendation 5 Use only Best Practice WLAN Mode Conclusion...11 Department of Finance 3

4 1. Purpose and Scope The purposes of this paper are to raise awareness of security risks posed by wireless computer networks, and to provide some high-level guidance for establishing secure wireless networks. This paper targets security for Wireless Local Area Networks (WLANs) using the standard typically used to install WLANs in Western Australian Government agencies (IEEE ). Other wireless technologies and external networks, such as public Internet access points ( hot spots ) are outside the scope of this paper. A Wireless Network Security Position Paper - Technical has also been developed to provide more detailed guidance on the management, operational and technical issues and recommendations for the secure deployment of wireless local area networks to agencies management and technical staff. This paper and the Wireless Network Security Position Paper Technical have been developed in response to the Auditor General's Second Public Sector Performance Report 2007, Report 3 April Department of Finance 4

5 2. Position Statement Key findings of the Auditor General's Second Public Sector Performance Report 2007, Report 3 April 2007 show serious weaknesses at the strategic, policy and operational levels in almost all agencies audited that had deployed wireless networks. Premier s Circular 2004/09 (Computer Information and Internet Security) noted that on 20 January 2003, Cabinet directed that the Chief Executive Officer of each agency is responsible for ensuring their agency implements an appropriate level of information and Internet security. In light of the Auditor General s findings, agencies should consider and implement the recommendations laid out in this paper for new and existing wireless networks. Department of Finance 5

6 3. Introduction Wireless communications offer agencies and users many benefits, such as portability, flexibility, increased productivity, and lower installation costs. Wireless technologies cover a broad range of differing capabilities oriented toward different uses and needs. Wireless local area network (WLAN) devices, for instance, allow users to move their laptops from place to place within their offices without the need for wires and without losing network connectivity. Less wiring means greater flexibility, increased efficiency and reduced wiring costs. However, risks are inherent in any wireless technology. Some of these risks are similar to those of wired networks; some are exacerbated by wireless connectivity; some are new. Perhaps the most significant source of risks in wireless networks is that the technology s underlying communication medium, the airwave, is open to intruders, making it the equivalent of installing a wired network connection outside your building that anyone can access. Despite the additional security risks to networks, the use of wireless devices and WLANs is growing rapidly. In fact, many devices today such as laptops are now wireless enabled by default. Department of Finance 6

7 4. What are the Risks? The loss of confidentiality and integrity and the threat of denial of service attacks are risks typically associated with wireless communications. Unauthorised users may easily gain access to an agency s systems and information, corrupt data, consume network bandwidth, degrade network performance, launch attacks that prevent authorised users from accessing the network, or use the agency s resources to launch attacks on other networks. A particular danger with wireless technologies highlighted by the Auditor General is that they can be easily procured and installed without the knowledge of management. As well, laptops connected to the wired network with the wireless card enabled pose an ongoing risk to agencies networks. Department of Finance 7

8 5. What Should be Done? 5.1 Be aware of the technical and security implications Although wireless technologies offer significant benefits, they also pose unique security challenges over and above those posed by wired networks. The coupling of relative immaturity of the technology with poor legacy security standards, flawed implementations, limited user awareness, and lax security and administrative practices forms an especially challenging combination. In a wireless environment, data is broadcast through the air. There are no physical controls over the boundaries of transmissions or the ability to use the physical security controls typically available with wired connections. As a result, data may be captured beyond the physical location that the wireless network was intended to serve. Because of differences in building construction, wireless frequencies and attenuation, and the capabilities of high-gain antennas, the distances necessary for positive control for wireless technologies to prevent eavesdropping can vary considerably. 5.2 Carefully plan the deployment of any wireless technology To be effective, WLAN security should be incorporated throughout the life cycle of all WLAN solutions, involving everything from strategy and policy, through to procurement, operations and disposal. Department of Finance 8

9 6. Recommendations Implementing the recommendations presented in this paper for a new or existing WLAN will ensure that accepted wireless networking best practice is met, and will provide reasonable assurance that an agency is protected against most currently known WLAN security threats. Recommendation 1 Develop a Strategy Agencies wishing to deploy wireless devices must be able to provide an overall documented vision for how the WLAN would support their business mission, creating a high-level strategy for the WLAN s implementation. Recommendation 2 Develop a Business Case In light of the security issues, any deployment of wireless technology on an agency's computing network must be subject to usual risk management processes and underpinned by a sound business case as to why this technology should be used. Recognising and documenting the benefits, costs and risks in a business case is something that can be done relatively easily and does not require voluminous documentation. A business case should specify business and functional requirements for a WLAN solution. A business case for a WLAN is strengthened if it can link to an overall WLAN strategy. Recommendation 3 Develop Policies and Ensure Compliance The cornerstone of an effective WLAN security strategy involves documenting, deploying and enforcing WLAN security policies and practices. A security policy, and compliance therewith, is the foundation on which other operational and technical countermeasures are rationalised and implemented. Department of Finance 9

10 Recommendation 4 Monitor for Wireless Devices All agencies should develop, and exercise, the capability to monitor for rogue wireless networks. Even agencies that do not believe they have any wireless devices on their network should have the capability to detect any rogue wireless devices that may have been installed without the knowledge or authority of the persons responsible for such matters. Creating a wireless access point or intercepting wireless signals can be done simply and cheaply and must therefore be monitored. As well, laptops connected to the wired network with the wireless card enabled pose an ongoing risk to agencies networks and should be monitored for by wireless or wired network detection capabilities. Agencies with WLANs installed should also periodically review security arrangements such as the strength of transmission signals and co-channel interference from other wireless networks in the vicinity. Recommendation 5 Use only Best Practice WLAN Mode An IEEE802.11i RSN using AES-CCMP with IEEE 802.1X and EAP-TLS authentication should be the only mode used for any government WLANs. The technical details of this mode are detailed in the Wireless Network Security Position Paper Technical. At the time of writing, this is consistent with the mode required for the transmission of classified information (below Top Secret) in Commonwealth Government agencies that are bound by the security specifications set out in the Defence Signals Directorate Australian Government Information Security Manual (ISM). Whilst State Government agencies are not bound by the ISM it is regarded as best practice to follow the security instructions from this manual. Department of Finance 10

11 7. Conclusion The deployment of insecure wireless networks poses new security threats to agencies computer networks and information. The Auditor General has identified serious weaknesses at the strategic, policy and operational levels in almost all agencies audited that had deployed wireless networks. The Chief Executive Officer of each agency is responsible for ensuring their agency implements an appropriate level of information and Internet security. To this end, agencies should consider and implement the recommendations above. More detailed and technical information is available in the Wireless Network Security Position Paper Technical. Any queries on the issues discussed in this paper or general requests for further information can be directed to: Gail Holt, Principal Policy Officer, Department of Finance on Department of Finance 11

12 Optima Centre 16 Parkland Road, Osborne Park WA 6017 Postal Address: Locked Bag 11, Cloisters Square, Perth WA 6850 E: W: