As with many new technologies, IT seems to have let wireless networking gain a foothold in the enterprise without properly securing it. The news abounds with corporate penetrations facilitated via weak wireless security—particularly ubiquitous 802.11 "WiFi" WLANs. The fallout has cost industry billions of dollars in outright theft, lost business, and remediation expense. One recent high profile case—the TJX WiFi point-of-sale debacle that dumped 40 million consumer credit card records into the hands of identity thieves—was settled with U.S. state regulators for nearly $10 million in fines. And this was on top of untold millions in losses to compromised consumers.

If you don’t want to be the next IT staffer explaining to news media just how the hackers managed to steal your corporation’s info assets, better read on; chances are your WLAN has one or more well-known exposures just waiting to be exploited. A recent survey of financial districts by WiFi security vendor AirTight Networks (tinyurl.com/atstudy [2]) showed 57 percent of the WLANs in seven cities were subject to immediate, trivial compromise. Worse, a large fraction of these were using outdated security practices, indicating their owners believed they were protecting themselves.

That’s the bad news. The good news is that it is possible to securely integrate WiFi into your enterprise IT ecosystem. The semi-good news is that you may be legally required to take measures to screw down wireless security, which will help you justify the costs of such measures to management. If, like many enterprises, you already have WiFi, it’s also straightforward to assess your existing WLAN’s exposures and remediate your network to counter them. But the process isn’t automatic, or even intuitive. You must first learn about the latest wireless vulnerabilities and the technologies you can call on as defensive measures. There’s no better way to do that than to study the aftermath of one highly visible disaster.

Legal News Hot Off the Press

The TJK incident led to new corporate governance rules that may affect you, so listen up. As a result of the massive blow TJK’s data breach dealt to the retail sales industry, in late 2008 the Payment Card Industry Security Standards Council (PCI SSC) published a new PCI DSS Wireless Guideline that literally lays down the law for any organization processing credit or debit cards. Retailers scrambled to make their point-of-sale WiFi networks compliant.

Then in June 2009 PCI SSC issued a clarification stating that the new rules applied not just to wireless POS, but to any organization—with or without WiFi—that even touches the credit card transaction data flow. You may well fall into this new category of governed organization.

The WiFi-specific PCI rules in PCI DSS 1.2 (tinyurl.com/pcidss12) are not numerous, but they are not trivial. Compliance requires the following steps:

• Firewall WLANs carrying cardholder data from LANs and other networks. Bridging WiFi and LAN traffic is a convenient, but insecure, wireless method that you must now shun. Any WLAN that payment card transactions traverse must be isolated so that a non-wireless security fault does not expose cardholder data. PCI DSS includes under this requirement formal documentation of your network, in the form of a comprehensive network diagram—covering both wireless and wired networks—depicting the path of cardholder data.
• Change all default WiFi security settings shipped with wireless gear. This means the SSID, encryption keys, and administrative access controls (HTTP and SSH administrative passwords, SNMP community strings, and any other means of remote access).
• Enable only strong WPA encryption. WEP is now officially disallowed. Ideally you’ll use a strong form of the WPA2 standard; more on that shortly. Many enterprises do use WPA/WPA2, but inadvertently leave WEP turned on, thus giving hackers easy entrée. In case you missed the news, WEP is completely vulnerable to penetration in minutes by any kid with an iPod touch.
• Assign a unique ID to each wireless user. This rules out the use of WPA2 shared secrets. WPA2 “enterprise” protection uses unique user IDs and credentials—in the form of passwords, security tokens, or both—to ensure that the compromise of one user’s access doesn’t open up the entire network. The PCI DSS spec actually requires two-factor authentication for any form of remote access. Given that most POS networks are remote from the enterprise HQ, two-factor authentication is essentially a mandate.
• Regularly test security systems and processes. The standard only calls for quarterly network vulnerability scans, but we all know how useless those are. To be really secure you must employ a Wireless Intrusion Prevention System (WIPS) that continuously scans for vulnerabilities. One vulnerability to absolutely curtail is the rogue access point, discussed in more detail below. PCI DSS also requires semi-annual written reviews of firewall and router rule sets.
• Update your Information Security Policy to address wireless aspects. At a minimum you’ll have to add to your policy the roles assigned to accomplish the various new PCI DSS requirements. You should also enumerate WiFi-specific monitoring tasks and the frequency of review for firewalls and routers supporting WiFi POS networks.

Even if you don’t fall under the aegis of PCI SSC, that specification is a useful low bar to aim for in your own wireless security stance. It’s a low bar because, despite its seemingly comprehensive rules, PCI SSC doesn’t address every exposure that WiFi brings to your network. Before finalizing your wireless security plan, it’s a good idea to review just what the latest vulnerabilities are.

Vulnerabilities Old and New

The 802.11 WiFi standards are among the most volatile in industry, changing on almost a monthly basis. The standards cover new technologies as they are developed, such as the 802.11n high-performance specification. But they also cover existing specs: the WiFi Protected Access (WPA) standard has been revised several times to address newly discovered vulnerabilities. Here is a cheat-sheet on vulnerabilities you should know about and mitigate:

• WEP/WPA encryption. As noted earlier, the old WEP head is dead. If you’re still using WEP, stop immediately and switch to WPA. But not just any WPA; you should go straight to WPA2. The first iteration of WPA was a knee-jerk reaction to the alarming weakness of WEP, and unfortunately has too many faults of its own to seriously consider for enterprise security. WPA2 is much more robust, but even then you must take care to employ it in its strongest form. The preshared-key WPA2 authentication method leaves your network open to total compromise should that shared secret get out, or be too easy to guess in the first place. The best WPA2 has to offer today is AES 265-bit encryption with per-user access credentials. And the best of the best is to employ two-factor authentication as well, in the form of biometric, token, or one-time-password factors.

• Rogue Access Points. Considered the second most prevalent exposure in enterprise WLANs, a rogue access point is a WiFi Access Point (AP) attached to a network without the permission, or knowledge, of the network owner. Employees are famous for attaching consumer-grade WiFi gear to eliminate pesky cables across the cubicle floor or to provide unofficial mini-hotspots for the convenience of notebook and netbook users. These can often be exploited by hackers from a nearby parking lot to scan and attack assets behind the corporate firewall.

  You should first establish a formal policy prohibiting rogues, and ensure that everyone gets the memo. But you’ll also have to be proactive in finding and eliminating rogues on a continuous basis. You can do that with an off-the-shelf WISP, and also by locking down vulnerable LAN ports using Network Access Control (NAC). WISPs detect rogues by periodically scanning for them using existing APs, then alerting you to their presence for removal. NAC, properly implemented, can stop a rogue from ever getting a port, by dint of requiring 802.1x authentication (MAC address or user ID and password login) for every Ethernet device.

• Counterfeit Access Points. While rogue APs are generally accidental, a counterfeit AP is a hostile act: someone configuring an AP near your premises to mimic your legitimate WiFi network, hoping to lure users into accidental connections. Once connected, the unsuspecting user may seem to be getting access to your LAN, but is actually subject to man-in-the-middle attacks by the interloper.

  One defense against counterfeiters is WPA2 with digital certificate authentication. You create a signed digital cert on your WPA2 authentication controller and install it on every user’s remote client. When the user connects, the cert automatically verifies that the AP being accessed belongs to your network and not the hacker’s. Alas, distributing and maintaining these certs can be an administrative nightmare.

  A better approach is to employ a wireless controller that establishes a VPN tunnel to each user. The VPN automatically performs just this kind of certificate validation, and it is completely independent of encryption performed in the AP, adding another layer of protection between users and hackers. If you can’t forklift upgrade your existing WiFi infrastructure to add this feature, an easy way to gain it is via an SSLVPN appliance: users connect to the appliance using a web browser to create an HTTPS-based VPN tunnel overlaying the existing WiFi network. You can then block all other network access from WiFi.

• Coffee Klatch Clutch. Users are now mobile, and fond of connecting via WiFi technologies from airports, coffee shops, or anywhere they can get a hotspot hookup. Few of these connections are encrypted, and many of them have hackers sipping a brew while trolling for victims using counterfeit APs and other connection deceptions.

  Guard against this exposure by extending VPN tunneling to these outside venues. You often can use the very same VPN server—WiFi controller, VPN concentrator, or SSLVPN appliance—as both WAN and LAN secure gateways. To fully enforce this protection, you’ll have do disallow casual Internet surfing at hot spots. Do this by disabling split-network wireless, so that all Internet access goes through the VPN tunnel (and your main office Internet connection), rather than directly to the Internet via the hotspot’s router.

  NAC can help here, in the form of an endpoint widget installed on every client device to implement your security policy prohibiting direct remote web surfing. Many smart phones, such as the iPhone, now have this capability built in via their enterprise administration interfaces.

As you can see, despite the strong security stance of PCI DSS, even that standard doesn’t protect against roaming user vulnerabilities, since retail sales from coffee shops was never envisioned as a possibility. When designing your new enterprise WiFi rollout—or planning security remediation of your existing network—you should take care to ensure you cover each of these critical exposures.

Intrusion Prevention in the Large

The vulnerabilities above highlight the value of WiFi-specific intrusion prevention systems, but they don’t cover all the bases of what WIPS can accomplish. Those are the minimal features you should seek to mitigate WiFi vulnerabilities. Other major features include ad-hoc wireless prevention, denial of service attack (DoS) blocking, and hostile device blacklisting.

Ad-hoc WiFi connections are those made between end user devices, such as two notebook connections. Users often start using ad-hoc connectivity for the convenience of moving files directly between computers without an intervening server, and sometimes to circumvent policies prohibiting data exchange between users in different groups, such as sales and engineering. The problem with ad-hoc connections is that they don’t require passwords or encryption, and thus can leak sensitive information to waiting hackers. And users often don’t close ad-hoc services when they’re done with them, leaving a notebook or desktop open to attachment by passersby, with the attendant bad consequences.

Because ad-hoc connections occur at will between cooperating (and oblivious) users that may not even be connected to the corporate LAN, they’re difficult for traditional IPS systems to prevent. If you have administrative control of a Windows XP or Vista device, you can push a policy restricting WiFi to infrastructure-only connections, which blocks the ad-hoc variety. But Mac OS X, Unix, and some smart phone devices would still be ad-hoc enabled. Some WISP systems can employ dedicated wireless security sensors dedicated to probing the airwaves for problems such as ad-hoc connections, and they have the ability to force them to disconnect.

DoS attacks are prosecuted by hackers intent on breaking something, hoping that the breakage will leave your network open and vulnerable to penetration. Several such attacks exist today in the wild, although the latest vendor patches will at least stop the exposure, if not the actual denial of service. A good Intrusion Prevention System, however, is able to instruct your APs and WiFi controllers to ignore attacking MAC addresses, or to rate limit associations and other protocol events, blunting the attacks and in many cases neutralizing them entirely.

That neutralization comes in handy when chronic wireless bad actors appear. Wireless networking knows no boundaries, so sometimes a malicious attacker or benign interferer lies physically just beyond the reach of the IT enforcement squad. Dynamic WIPS detection and prevention is designed to only temporarily block such attackers, eventually letting their bad behavior resume until it once again seems to be a threat. You really want to permanently blacklist these evil seeds, both to prevent constant WIPS alerts, and to ensure that troublemakers don’t interfere with legitimate users. WIPS systems accomplish blacklisting by recording a unique signature for each potential intruder. At any time you can mark that signature as periphera non gratis, so to speak, and the WIPS system will instruct all APs to keep the annoyer at bay.

The flip side of blacklisting is whitelisting, and it is equally important. Sometimes a wireless device just looks threatening and thus gets constantly interdicted by your WISP. If you own the device, that’s a nuisance. If a neighboring company owns it, that’s a lawsuit. You want a WISP that can accurately classify friends and foes, but when it misses, lets you register friendlies as friends, protected against WISP harassment.

Other features you should look for in a WIPS include alert level filtering, to keep you from getting paged constantly by innocuous events, reporting that proves the WIPS was operational to regulatory agencies, and event tracking to help you assess the levels of attack your network is experiencing over time.

Turn On but Don’t Tune Out

Securely deploying WiFi isn’t impossible or even necessarily difficult. But you have to understand the risks you’re trying to mitigate and the changing WiFi technology landscape, as well as available product features, before you can lock down your WLAN. Only then will it be safe to watch the evening news.

Mel Beckman is a senior technical editor for System iNEWS.