When posed the question “how secure is your corporate wireless,” the answer we hear many times is “pretty secure” when we’re doing assessments with clients.
It’s kind of a loaded question, right? What exactly does secure mean when we’re talking about wireless? Well, there are a few key things we look at for starters:
- Network segmentation
- Password control
- Encryption type
Let’s dig into each of these items a bit more.
Network Segmentation
Many clients setup their wireless infrastructure to be an extension of their wired LAN.
In other words, if a user were to join the wireless access point with a laptop, he/she would be able to do anything that could be done if the user had plugged the laptop into the regular corporate wired network. This means that if a malicious user was sitting in your parking lot and was able to gain access to your wireless, your entire infrastructure–servers, wireless routers, workstations, wireless devices, everything– would be at risk.
Unfortunately, we also often find that companies allow guests to connect to their Wi-Fi network to check email and browse the internet, assuming the attention of their guests are good. However, people are the biggest risk when it comes to information security, so our recommendations in cases like these include some or all of the following changes:
- Divide Guest and Corporate Wireless
- First, reconfigure your wireless into an internal corporate segment (only to be used by company users/devices) and a second “guest only” segment.
- Lockdown Both Networks
- The “guest only” segment should be set up to allow users to connect to the internet, and that’s it. No traffic–including DNS requests–should pass into the production network. In fact, if the guest wireless can be a completely separate internet connection and network hardware, even better!
- Additionally, ensure technical access controls are in place to protect the connection and filter traffic. We’ve worked with customers who have had their guest internet connections abused by individuals downloading illegal software, music, and movies.
Password Control
More often than not, we find that companies set up wireless security configurations when the access points were originally installed, and they haven’t been touched since. This is understandable since in most configurations, changing the password would involve touching many connected devices manually to get them to reconnect.
But, usually, default settings do not include strong passwords. Strong passwords and good password control are simple efforts in protecting your devices, so this is a necessary effort.
Also, we tend to find that the wireless password is freely available–it’s posted on the break room or other public areas for employees and visitors to see.
The following recommendations are common:
- Don’t Post the Wireless Passwords Everywhere
- For your corporate wireless segment, do all the employee iPhones really need to connect to it–for example, to talk with an internal server or application? Or, do they really just need Internet access to be able to keep tabs on email and Facebook? One approach would be to offer employees the “guest only” internet password for their personal devices and keep only the corporate systems on internal wireless.
- For office guests, offer the “guest only” password upon request, rather than have it posted freely in the lobby.
- Rotate Wireless Passwords Regularly
- For example, if you force users to change passwords every 90 days, update your wireless passwords every 90 days too.
Encryption Type
When it comes to encrypting your wireless connections, there are many terms and configurations to learn about and be familiar with.
But, for the most part, we find companies use the following types of encryption: WEP (wired equivalent), WPA and WPA2.
And, in some cases, we see access points running “wide open,” meaning users need no password or form of authentication to join–much like you’d see at your local coffee shop.
Here are a few things we look for, and recommendations we make, when looking at wireless encryption:
- Open Should Be Shut
- In general, even if your access points are segmented and secured properly, running wireless “wide open” is a significant security risk. You essentially have no control over who connects to your access point, and depending on what kinds of activities users partake in online (such as downloading pirated music and movies, as mentioned earlier), your internet connection could get suspended and your company could face legal action.
- Don’t Use WEP
- Check your access points and ensure they are not using WEP encryption. To put it simply, WEP is an older type of encryption that can be very easily broken. I recently did a demonstration for a friend who used WEP on their home network. Using tools freely available on the internet, I was able to launch a script that broke his WEP encryption key in under 2 minutes.
- WPA/WPA2 Passwords Need to Be Long and Strong
- Currently, WPA/WPA2 are a few of the encryption standards that are considered to be very secure. However, it’s important to know that this type of encryption does not give us an excuse to use weak passwords to secure the connection. If a bad guy is able to capture the “handshake” that takes place between workstations and the access points (very easy to do), the bad guy can then run that handshake file against a database of words and phrases and if there’s a match–boom!–he’s got your password.
To put it in perspective, there are services online that will allow you to upload a handshake file and for just a few dollars, check the handshake against 300 million passwords in under a half-hour. So, suffice to say, using a password like twins123 or vikings2014 is not going to cut it.
Instead, use a best-in-class password manager utility that has the ability to generate passwords, and make it give you one with a long combination of uppercase and lowercase characters, as well as special characters, such as 05GcA^Hb!$LzjKAEzujk.
Summary
In summary, it’s important to give your wireless network proper–and continuous–care. This includes correct segmentation, strong encryption, and strict control over who and what connects to it.
Keep in mind, these are specific technical controls to address what is really a people problem, as people are always the biggest risk in information security. These technical controls need to be backed by proper policy and governance as part of a managed and maintained information security program.
For assistance with best practices for corporate wireless network security or other ways to improve the security at your organization, visit frsecure.com to learn more.
