Presentation

Evaluating Wireless NetworksPCIE IT Roundtable

Evaluating Wireless Networks

PCIE IT Roundtable WorkshopOctober 14, 2003

2

Evaluating Wireless NetworksPCIE IT Roundtable

Outline

• Introduction to wireless networks• Threats and vulnerabilities• Evaluating wireless networks

• Objectives• Methodology• Tools• Findings• Recommendations

• Conclusion

3

Evaluating Wireless NetworksPCIE IT Roundtable

Introduction to Wireless Networks

• Rapid growth computer communications technology

• Agencies increasingly use wireless networks• Enhanced mobility• Greater productivity• Low implementation costs• Painless installation

4

Evaluating Wireless NetworksPCIE IT Roundtable

Introduction to Wireless Networks (cont.)

• Use of radio waves instead of cables• Major standard

• Institute of Electrical and Electronic Engineers (IEEE) 802.11, Wireless Local Area Networks

• Components of a Wi-Fi network• Access Points (Hot Spot)• Wireless clients (e.g. laptops, PDAs)

5

Evaluating Wireless NetworksPCIE IT Roundtable

6

Evaluating Wireless NetworksPCIE IT Roundtable

Threats

• Disclosure of sensitive/confidential data• Denial of service (DoS)• Unauthorized access to wireless-enabled

resources• Potential weakening of existing security

measures on connected wired networks and systems

7

Evaluating Wireless NetworksPCIE IT Roundtable

8

Evaluating Wireless NetworksPCIE IT Roundtable

Vulnerabilities

• Wired Equivalent Privacy (WEP) encryption standard extremely weak

• Radio signals susceptible to jamming and interference• Protocol vulnerabilities allow

• Network sessions to be taken over by an intruder• Injection of invalid data into network traffic• Network reconnaissance

• Default configurations create “open” network

9

Evaluating Wireless NetworksPCIE IT Roundtable

Wireless Automatically Enabled

“Roam if you want to. Windows XP automatically recognizes the 802.11 wireless network you’re near and connects you to it.” Microsoft Windows XP Retail box

10

Evaluating Wireless NetworksPCIE IT Roundtable

Evaluating Wireless Networks

• Wireless networks are• Easy to implement• Difficult to secure

• Policies often have not been developed

11

Evaluating Wireless NetworksPCIE IT Roundtable

Evaluation Objectives

• Assess the current Agency position regarding wireless networks

• Examine the use of wireless technology• Evaluate the security of the wireless network and

applications including threats to• Data integrity• Confidentiality• Availability of services and resources

• Determine the level of user awareness of wireless technology

12

Evaluating Wireless NetworksPCIE IT Roundtable

Evaluation Methodology

• External scanning to illustrate the ease with which unauthorized persons could intercept wireless signals

• Internal scanning and physical inspection to verify the source of signals

• Traffic analysis to see if sensitive data is being transmitted, if transmissions are encrypted, and how vulnerable the networks are to attack

• Review network topologies to assess connectivity to wired networks and determine measures to protect wired networks

• Meet with wireless users and administrators to assess awareness, employee expertise, and strength of security measures

13

Evaluating Wireless NetworksPCIE IT Roundtable

Content Analysis

• Characterize data on the network• View potential vulnerabilities• Determine appropriate network use• Assist in review of policy conformance• 18 USC 2511(2)(a)(i) allows protectors of

systems (non law-enforcement) to look at content of wireless transmissions

14

Evaluating Wireless NetworksPCIE IT Roundtable

Evaluation Tools

• Hardware• Laptop• Wireless network card• Antenna• GPS

• Wireless sniffing software• WEP encryption cracking software• Mapping software

15

Evaluating Wireless NetworksPCIE IT Roundtable

Findings

• Wireless networks with inadequate security• Range of wireless networks exceed physical boundaries

of user organizations• Non-existent or inadequate policies for wireless networks• No risk assessments were performed prior to wireless

implementation• No logical separation of wireless networks from wired

counterparts• Insufficient employee awareness

16

Evaluating Wireless NetworksPCIE IT Roundtable

Example: Many wireless networks do not use WEP or other encryption to protect network traffic.

▲ = Access points using encryption▲ = Access points without encryption

17

Evaluating Wireless NetworksPCIE IT Roundtable

Example: The radio signal from a wireless network can spill over from the building where access points are located to neighboring buildings, parking lots and public roads.

18

Evaluating Wireless NetworksPCIE IT Roundtable

Example: These packet traces show highly confidential data that can be captured from a wireless network

19

Evaluating Wireless NetworksPCIE IT Roundtable

General Evaluation Recommendations

• Develop wireless network policies• Conduct risk assessments to determine required level of

security• Limit access to wireless networks through the use of

wireless security measures (ie. 802.11i or WPA)• Maintain logical separation between wireless and wired

networks• Perform wireless scans to identify wireless networks and

applications (on a regular basis)• Enforce wireless network policies

20

Evaluating Wireless NetworksPCIE IT Roundtable

Information Sharing

• Awareness• Collaborative use of findings• Confidentiality

21

Evaluating Wireless NetworksPCIE IT Roundtable

Conclusion

• Wireless network evaluations are easy to conduct using inexpensive or freely available tools.

• Evaluations are very necessary• Wireless networks are inexpensive, convenient, and

simple to use – so people will use them. • BUT, wireless networks are vulnerable.

22

Evaluating Wireless NetworksPCIE IT Roundtable

Contact for Wireless Network Evaluations

Jamil Farshchi

(202) 358-1897

[email protected]