Wireless network proliferation brings security issues to the forefront

The need to provide secure access to corporate networks for mobile workers is increasingly becoming a key issue for enterprise IT departments as access to internal networks proliferates through the use of various wireless technologies. This was one of the key messages from panelists of the Wireless Insecurities: Myths and Menaces session at the Wireless Connections 2003 conference in Calgary late last month. Much of the session focused on improving security methods of 802.11b networks, commonly referred to as Wi-Fi, which are being deployed by a greater number of organizations. Cisco Systems Inc.’s Wayne Mah talked about the challenges of securing Wi-Fi networks, but also mentioned that there might be light at the end of the tunnel. Brian Mackie, president of NON-Elephant Encryption Systems Inc. (NE2), spoke about the challenges his company faced in implementing a security system for Talisman Energy. Mah said during the breakout session that Wi-Fi does have built in security, dubbed Wireless Equivalent Privacy (WEP), but it is wholly inadequate because the encryption and authentication feature is optional. He added that to ensure plug’n’play functionality of Wi-Fi, the security protocols have to be turned off. He summed up the problem by describing WEP as a key to the front door of a house. "If you have three teenage daughters all with keys to the door and one of them loses a key, you have to change the door and get three new keys," he explained. "Now just imagine an organization with 1,000 people with (identical keys) and you lose one of the NIC (network interface cards) or you lose a laptop, you’ve got to rekey 999 laptops." Mah said that to plug some of the security holes, the industry is now offering a security solution called Dynamic WEP, which generates a new key at the beginning of every day, for example. He added that the system administrator can determine the time frame for new key generation. "We recommend the best practice is to rotate your keys every four hours. There’s a mathematical algorithm that says if you rotate your keys every four hours, it’s unlikely that someone will be able to decrypt it," Mah explained. There are also other solutions, such as a VPN or Dynamic WEP, open to enterprises looking to extend the reach of internal corporate networks into the wireless space. But Mah said each of those implementations has its own set of issues. With a VPN implementation, the quality of service (QoS) insight is lost because it’s hard to tell if a particular packet of information is coming from an IP telephone or a regular data transmission, Mah noted. On the Dynamic WEP side, there is end-to-end QoS because encryption is only done at the access point layer. "The only issue with this technology is it is proprietary (and) you’ll find that some vendors won’t support it." Secure socket layer (SSL) is another security option, but it will only work with applications that are SSL or web-enabled, Mah said. Data collection applications like supervisory control and data acquisition (SCADA) aren’t likely web-enabled and therefore can operate within the SSL security environment, he added. Mah said that there might be light at the end of the security tunnel, however, and two emerging standards may be able to address some of the key security concerns going forward. The emerging 802.1X standard "might be the holy grail because it works in the wired world and the wireless world," he said. And the 802.11i standard could fix some of the shortcomings of the first Wi-Fi encryption and security protocols. Both are draft standards at the Institute of Electrical and Electronics Engineers. The advantage of 802.1X is that it authenticates the user, not the PC as does WEP. Essentially, this security method won’t allow the user onto the network through the wireless access point until the authentication server authenticates the user. The 802.11i standard will use the advanced encryption system (AES), which is similar to DES and 3DES (triple DES), Mah explained, adding that this is computationally less expensive. "It is equally strong on the encryption front, but takes less time to generate," he said. Talisman Energy case study Calgary-based NE2 was tasked with deploying a security system for Talisman Energy to allow the company to query the geological and geophysical information coming from its various well site locations and then be able to share that information with corporate headquarters. Mackie explained that one of the key objectives of the system was to avoid to a large degree the amount of user interaction. "They wanted to have an application where oil field workers would not have to enter encryption keys or enter passwords," he said. Secondly, the system had to cover all well sites, including test sites, due to the widespread corporate espionage within the industry, Mackie noted. Talisman wanted to avoid showing the competition that only certain sites were viable. It also had to operate on satellite, microwave and cellular networks. Strong cryptographic protection was of utmost importance. Finally, the product had to be low cost. The key differentiating factor of NE2’s solution is that it provides encryption keys on a random basis, Mackie explained. The company’s products are based on a patent pending key establishment algorithm, which can operate in both the wired and wireless worlds. Initially implemented in software, hardware iterations are coming down the pipe, he added. "The truly randomness is the strong cryptographic protection," Mackie told the conference session. "The keys are secret to only the two parties communicating. It eliminates key management issues so there’s no private keys for storing and no public to transfer. (It) transparently encrypts and decrypts transmitted data, (which) addresses the issue of transparency for the users out in the field." Mackie also talked about some of the lessons learned from the Talisman security project. He said there were three things NE2 learned from this project. One was to make sure there is a business driver behind the system deployment. Secondly, he said that finding an executive sponsor or champion outside the IT department is important. Finally, partnerships need to be examined carefully due to potential product incompatibility problems. For a more detailed look at NE2, its target markets and issues surrounding compatibility, see the next issue of Report on Wireless.

Wireless network proliferation brings security issues to the forefront

News | June 11, 2003

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us