Re: [Full-Disclosure] Wireless Security

From: Joel R. Helgeson (joel_at_helgeson.com)
Date: 11/29/03

  • Next message: Todd Burroughs: "RE: [Full-Disclosure] automated vulnerability testing"
    To: "Patrick Doyle" <patrick.doyle@bbc.co.uk>
    Date: Fri, 28 Nov 2003 21:27:05 -0600
    
    

    Hey Paddy,
    I've been doing wireless security ever since Cisco acquired the Aironet
    Product line. I was working for Cisco at the time. I was also there when
    they developed the LEAP architecture and it was my team that implemented the
    first large-scale roll-out of it for the Chicago Board of Trade & the
    Currency Exchange. What I'm trying to say is that when it comes to wireless
    security, I've been there, done that.

    There has always been a Holy Grail that has been sought when working with
    Wireless Security. The trade-off always seems to be Flexibility vs.
    Security. This was always the case until I came across wireless gateways.
    I've now been working with wireless gateways for over a year now and I can
    say that they have solved every problem I've encountered with wireless
    security.

    A wireless gateway is similar to a firewall with some key differences. Just
    as a firewall is designed and customized to secure internet communications,
    a Wireless Gateway is customized to secure wireless to wired communications.
    A firewall segments internal from external networks, whereas a gateway
    segments wired and wireless.

    I would recommend that you take a look at the Reefedge product. It is by far
    the most scalable and secure solution I have found to date.
    www.reefedge.com

    In the interest of FD: I do not work for a wireless gateway provider, but my
    company does resell them. We resell them because until they came along,
    wireless security was a pain in the arse. I am not a paid endorser of any
    product, nor do I have any financial interest in any wireless gateway
    company. I'm pretty sure they can now export the product overseas.

    Regards,

    Joel R. Helgeson
    Director of Networking & Security Services
    SymetriQ Corporation

    "Give a man fire, and he'll be warm for a day; set a man on fire, and he'll
    be
    warm for the rest of his life."

    ----- Original Message -----
    From: "Patrick Doyle" <patrick.doyle@bbc.co.uk>
    To: <full-disclosure@lists.netsys.com>
    Sent: Friday, November 28, 2003 8:40 AM
    Subject: [Full-Disclosure] Wireless Security

    > Hope this question isn't off topic,
    >
    > I am currently looking at securing wireless networks using Cisco hardware
    and wanted to check what peoples thoughts are on security.
    >
    > I have read about using LEAP and also IPSEC, my concerns about using LEAP
    would be that although the client and access point send hashes of the
    username and password, and also dynamically create WEP keys, the process is
    still vulnerable to brute force attacks. Now i know you can lock down the
    Access Point (AP) to specific MAC addresses, however, in our environment i
    can see wireless being used for meeting rooms etc, so the users would be
    random which would mean the constant addition / removal of MACs to the AP
    which would probably not be possible or practical all of the time.
    Although policy could dictate that when a wireless card is given out, the
    MAC address in added to the AP, however if you have multiple APs in
    different areas of building, being administered by different IT depts then
    this could soon become be a problem.
    >
    > To me IPSEC looks like be the better solution using SecurID tokens (one
    time passwords) to authenticate users, any thoughts would be appreciated.
    >
    >
    >
    >
    >
    > BBCi at http://www.bbc.co.uk/
    >
    > This e-mail (and any attachments) is confidential and may contain personal
    views which are not the views of the BBC unless specifically
    > stated.
    > If you have received it in error, please delete it from your system. Do
    not use, copy or disclose the information in any way nor act in
    > reliance on it and notify the sender immediately. Please note that the BBC
    monitors e-mails sent or received.
    > Further communication will signify your consent to this.
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html
    >

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html


  • Next message: Todd Burroughs: "RE: [Full-Disclosure] automated vulnerability testing"

    Relevant Pages

    • Re: A home computer is a forensic evidence room
      ... A security plan that first covers recovery, and data protection is key. ... Anyone within range of your wireless transmission could connect to your network and use it or capture your computing sessions. ... reset the wireless router to factory: press and hold reset 20 seconds. ...
      (alt.2600)
    • Re: Two wireless routers one network
      ... neighborhood kids trying to use my wireless than from any books or web ... I don't expect my customers to ... My level of security and paranoia largely depends on the risks and ... >>I notice you didn't say anything about my comments about monitoring ...
      (alt.internet.wireless)
    • Re: Wi-Fi question
      ... Wireless internet has been a security hole from day one. ... Both sides must have the same WEP key, which is usually a total of 64 ... The Auditor security collection is a GPL-licensed live CD based on ...
      (rec.outdoors.rv-travel)
    • RE: palm VIIx wireless modem
      ... Here is a Wireless LAN Security FAQ, ... What are solutions to minimizing WLAN risk? ... that connects clients to the internal network. ...
      (Security-Basics)
    • Re: no phone line? & 2way voice. move over joel
      ... Simon XT delivers added wireless and interactive capabilities through ... today announced enhancements to Simon ... complete and secure advanced wireless security solution including ... a wireless security system offering burglary and fire ...
      (alt.security.alarms)