HACK PROOFING YOUR WIRELESS NETWORK
CONTENTS XIII CHAPTER 1 THE WIRELESS CHALLENGE INTRODUCTION WIRELESS TECHNOLOGY OVERVIEW DEFINING CELLULAR-BASED WIRELESS DEFINING THE WIRELESS LAN THE CONVERGENCE OF WIRELESS TECHNOLOGIES TRENDS AND STATISTICS INCREASING USE OF INFORMATION APPLIANCES THE FUTURE OF WIRELESS, CIRCA UNDERSTANDING THE PROMISE OF WIRELESS WIRELESS NETWORKING WIRELESS NETWORKING APPLICATIONS FOR BUSINESS WIRELESS NETWORKING APPLICATIONS FOR CONSUMERS UNDERSTANDING THE BENEFITS OF WIRELESS CONVENIENCE FLEXIBILITY ROAMING MOBILITY AFFORDABILITY SPEED AESTHETICS PRODUCTIVITY FACING THE REALITY OF WIRELESS TODAY STANDARDS CONFLICTS COMMERCIAL CONFLICTS MARKET ADOPTION CHALLENGES THE LIMITATIONS OF “RADIO” RADIO RANGE AND COVERAGE USE OF ANTENNAS INTERFERENCE AND COEXISTENCE THE LIMITATIONS OF WIRELESS SECURITY CELLULAR-BASED WIRELESS NETWORKS AND WAP WIRELESS LAN NETWORKS AND WEP EXAMINING THE WIRELESS STANDARDS CELLULAR-BASED WIRELESS NETWORKS COMMUNICATIONS TECHNOLOGIES WIRELESS LAN NETWORKS 80211 WLAN HOMERF 80215 WPAN 80216 WMAN UNDERSTANDING PUBLIC KEY INFRASTRUCTURES AND WIRELESS NETWORKING OVERVIEW OF CRYPTOGRAPHY SUMMARY SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 2 A SECURITY PRIMER UNDERSTANDING SECURITY FUNDAMENTALS AND PRINCIPLES OF PROTECTION ENSURING CONFIDENTIALITY ENSURING INTEGRITY ENSURING AVAILABILITY ENSURING PRIVACY ENSURING AUTHENTICATION ENSURING AUTHORIZATION ENSURING NON-REPUDIATION ACCOUNTING AND AUDIT TRAILS USING ENCRYPTION ENCRYPTING VOICE DATA ENCRYPTING DATA SYSTEMS REVIEWING THE ROLE OF POLICY IDENTIFYING RESOURCES UNDERSTANDING CLASSIFICATION CRITERIA IMPLEMENTING POLICY RECOGNIZING ACCEPTED SECURITY AND PRIVACY STANDARDS REVIEWING SECURITY STANDARDS EARLY SECURITY STANDARDS UNDERSTANDING THE COMMON CRITERIA MODEL ISO 17799/BS ISO REVIEWING PRIVACY STANDARDS AND REGULATIONS NAIC MODEL ACT GRAMM-LEACH-BLILEY ACT HIPAA ELECTRONIC SIGNATURES IN THE GLOBAL AND NATIONAL COMMERCE ACT COPPA CIVIL LIABILITY LAW ADDRESSING COMMON RISKS AND THREATS EXPERIENCING LOSS OF DATA LOSS OF DATA SCENARIO EXPERIENCING DENIAL AND DISRUPTION OF SERVICE DISRUPTION OF SERVICE SCENARIO EAVESDROPPING EAVESDROPPING SCENARIO PREEMPTING THE CONSEQUENCES OF AN ORGANIZATION’S LOSS SECURITY BREACH SCENARIO CHAPTER 3 WIRELESS NETWORK ARCHITECTURE AND DESIGN FIXED WIRELESS TECHNOLOGIES MULTICHANNEL MULTIPOINT DISTRIBUTION SERVICE LOCAL MULTIPOINT DISTRIBUTION SERVICES WIRELESS LOCAL LOOP POINT-TO-POINT MICROWAVE WIRELESS LOCAL AREA NETWORKS WHY THE NEED FOR A WIRELESS LAN STANDARD? STANDARD DEFINE? DOES THE 80211 STANDARD GUARANTEE COMPATIBILITY ACROSS DIFFERENT VENDORS? 80211B 80211A 80211E ARCHITECTURE THE BASIC SERVICE SET THE EXTENDED SERVICE SET SERVICES TO THE 80211 ARCHITECTURE THE CSMA-CA MECHANISM THE RTS/CTS MECHANISM ACKNOWLEDGING THE DATA CONFIGURING FRAGMENTATION USING POWER MANAGEMENT OPTIONS MULTICELL ROAMING SECURITY IN THE WLAN BLUETOOTH HIGH PERFORMANCE RADIO LAN MOBILE WIRELESS TECHNOLOGIES FIRST GENERATION TECHNOLOGIES SECOND GENERATION TECHNOLOGIES 25G TECHNOLOGY THIRD GENERATION TECHNOLOGIES WIRELESS APPLICATION PROTOCOL GLOBAL SYSTEM FOR MOBILE COMMUNICATIONS GENERAL PACKET RADIO SERVICE SHORT MESSAGE SERVICE OPTICAL WIRELESS TECHNOLOGIES EXPLORING THE DESIGN PROCESS CONDUCTING THE PRELIMINARY INVESTIGATION PERFORMING ANALYSIS OF THE EXISTING ENVIRONMENT CREATING A PRELIMINARY DESIGN FINALIZING THE DETAILED DESIGN EXECUTING THE IMPLEMENTATION CAPTURING THE DOCUMENTATION CREATING THE DESIGN METHODOLOGY CREATING THE NETWORK PLAN GATHERING THE REQUIREMENTS BASELINING THE EXISTING NETWORK ANALYZING THE COMPETITIVE PRACTICES BEGINNING THE OPERATIONS PLANNING PERFORMING A GAP ANALYSIS CREATING A TECHNOLOGY PLAN CREATING AN INTEGRATION PLAN BEGINNING THE COLLOCATION PLANNING PERFORMING A RISK ANALYSIS CREATING AN ACTION PLAN PREPARING THE PLANNING DELIVERABLES DEVELOPING THE NETWORK ARCHITECTURE REVIEWING AND VALIDATING THE PLANNING PHASE CREATING A HIGH-LEVEL TOPOLOGY CREATING A COLLOCATION ARCHITECTURE DEFINING THE HIGH-LEVEL SERVICES CREATING A HIGH-LEVEL PHYSICAL DESIGN DEFINING THE OPERATIONS SERVICES CREATING A HIGH-LEVEL OPERATING MODEL EVALUATING THE PRODUCTS CREATING THE NETWORK ARCHITECTURE DELIVERABLE FORMALIZING THE DETAILED DESIGN PHASE REVIEWING AND VALIDATING THE NETWORK ARCHITECTURE CREATING THE DETAILED TOPOLOGY CREATING A DETAILED SERVICE COLLOCATION DESIGN CREATING THE DETAILED SERVICES CREATING A DETAILED PHYSICAL DESIGN CREATING A DETAILED OPERATIONS DESIGN CREATING A DETAILED OPERATING MODEL DESIGN CREATING A TRAINING PLAN DEVELOPING A MAINTENANCE PLAN DEVELOPING AN IMPLEMENTATION PLAN CREATING THE DETAILED DESIGN DOCUMENTS UNDERSTANDING WIRELESS NETWORK ATTRIBUTES FROM A DESIGN PERSPECTIVE APPLICATION SUPPORT SUBSCRIBER RELATIONSHIPS PHYSICAL LANDSCAPE NETWORK TOPOLOGY CHAPTER 4 COMMON ATTACKS AND VULNERABILITIES THE WEAKNESSES IN WEP CRITICISMS OF THE OVERALL DESIGN WEAKNESSES IN THE ENCRYPTION ALGORITHM WEAKNESSES IN KEY MANAGEMENT WEAKNESSES IN USER BEHAVIOR CONDUCTING RECONNAISSANCE FINDING A TARGET FINDING WEAKNESSES IN A TARGET EXPLOITING THOSE WEAKNESSES SNIFFING, INTERCEPTION, AND EAVESDROPPING DEFINING SNIFFING SAMPLE SNIFFING TOOLS SNIFFING CASE SCENARIO PROTECTING AGAINST SNIFFING AND EAVESDROPPING SPOOFING AND UNAUTHORIZED ACCESS DEFINING SPOOFING SAMPLE SPOOFING TOOLS SPOOFING CASE SCENARIO PROTECTING AGAINST SPOOFING AND UNAUTHORIZED ATTACKS NETWORK HIJACKING AND MODIFICATION DEFINING HIJACKING SAMPLE HIJACKING TOOLS HIJACKING CASE SCENARIO PROTECTION AGAINST NETWORK HIJACKING AND MODIFICATION DENIAL OF SERVICE AND FLOODING ATTACKS DEFINING DOS AND FLOODING SAMPLE DOS TOOLS DOS AND FLOODING CASE SCENARIO PROTECTING AGAINST DOS AND FLOODING ATTACKS THE INTRODUCTION OF MALWARE STEALING USER DEVICES CHAPTER 5 WIRELESS SECURITY COUNTERMEASURES REVISITING POLICY ADDRESSING THE ISSUES WITH POLICY ANALYZING THE THREAT THREAT EQUALS RISK PLUS VULNERABILITY DESIGNING AND DEPLOYING A SECURE NETWORK IMPLEMENTING WEP DEFINING WEP CREATING PRIVACY WITH WEP THE WEP AUTHENTICATION PROCESS WEP BENEFITS AND ADVANTAGES WEP DISADVANTAGES THE SECURITY IMPLICATIONS OF USING WEP IMPLEMENTING WEP ON THE AIRONET SECURING A WLAN WITH WEP: A CASE SCENARIO FILTERING MACS DEFINING MAC FILTERING MAC BENEFITS AND ADVANTAGES MAC DISADVANTAGES SECURITY IMPLICATIONS OF MAC FILTERING IMPLEMENTING MAC FILTERS ON THE AIRONET FILTERING MAC ADDRESSES:A CASE SCENARIO FILTERING PROTOCOLS DEFINING PROTOCOL FILTERS PROTOCOL FILTER BENEFITS AND ADVANTAGES PROTOCOL FILTER DISADVANTAGES SECURITY IMPLICATIONS OF USING PROTOCOL FILTERS USING CLOSED SYSTEMS AND NETWORKS DEFINING A CLOSED SYSTEM CLOSED SYSTEM BENEFITS AND ADVANTAGES CLOSED SYSTEM DISADVANTAGES SECURITY IMPLICATIONS OF USING A CLOSED SYSTEM A CLOSED ENVIRONMENT ON A CISCO AIRONET SERIES AP IMPLEMENTING A CLOSED SYSTEM: A CASE SCENARIO ENABLING WEP ON THE ORINOCO CLIENT ALLOTTING IPS DEFINING IP ALLOCATION ON THE WLAN DEPLOYING IP OVER THE WLAN: BENEFITS AND ADVANTAGES DEPLOYING IP OVER THE WLAN: DISADVANTAGES SECURITY IMPLICATIONS OF DEPLOYING IP OVER THE WLAN DEPLOYING IP OVER THE WLAN: A CASE SCENARIO USING VPNS VPN BENEFITS AND ADVANTAGES VPN DISADVANTAGES SECURITY IMPLICATIONS OF USING A VPN LAYERING YOUR PROTECTION USING A VPN UTILIZING A VPN:A CASE SCENARIO SECURING USERS END USER SECURITY BENEFITS AND ADVANTAGES END USER SECURITY DISADVANTAGES USER SECURITY:A CASE SCENARIO CHAPTER 6 CIRCUMVENTING SECURITY MEASURES PLANNING AND PREPARATIONS CHOOSING THE TOOLS AND EQUIPMENT REQUIRED FOR ATTACK DETECTING AN OPEN SYSTEM DETECTING A CLOSED SYSTEM EXPLOITING WEP SECURITY OF 64-BIT VERSUS 128-BIT KEYS ACQUIRING A WEP KEY WAR DRIVING WHAT THREAT DO THESE “OPEN NETWORKS” POSE TO NETWORK SECURITY? WHAT TOOLS ARE NECESSARY TO PERFORM A WAR DRIVE? WHAT NETWORK INFORMATION CAN I DISCOVER FROM A WAR DRIVE? CAN WAR DRIVING BE DETECTED? WHAT ARE THE BENEFITS OF DEVICE THEFT? MAC FILTERING WHAT IS A MAC ADDRESS? WHERE IN THE AUTHENTICATION/ASSOCIATION PROCESS DOES MAC FILTERING OCCUR? DETERMINING MAC FILTERING IS ENABLED MAC SPOOFING BYPASSING ADVANCED SECURITY MECHANISMS FIREWALLS FILTERING BY IP ADDRESS FILTERING BY PORT WHAT HAPPENS NOW? EXPLOITING INSIDERS WHAT IS AT STAKE? SOCIAL ENGINEERING TARGETS INSTALLING ROGUE ACCESS POINTS WHERE IS THE BEST LOCATION FOR A ROGUE AP? CONFIGURING THE ROGUE AP RISKS CREATED BY A ROGUE AP ARE ROGUE APS DETECTABLE? EXPLOITING VPNS CHAPTER 7 MONITORING AND INTRUSION DETECTION DESIGNING FOR DETECTION STARTING WITH A CLOSED NETWORK RULING OUT ENVIRONMENTAL OBSTACLES RULING OUT INTERFERENCE DEFENSIVE MONITORING CONSIDERATIONS AVAILABILITY AND CONNECTIVITY INTERFERENCE AND NOISE SIGNAL STRENGTH DETECTING A DENIAL OF SERVICE MONITORING FOR PERFORMANCE KNOWING THE BASELINE MONITORING TOOLS OF THE TRADE INTRUSION DETECTION STRATEGIES INTEGRATED SECURITY MONITORING WATCHING FOR UNAUTHORIZED TRAFFIC AND PROTOCOLS UNAUTHORIZED MAC ADDRESSES POPULAR MONITORING PRODUCTS SIGNATURES CONDUCTING VULNERABILITY ASSESSMENTS INCIDENT RESPONSE AND HANDLING POLICIES AND PROCEDURES REACTIVE MEASURES REPORTING CLEANUP PREVENTION CONDUCTING SITE SURVEYS FOR ROGUE ACCESS POINTS THE ROGUE PLACEMENT THE WELL-INTENTIONED EMPLOYEE THE SOCIAL ENGINEER TRACKING ROGUE ACCESS POINTS CHAPTER 8 AUDITING DESIGNING AND PLANNING A SUCCESSFUL AUDIT TYPES OF AUDITS ASSESSING RISK MEASURING SYSTEM OPERATION MEASURING SYSTEM COMPLIANCE VERIFY CHANGE MANAGEMENT ASSESSING DAMAGE WHEN TO PERFORM AN AUDIT AT SYSTEM LAUNCH ON SCHEDULE MAINTENANCE WINDOW UNPLANNED EMERGENCY AUDITS AUDITING ACTIVITIES AUDIT PLANNING AUDIT INFORMATION GATHERING AUDIT INFORMATION ANALYSIS AND REPORT GENERATION AUDIT REPORT PRESENTATION POST-AUDIT REVIEW NEXT STEPS AUDITING TOOLS AUDITING INTERVIEW TOOLS TECHNICAL AUDITING TOOLS CRITICAL AUDITING SUCCESS FACTORS DEFINING STANDARDS STANDARDS GUIDELINES BEST PRACTICES POLICIES PROCEDURES AUDITING, SECURITY STANDARDS, AND BEST PRACTICES CORPORATE SECURITY POLICIES AUDITING CHARTERS AND IRREGULARITIES SAMPLING IRREGULARITIES BIASED OPINIONS FRAUD ESTABLISHING THE AUDIT SCOPE ESTABLISHING THE DOCUMENTATION PROCESS PERFORMING THE AUDIT AUDITORS AND TECHNOLOGISTS OBTAINING SUPPORT FROM IS/IT DEPARTMENTS SENIOR MANAGEMENT SUPPORT IS/IT DEPARTMENT SUPPORT GATHERING DATA INTERVIEWS DOCUMENT REVIEW TECHNICAL REVIEW ANALYZING AUDIT DATA MATRIX ANALYSIS RECOMMENDATIONS REPORTS GENERATING AUDIT REPORTS THE IMPORTANCE OF AUDIT REPORT QUALITY WRITING THE AUDIT REPORT EXECUTIVE SUMMARY PRIORITIZED RECOMMENDATIONS MAIN BODY DETAILED RECOMMENDATIONS FINAL CONCLUSIONS APPENDICES GLOSSARY FINAL THOUGHTS ON AUDITING SAMPLE AUDIT REPORTS SAMPLE MANAGEMENT REPORT:WIRELESS NETWORK SECURITY AUDIT REPORT XYZ CORPORATION SAMPLE TECHNICAL REPORT WIRELESS NETWORK SECURITY AUDIT REPORT: XYZ CORPORATION CHAPTER 9 CASE SCENARIOS IMPLEMENTING A NON-SECURE WIRELESS NETWORK IMPLEMENTING AN ULTRA-SECURE WIRELESS LAN PHYSICAL LOCATION AND ACCESS CONFIGURING THE AP DESIGNING SECURELY SECURING BY POLICY TAKING A WAR DRIVE SCOUTING YOUR LOCATION INSTALLING IN DIFFICULT SITUATIONS DEVELOPING A WIRELESS SECURITY CHECKLIST MINIMUM SECURITY MODERATE SECURITY OPTIMAL SECURITY THE WIRELESS CHALLENGE SOLUTIONS IN THIS CHAPTER: I WIRELESS TECHNOLOGY OVERVIEW I UNDERSTANDING THE PROMISE OF WIRELESS I UNDERSTANDING THE BENE?TS OF WIRELESS I FACING THE REALITY OF WIRELESS TODAY I EXAMINING THE WIRELESS STANDARDS ; SUMMARY ; SOLUTIONS FAST TRACK ; FREQUENTLY ASKED QUESTIONS INTRODUCTION WHEN THE CONCEPT OF A NETWORK WITHOUT WIRES WAS ?RST SUGGESTED MORE THAN TWO DECADES AGO, IT SPARKED THE IMAGINATION OF SCIENTISTS, PRODUCT VENDORS, AND USERS AROUND THE GLOBE EAGER FOR THE CONVENIENCE AND ?EXIBILITY OF A FREE ROAMING CON- NECTION UNFORTUNATELY, AS THE VARIETY OF WIRELESS SOLUTIONS BEGAN TO EMERGE, ANTIC- IPATION TURNED TO DISAPPOINTMENTTHE ?RST WAVE OF SOLUTIONS PROVED INADEQUATE FOR THE NETWORKING, PORTABILITY, AND SECURITY NEEDS OF A CHANGING IT ENVIRONMENT WHILE THIS HAS LARGELY CONTINUED TO BE THE CASE THROUGHOUT THE 1990S WITH MOST CELL-BASED AND OF?CE LOCAL AREA NETWORK (LAN)-BASED WIRELESS TECHNOLOGY DEPLOYMENTS, GREAT STRIDES HAVE BEEN MADE SPECI?CALLY OVER THE LAST TWO YEARS TO ADDRESS THE FUNDAMENTAL CONCERNS IMPEDING THE FULL ACCEPTANCE OF WIRELESS NET- WORKING IN THE MAINSTREAM OF CORPORATE IT DEPARTMENTS AND THE SMALL OF?CE IN THIS CHAPTER, YOU WILL LEARN ABOUT THE TECHNOLOGY THAT IS AVAILABLE TODAY FOR WIRELESS DATA NETWORKING AND WHAT TOMORROW’S WIRELESS TECHNOLOGIES HAVE TO OFFERWE WILL COVER OF?CE LAN WIRELESS SOLUTIONS INCLUDING 80211, ITS SUBGROUPS (80211B, 80211A, 80211G) AND HOMERF, CELLULAR-BASED WIRELESS DATA SOLUTIONS INCLUDING THE WIRELESS APPLICATION PROTOCOL (WAP) AND I-MODE AND THE NETWORK INFRASTRUCTURES SUPPORTING THEM (IN PARTICULAR 2G, 25G, AND 3G), AND ?NALLY, 80215 PERSONAL AREA NETWORK (PAN) SOLUTIONS SUCH AS BLUETOOTH IN ADDITION, WE WILL REVIEW SOME OF THE NEW STANDARDS BEING DEVELOPED TO CREATE WIRELESS METROPOLITAN AREA NETWORKS (WMANS) AND OTHER WIRELESS DATA TRANSMISSION SOLU- TIONS THAT ARE BEING PROPOSED FOR COMMERCIAL APPLICATION IN CONJUNCTION WITH THE REVIEW OF THE TECHNOLOGIES BEHIND WIRELESS, WE WILL ALSO COVER THE MAIN SECURITY CONCERNS SPECI?CALLY IMPACTING CELLULAR-BASED OF?CE LAN AND PAN WIRELESS DEPLOYMENTS IN DOING SO, WE WILL REVIEW THE MAJOR SECU- RITY CONCERNS YOU CAN EXPECT TO READ ABOUT IN LATER CHAPTERS, AND WILL DISCUSS SOME OF THE EFFORTS BEING MADE TO MINIMIZE THEIR IMPACT AFTER COMPLETING THIS CHAPTER, YOU WILL HAVE GAINED A SOLID UNDERSTANDING OF WIRELESS TECHNOLOGIES AND THEIR ASSOCIATED SECURITY RISKS IT IS OUR HOPE THAT WE PROVIDE YOU WITH AN APPRECIATION OF HOW WIRELESS NETWORKING TECHNOLOGIES WILL IMPACT OUR WORK AND HOME LIVES, AND THAT SECURITY WILL HAVE TO PLAY AN IMPORTANT ROLE IN WIRELESS DEPLOYMENTS LET’S GET STARTED! WIRELESS TECHNOLOGY OVERVIEW