Plug & pray? A layered security system can help keep your wireless system safe - technology

California CPA, Sept, 2003 by Bob Gaby

Have you gone wireless? It's not as complex as you may think. It's easy to install--simply plug and play--and cheap. A two-user wireless network can be purchased and installed for as little as $200. Not only will this impress your friends and family, you'll increase your productivity and gain access anywhere and anytime within your home or office.

On the flip side, what many wireless users don't realize is that going wireless can compromise their network's security.

The truth is, hacking into an improperly configured wireless system is a piece of cake ... like shooting fish in a barrel ... like taking candy from a baby. You get the point. Hackers roam the streets with notebook computers, wireless access cards, high-gain antennas and global positioning systems looking for unsecured access points. Known as "war driving," this new breed of hacker looks for free Internet access, access to confidential data and a new network to compromise.

A wireless network essentially provides the world a public entrance to the programs and data on your network--unless you have taken appropriate network security steps. We've all heard the saying that it's better to give than receive, but freely exposing your network resources to the outside world is going a bit too far.

You can significantly reduce your risk of being hacked by taking a few simple steps. Keep in mind, however, that no access point will ever be 100 percent secure. Rather, the steps you take hopefully will encourage would-be hackers to look for an easier, less secure network to compromise.

SEVEN STEPS TO SECURE COMPUTING IN A WIRELESS ENVIRONMENT

(1) Change the default administrator password for the access point. This should be obvious, but there are hundreds of access points for which no thought has ever been given to changing a password. Passwords should be at least 10 characters, include upper and lower case letters, numbers and special characters, such as exclamation points or the pound symbol.

(2) Change the SSID. Each access point in a wireless network is programmed with a unique identifier known as a Service Set Identifier (SSID). It's also sometimes referred to as an Extended Service Set Identifier (ESSID). Most access points come preconfigured with the manufacturer's name as the SSID. To access the network, client computers must present the correct SSID to the access point.

The SSID is a 32-character unique identifier attached to the header of packets sent over a wireless network (WLAN) that acts as a password when a mobile device tries to connect to the access point. The SSID differentiates one WLAN from another so all access points and devices attempting to connect to a specific WLAN must use the same SSID. A device will not be permitted to join the wireless network unless it can provide the unique SSID.

Because an SSID can be sniffed in plain text from a packet, it does not supply any security to the network. Changing the SSID does, however, make hacking a bit more inconvenient.

(3) Don't let the outside world know you're there. Turn off SSID broadcasting, also known as closed mode. This feature is not available on all access points, so make sure to spend the couple of extra dollars required to purchase an access point with this feature. By default, the SSID is turned on, making it easy for the casual user to join the system. Similar to changing the SSID name, turning off the SSID broadcast does not make your access point secure, but does require the hacker to jump through a couple more hoops to sniff out your network.

(4) Enable MAC address filtering. While access points are identified by SSID, client computers can be identified by the unique 12-character MAC (Media Access Control) address associated with its 802.11x network card.

Typically the address can be found on the box the card shipped in, on the card itself or obtained by running the IPCONFIG/all command from a command prompt line in Windows 2000 or XP.

To increase security, an access point can be configured with a list of the MAC addresses associated with the client computers that are allowed access to the network. This is best suited for small networks as the task of managing MAC address lists for a large network can become unruly.

Again, enabling MAC addresses alone isn't a guarantee against backing, but it provides another layer of security. Tools are easily obtained from the Internet that allow hackers to easily capture and "spoof" MAC addresses to gain access to a wireless network.

(5) Enable Wired Equivalent Privacy (WEP). Wireless transmissions are easy to intercept. To provide an additional layer of security, the current 802.11 standard specifies the WEP security protocol to provide encrypted communication between the client computer and the access point. WEP keys are 64 or 128-bit (eight or 16-character) keys used to encrypt data using a public algorithm. All client computers and access points on the network typically use the same key to encrypt and decrypt data.

WEP is generally first configured at the access point by assigning a key or allowing the access point to randomly generate a WEP key. Once the access point has been configured, the unique WEP encryption must be enabled and a key must be entered for each client computer.