Feeds

Confirmed: MS to ship beefed up 802.11 security in XP SP1

Surely not a reason to upgrade from Win2k? You amaze us...

  • alert
  • submit to reddit

3 Big data security analytics techniques

Microsoft will, as suggested here last week, be shipping a Protected Extensible Authentication Protocol (PEAP) client with SP1 of Windows XP. This will beef up wireless security in XP and will no doubt come in handy for the mysterious security of Microsoft's forthcoming home wireless products.

Thanks to readers for the snap of XP SP1's wireless properties, showing Protected EAP security enabled, and for a couple of useful links. Microsoft Technet's Cable Guy discusses PEAP in the July column, and over at Sifry's Alerts there are a few pertinent comments.

Dave Sifry suggests that, because the Access Points (APs) will need to be able to handle multiple TLS sessions, they'll need to be more powerful than the current generation that's on sale.

Sifry also says that "each access point must now have a TLS certificate, which is fine if you're VeriSign or if you're shelling out the dough for Microsoft's CA implementation across your organization." This would certainly be the case if you were running a local wireless network that did not use an authentication server (and would indeed chew up a lot of horsepower), but Technet's Cable Guy describes a scenario which uses PEAP and MS-CHAP V2 with an authentication server, simply using the AP as a pass through device. This is what he has to say about certificates:

"PEAP with MS-CHAP v2 requires certificates on the IAS servers but not on the wireless clients. IAS servers must have a certificate installed in their Local Computer certificate store. Instead of deploying a PKI, you can purchase individual certificates from a third-party CA to install on your IAS servers. To ensure that wireless clients can validate the IAS server certificate chain, the root CA certificate of the CA that issued the IAS server certificates must be installed on each wireless client.

"Windows XP includes the root CA certificates of many third-party CAs. If you purchase your IAS server certificates from a third-party CA that corresponds to an included root CA certificate, no additional wireless client configuration is required. If you purchase your IAS server certificates from a third party CA for which Windows XP does not include a corresponding root CA certificate, you must install the root CA certificate on each wireless client."

Clearly, for home networking, there's a piece of the picture still missing. It's possible that Microsoft could offer some form of external authentication services (hardly uncharacteristic of Redmond, this), but this would be a little bit of an own-goal if it resulted in home and small office networks that were paralysed if the internet connection was down. So not an option on its own. Alternatively, or additionally, APs could have their own certificates built in, and if you viewed the implimentation as being optional, i.e. AP authentication for small office, home gateway type systems, and server authentication for business, then the crunching requirements for the AP/gateway probably wouldn't be that great.

Presuming Microsoft does have that missing piece of the picture and does intend to deploy PEAP in its home wireless networks, then we can rough out a few of those edges it likes to give itself. A system that is reasonably secure out of the box would be pretty attractive for home users, for those of them who've actually heard of security, anyway. It would also be a fairly significant reason for installing SP1. And for Windows 2000 users? Well yes, no doubt MS-PEAP for Win2k will ship in the fullness of time, but we'd guess Win9x users can forget it.

Depending on how Microsoft does the implementation and how hard it decides to push PEAP, non-MS operating systems could be speed-bumped. PEAP is currently an IETF standard in progress, so theoretically non-MS operating systems won't be disadvantaged in the long run, but early implementation and popularisation of a standard by Microsoft, leaving the rest of the world eating dust and puzzling over APIs, is something we've seen before too. Not that we're saying this is necessarily bad, of course. It's just frequently difficult to disentangle the trail-blazing (Microsoft's view) aspects of Redmond's roadmaps from the edge-getting (everybody else's) ones. ®

SANS - Survey on application security programs

More from The Register

next story
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Batten down the hatches, Ubuntu 14.04 LTS due in TWO DAYS
Admins dab straining server brows in advance of Trusty Tahr's long-term support landing
Microsoft lobs pre-release Windows Phone 8.1 at devs who dare
App makers can load it before anyone else, but if they do they're stuck with it
Half of Twitter's 'active users' are SILENT STALKERS
Nearly 50% have NEVER tweeted a word
Internet-of-stuff startup dumps NoSQL for ... SQL?
NoSQL taste great at first but lacks proper nutrients, says startup cloud whiz
Windows 8.1, which you probably haven't upgraded to yet, ALREADY OBSOLETE
Pre-Update versions of new Windows version will no longer support patches
Microsoft TIER SMEAR changes app prices whether devs ask or not
Some go up, some go down, Redmond goes silent
Red Hat to ship RHEL 7 release candidate with a taste of container tech
Grab 'near-final' version of next Enterprise Linux next week
Ditch the sync, paddle in the Streem: Upstart offers syncless sharing
Upload, delete and carry on sharing afterwards?
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.