Feeds

WLAN security is still work in progress

Incomplete standards

  • alert
  • submit to reddit

The Power of One eBook: Top reasons to choose HP BladeSystem

IT managers are cautiously optimistic that wireless networks will - over time - become as secure as today's local area networks, but security concerns are still holding back deployment of the technology.

Those are the main findings of a limited (but still informative) survey of IT security manager attitudes on the deployment of 802.11b (wireless) networks by security consultancy Defcom released this week.

The 20 senior IT security managers questioned by Defcom at a recent London event were optimistic on the future security of WLAN equipment. Ninety per cent believed that it will be as secure as regular LANs within the next three to five years. However nearly two thirds (60 per cent) of the IT security managers polled said that the main barrier to wireless networking growth is still the perceived lack of securit.

Wireless LAN sales growth remains strong. Recent research by Gartner Dataquest predicted worldwide WLAN shipments will grow by 73 per cent this year.

Defcom's findings should encourage both manufacturers and the Wi-Fi standards body to properly address the fears of many end-users. Replacing the previous encryption standard, WEP (Wireless Equivalent Privacy), with more robust WiFi standards Wi-Fi Protected Access (WPA) is a step in the right direction but IT security managers are still sceptical.

WPA uses a higher level of encryption and brings in dynamic key exchange functions absent with WEP. WPA is designed to work with existing products and is expected to first appear in Wi-Fi certified products during the first quarter of next year.

Eighty per cent of IT security managers questioned by Defcom said they did not trust the manufacturers of wireless networking solutions to provide security expertise, even after the announcement of WPA.

One small step for security, one giant leap of the marketing kind

User caution about WPA, which all concerned welcome as a big improvement on the broken WEP standard, is echoed by vendors who tell us WPA is far from the last word on wireless security.

Wireless gateway vendor Bluesocket says WPA is a significant improvement over WEP as a security framework. But it is an incomplete, temporary solution until 802.11i is available at the end of 2003. 802.11i is the medium term goal for the Wi-Fi Alliance, but in promoting testing and interoperability work on WPA the industry is losing sight of some of its shortcomings, Bluesocket argues.

Dave Juitt, CTO at Bluesocket, said enterprises are looking for bandwidth management, secure mobility and policy enforcement features but WPA only covers authentication and access control.

"WPA only addressing one part of the puzzle. It won't solve all the problems even when its is deployed, which is not a given" Juitt told us.

WEP frequently went unused by many enterprise users, some of whom left themselves vulnerable to war driving by not taking additional security measures (such as deploying wireless networks over VPNs).

So will WPA be more widely used?

Juitt reckons the short answer to that is yes, but he's not without his reservations.

"WPA is less onerous than WEP, since it doesn't have as much involvement with mobile devices, but it doesn't fulfil everyone's needs. Interoperability might still be a barrier - it's not as simple as some people say," Juitt told us.

WPA is positioned as being compatible with 802.11i when the enhanced standard becomes available. Bluesocket argues that 802.11i will require AES support in access points and therefore new hardware.

New hardware is hardly a recipe for compatibility, it points out. ®

Designing a Defense for Mobile Applications

More from The Register

next story
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.