Feeds

WLAN security is still work in progress

Incomplete standards

  • alert
  • submit to reddit

Security for virtualized datacentres

IT managers are cautiously optimistic that wireless networks will - over time - become as secure as today's local area networks, but security concerns are still holding back deployment of the technology.

Those are the main findings of a limited (but still informative) survey of IT security manager attitudes on the deployment of 802.11b (wireless) networks by security consultancy Defcom released this week.

The 20 senior IT security managers questioned by Defcom at a recent London event were optimistic on the future security of WLAN equipment. Ninety per cent believed that it will be as secure as regular LANs within the next three to five years. However nearly two thirds (60 per cent) of the IT security managers polled said that the main barrier to wireless networking growth is still the perceived lack of securit.

Wireless LAN sales growth remains strong. Recent research by Gartner Dataquest predicted worldwide WLAN shipments will grow by 73 per cent this year.

Defcom's findings should encourage both manufacturers and the Wi-Fi standards body to properly address the fears of many end-users. Replacing the previous encryption standard, WEP (Wireless Equivalent Privacy), with more robust WiFi standards Wi-Fi Protected Access (WPA) is a step in the right direction but IT security managers are still sceptical.

WPA uses a higher level of encryption and brings in dynamic key exchange functions absent with WEP. WPA is designed to work with existing products and is expected to first appear in Wi-Fi certified products during the first quarter of next year.

Eighty per cent of IT security managers questioned by Defcom said they did not trust the manufacturers of wireless networking solutions to provide security expertise, even after the announcement of WPA.

One small step for security, one giant leap of the marketing kind

User caution about WPA, which all concerned welcome as a big improvement on the broken WEP standard, is echoed by vendors who tell us WPA is far from the last word on wireless security.

Wireless gateway vendor Bluesocket says WPA is a significant improvement over WEP as a security framework. But it is an incomplete, temporary solution until 802.11i is available at the end of 2003. 802.11i is the medium term goal for the Wi-Fi Alliance, but in promoting testing and interoperability work on WPA the industry is losing sight of some of its shortcomings, Bluesocket argues.

Dave Juitt, CTO at Bluesocket, said enterprises are looking for bandwidth management, secure mobility and policy enforcement features but WPA only covers authentication and access control.

"WPA only addressing one part of the puzzle. It won't solve all the problems even when its is deployed, which is not a given" Juitt told us.

WEP frequently went unused by many enterprise users, some of whom left themselves vulnerable to war driving by not taking additional security measures (such as deploying wireless networks over VPNs).

So will WPA be more widely used?

Juitt reckons the short answer to that is yes, but he's not without his reservations.

"WPA is less onerous than WEP, since it doesn't have as much involvement with mobile devices, but it doesn't fulfil everyone's needs. Interoperability might still be a barrier - it's not as simple as some people say," Juitt told us.

WPA is positioned as being compatible with 802.11i when the enhanced standard becomes available. Bluesocket argues that 802.11i will require AES support in access points and therefore new hardware.

New hardware is hardly a recipe for compatibility, it points out. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.