Feeds

WLAN security is still work in progress

Incomplete standards

  • alert
  • submit to reddit

Beginner's guide to SSL certificates

IT managers are cautiously optimistic that wireless networks will - over time - become as secure as today's local area networks, but security concerns are still holding back deployment of the technology.

Those are the main findings of a limited (but still informative) survey of IT security manager attitudes on the deployment of 802.11b (wireless) networks by security consultancy Defcom released this week.

The 20 senior IT security managers questioned by Defcom at a recent London event were optimistic on the future security of WLAN equipment. Ninety per cent believed that it will be as secure as regular LANs within the next three to five years. However nearly two thirds (60 per cent) of the IT security managers polled said that the main barrier to wireless networking growth is still the perceived lack of securit.

Wireless LAN sales growth remains strong. Recent research by Gartner Dataquest predicted worldwide WLAN shipments will grow by 73 per cent this year.

Defcom's findings should encourage both manufacturers and the Wi-Fi standards body to properly address the fears of many end-users. Replacing the previous encryption standard, WEP (Wireless Equivalent Privacy), with more robust WiFi standards Wi-Fi Protected Access (WPA) is a step in the right direction but IT security managers are still sceptical.

WPA uses a higher level of encryption and brings in dynamic key exchange functions absent with WEP. WPA is designed to work with existing products and is expected to first appear in Wi-Fi certified products during the first quarter of next year.

Eighty per cent of IT security managers questioned by Defcom said they did not trust the manufacturers of wireless networking solutions to provide security expertise, even after the announcement of WPA.

One small step for security, one giant leap of the marketing kind

User caution about WPA, which all concerned welcome as a big improvement on the broken WEP standard, is echoed by vendors who tell us WPA is far from the last word on wireless security.

Wireless gateway vendor Bluesocket says WPA is a significant improvement over WEP as a security framework. But it is an incomplete, temporary solution until 802.11i is available at the end of 2003. 802.11i is the medium term goal for the Wi-Fi Alliance, but in promoting testing and interoperability work on WPA the industry is losing sight of some of its shortcomings, Bluesocket argues.

Dave Juitt, CTO at Bluesocket, said enterprises are looking for bandwidth management, secure mobility and policy enforcement features but WPA only covers authentication and access control.

"WPA only addressing one part of the puzzle. It won't solve all the problems even when its is deployed, which is not a given" Juitt told us.

WEP frequently went unused by many enterprise users, some of whom left themselves vulnerable to war driving by not taking additional security measures (such as deploying wireless networks over VPNs).

So will WPA be more widely used?

Juitt reckons the short answer to that is yes, but he's not without his reservations.

"WPA is less onerous than WEP, since it doesn't have as much involvement with mobile devices, but it doesn't fulfil everyone's needs. Interoperability might still be a barrier - it's not as simple as some people say," Juitt told us.

WPA is positioned as being compatible with 802.11i when the enhanced standard becomes available. Bluesocket argues that 802.11i will require AES support in access points and therefore new hardware.

New hardware is hardly a recipe for compatibility, it points out. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.