Feeds

WLAN security is still work in progress

Incomplete standards

  • alert
  • submit to reddit

Beginner's guide to SSL certificates

IT managers are cautiously optimistic that wireless networks will - over time - become as secure as today's local area networks, but security concerns are still holding back deployment of the technology.

Those are the main findings of a limited (but still informative) survey of IT security manager attitudes on the deployment of 802.11b (wireless) networks by security consultancy Defcom released this week.

The 20 senior IT security managers questioned by Defcom at a recent London event were optimistic on the future security of WLAN equipment. Ninety per cent believed that it will be as secure as regular LANs within the next three to five years. However nearly two thirds (60 per cent) of the IT security managers polled said that the main barrier to wireless networking growth is still the perceived lack of securit.

Wireless LAN sales growth remains strong. Recent research by Gartner Dataquest predicted worldwide WLAN shipments will grow by 73 per cent this year.

Defcom's findings should encourage both manufacturers and the Wi-Fi standards body to properly address the fears of many end-users. Replacing the previous encryption standard, WEP (Wireless Equivalent Privacy), with more robust WiFi standards Wi-Fi Protected Access (WPA) is a step in the right direction but IT security managers are still sceptical.

WPA uses a higher level of encryption and brings in dynamic key exchange functions absent with WEP. WPA is designed to work with existing products and is expected to first appear in Wi-Fi certified products during the first quarter of next year.

Eighty per cent of IT security managers questioned by Defcom said they did not trust the manufacturers of wireless networking solutions to provide security expertise, even after the announcement of WPA.

One small step for security, one giant leap of the marketing kind

User caution about WPA, which all concerned welcome as a big improvement on the broken WEP standard, is echoed by vendors who tell us WPA is far from the last word on wireless security.

Wireless gateway vendor Bluesocket says WPA is a significant improvement over WEP as a security framework. But it is an incomplete, temporary solution until 802.11i is available at the end of 2003. 802.11i is the medium term goal for the Wi-Fi Alliance, but in promoting testing and interoperability work on WPA the industry is losing sight of some of its shortcomings, Bluesocket argues.

Dave Juitt, CTO at Bluesocket, said enterprises are looking for bandwidth management, secure mobility and policy enforcement features but WPA only covers authentication and access control.

"WPA only addressing one part of the puzzle. It won't solve all the problems even when its is deployed, which is not a given" Juitt told us.

WEP frequently went unused by many enterprise users, some of whom left themselves vulnerable to war driving by not taking additional security measures (such as deploying wireless networks over VPNs).

So will WPA be more widely used?

Juitt reckons the short answer to that is yes, but he's not without his reservations.

"WPA is less onerous than WEP, since it doesn't have as much involvement with mobile devices, but it doesn't fulfil everyone's needs. Interoperability might still be a barrier - it's not as simple as some people say," Juitt told us.

WPA is positioned as being compatible with 802.11i when the enhanced standard becomes available. Bluesocket argues that 802.11i will require AES support in access points and therefore new hardware.

New hardware is hardly a recipe for compatibility, it points out. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.