WLAN security is still work in progress

Incomplete standards

IT managers are cautiously optimistic that wireless networks will - over time - become as secure as today's local area networks, but security concerns are still holding back deployment of the technology.

Those are the main findings of a limited (but still informative) survey of IT security manager attitudes on the deployment of 802.11b (wireless) networks by security consultancy Defcom released this week.

The 20 senior IT security managers questioned by Defcom at a recent London event were optimistic on the future security of WLAN equipment. Ninety per cent believed that it will be as secure as regular LANs within the next three to five years. However nearly two thirds (60 per cent) of the IT security managers polled said that the main barrier to wireless networking growth is still the perceived lack of securit.

Wireless LAN sales growth remains strong. Recent research by Gartner Dataquest predicted worldwide WLAN shipments will grow by 73 per cent this year.

Defcom's findings should encourage both manufacturers and the Wi-Fi standards body to properly address the fears of many end-users. Replacing the previous encryption standard, WEP (Wireless Equivalent Privacy), with more robust WiFi standards Wi-Fi Protected Access (WPA) is a step in the right direction but IT security managers are still sceptical.

WPA uses a higher level of encryption and brings in dynamic key exchange functions absent with WEP. WPA is designed to work with existing products and is expected to first appear in Wi-Fi certified products during the first quarter of next year.

Eighty per cent of IT security managers questioned by Defcom said they did not trust the manufacturers of wireless networking solutions to provide security expertise, even after the announcement of WPA.

One small step for security, one giant leap of the marketing kind

User caution about WPA, which all concerned welcome as a big improvement on the broken WEP standard, is echoed by vendors who tell us WPA is far from the last word on wireless security.

Wireless gateway vendor Bluesocket says WPA is a significant improvement over WEP as a security framework. But it is an incomplete, temporary solution until 802.11i is available at the end of 2003. 802.11i is the medium term goal for the Wi-Fi Alliance, but in promoting testing and interoperability work on WPA the industry is losing sight of some of its shortcomings, Bluesocket argues.

Dave Juitt, CTO at Bluesocket, said enterprises are looking for bandwidth management, secure mobility and policy enforcement features but WPA only covers authentication and access control.

"WPA only addressing one part of the puzzle. It won't solve all the problems even when its is deployed, which is not a given" Juitt told us.

WEP frequently went unused by many enterprise users, some of whom left themselves vulnerable to war driving by not taking additional security measures (such as deploying wireless networks over VPNs).

So will WPA be more widely used?

Juitt reckons the short answer to that is yes, but he's not without his reservations.

"WPA is less onerous than WEP, since it doesn't have as much involvement with mobile devices, but it doesn't fulfil everyone's needs. Interoperability might still be a barrier - it's not as simple as some people say," Juitt told us.

WPA is positioned as being compatible with 802.11i when the enhanced standard becomes available. Bluesocket argues that 802.11i will require AES support in access points and therefore new hardware.

New hardware is hardly a recipe for compatibility, it points out. ®

Sponsored: 5 critical considerations for enterprise cloud backup