Wireless Security: End to End

by Brian Carter and Russell Shumway John Wiley & Sons 2002 (504 pages) Citation ISBN:9780764548864 This Practical, hands-on guide will lead you through the wilderness of competing wireless security solutions-and show you how to determine the best mix of security components for your organization. Table of Contents Wireless SecurityEnd to End Preface Part I - Introduction to Wireless Network Security Chapter 1 - Introduction to Wireless Networking Chapter 2 - Wireless Threat Analysis Chapter 3 - Behind the Threat Part II - Network Security Components Chapter 4 - The Network Security Model Chapter 5 - Network Intrusion Protection Chapter 6 - Network Intrusion Detection Chapter 7 - Host-Based Security Chapter 8 - Virtual Private Networking Chapter 9 - Event Correlation Part III - Wireless Security Components Chapter 10 - Secure Configuration Chapter 11 - Secure Authentication Chapter 12 - Encryption Chapter 13 - Wireless Device Placement Part IV - Integrating Wireless Access into the Network Security Process Chapter 14 - Logging Wireless Events Chapter 15 - Policy Issues Chapter 16 - Assessing Wireless Network Security Chapter 17 - Change Control and Device Administration Part V - Wireless Security Models Chapter 18 - Cisco Implementation with LEAP Chapter 19 - WLAN Authentication and Key Management with RADIUS Chapter 20 - Wireless Access with IPSEC Chapter 21 - Secure Wireless Public Access Chapter 22 - Secure Wireless Point-to-Point Connectivity Appendix A - Glossary of Terms Appendix B - Web Site References Index List of Figures List of Tables List of Code Examples List of Sidebars

Wireless SecurityEnd to End

Brian Carter Russell Shumway Wireless Security End to End Published by Wiley Publishing, Inc. 10475 Crosspoint Boulevard Indianapolis, IN 46256 www.wiley.com Copyright 2002 by Wiley Publishing, Inc., Indianapolis, Indiana Published by Wiley Publishing, Inc., Indianapolis, Indiana Published simultaneously in Canada Library of Congress Catalog Card Number: 2002107894 ISBN: 0-7645-4886-7 Manufactured in the United States of America 10 9 8 7 6 5 4 3 2 1 1B/SR/QY/QS/IN No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 7504744. Requests to the Publisher for permission should be addressed to the Legal Department, Wiley Publishing, Inc., 10475 Crosspoint Blvd., Indianapolis, IN 46256, (317) 572-3447, fax (317) 572-4447, EMail: permcoordinator@wiley.com. Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor author shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages. For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at (800) 762-2974, outside the U.S. at (317) 572-3993 or fax (317) 572-4002. Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books.

Trademarks: Wiley, the Wiley Publishing logo, End to End and related trade dress are trademarks or registered trademarks of Wiley Publishing, Inc., in the United States and other countries, and may not be used without written permission. All other trademarks are the property of their respective owners. Wiley Publishing, Inc., is not associated with any product or vendor mentioned in this book. About the Authors Brian Carter is an Information Protection Analyst for a financial institution in the Midwest. He was first introduced to information security while serving as an intelligence analyst in the U.S. Army and later as an analyst for a drug task force sponsored by the Department of Justice, where he implemented a secure extranet system for collecting and disseminating drug intelligence. Since then he has worked as a consultant, performing security assessments on wired and wireless networks, as well as managing firewalls and Intrusion Detection Systems. He is a Certified Cisco Security Specialist - 1 and a Certified Information Systems Security Professional (CISSP). Russell Shumway, a Principal Consultant at Guardent, is a recognized expert in the field of information security. Prior to Guardent, he was the technical director for Response Services for Global Integrity, where he provided incident response consulting for large commercial clients throughout the United States and Europe, including 7 of the 10 largest banks in the U.S. and 13 of the top 50 in the world. He assisted in design and implementation of the Information Sharing and Analysis Center (ISAC) for the financial services sector. As a U.S. Army Reserve officer, he performed vulnerability assessments of military computer networks for the Army Computer Emergency Response Team. He was the first person (either military or civilian) to be certified to perform penetration testing on Army networks. He is also the author of Incident Response: A Strategic Guide to Handling System and Network Security Breaches and has spoken and presented at information security conferences in the U.S. and Europe. He is an adjunct professor at the University of Virginia and a Certified Information Systems Security Professional (CISSP). Credits Acquisitions Editor Katie Feltman Project Editor Kevin Kent Technical Editors Scott Orr Joan Ross Copy Editor Jennifer Ashley Editorial Manager Ami Frank Sullivan Vice President & Executive Group Publisher Richard Swadley Vice President and Executive Publisher Bob Ipsen Executive Editorial Director Mary Bednarek

Executive Editor Carol Long Project Coordinator Maridee Ennis Graphics and Production Specialists Beth Brooks Kristin McMullan Laurie Petrone Jeremey Unger Quality Control Technicians David Faust John Greenough Charles Spencer Permissions Editor Carmen Krikorian Book Designers Michael Freeland Kathie Schutte Proofreading and Indexing TECHBOOKS Production Services I would like to dedicate my portion of this book to Gene Schultz, my mentor, advisor, colleague, and good friend. Thanks for having faith in me. Russell Shumway

Preface
The adoption of wireless networking has grown very rapidly in the last couple of years. There are many advantages to wireless networking, even beyond the obvious lack of having to bend over your desk to plug in your laptop. Many enterprises are using wireless to bridge two office buildings, to attract customers, and to provide easy-to-use network connectivity to roaming users. These advantages come with some pretty serious risk, and those responsible for information services should carefully determine if the benefit is worth the risk. There has been a great deal of press regarding wireless security, and many articles go as far as saying it is not worth the risk at all. This book aims to help readers decide how to approach wireless security and how to make a determination of whether or not it is appropriate for their enterprise. It will also serve readers who are currently responsible for a wireless network in helping them decide what level of security is appropriate for them.

Why We Wrote This Book

This book was written primarily to help readers wade through all of the negative information about wireless network security. There seems to be a new article or television expose about wireless security almost daily, and many of them offer conflicting information. We believe that wireless networks can be at least as secure as their wired counterparts, and we hope that this book will lead readers to a solution that makes wireless work for them, without creating an unmanageable security risk. There are many different approaches to writing a technical reference. Many readers prefer a step-by-step approach, while others prefer a detailed technical overview, without any instruction. This book takes an overview approach in the first few sections and leaves the reader with several step-by-step solutions at the end. The intent is to build the readers understanding of the concepts and finish with a complete solution that he or she can use in the enterprise. We intended for this book to be completely vendor neutral so it would be useful to a broad audience. The examples in this book are based on some of the most popular equipment at the time of this writing, such as Cisco and Orinoco products. However, if you do not possess the particular brand of equipment discussed, you may still find the information in those sections useful because many of the terms, configuration options, and features are similar in many different manufacturers equipment.

Who Should Read This Book

This book was written for security professionals new to wireless networking and for wireless network administrators new to security. It has a mix of step-by-step instruction and overview of security and networking concepts. It is focused on security problems and solutions, and the coverage of basic concepts is light. In other words, a reader should have at least a fundamental understanding of wireless networking, such as what an access point is and what the difference between ad hoc and infrastructure modes is. If you are completely new to wireless networking, you may find it useful to review another text before this one, or you may find it difficult to follow.

How This Book Is Organized

This book is organized into five parts as follows:

Part I: Introduction to Wireless Network Security

In this part, the fundamental security issues that face users of wireless technology are discussed. Many types of popular wireless communication are discussed, such as mobile phones, PDAs, Bluetooth, and wireless LANs.
Part II: Network Security Components

This part covers the components of network security for the wired network, such as firewalls, Intrusion Detection Systems (IDS), and policies.
Part III: Wireless Security Components

This part details the components that improve wireless network security. Basics, such as secure configuration and standards-based security mechanisms, are discussed.
Part IV: Integrating Wireless Access into the Network Security Process

This part provides details on how to make sure your wireless devices are kept as secure as your wired devices. Discussions on minimizing the risk of unintentional misconfiguration, recovering from disaster, collecting security events from wireless devices, and conducting self-assessments are included.
Part V: Wireless Security Models

This part includes chapters that provide models for implementing a secure wireless network in your enterprise. Each of the models is designed to fit a particular space, such as an all-Cisco enterprise or a wireless network for public access.

Acknowledgments
I would like to thank Katie Feltman and Kevin Kent, first and foremost, for their seemingly unending patience and insight as my Acquistions Editor and Project Editor for this book. I would also like to thank Scott Orr, my technical editor, for a great deal of much needed advice and for keeping me honest with many areas that I may have otherwise neglected. Also, I want to thank Craig Pennington and Jeff Ambern for helping me get all of the equipment and my boss, Greg Weber, for ignoring my grumpiness after many sleepless nights. Brian Carter I would like to thank, in alphabetical order, Tim Appleby, Jen Braun, Bob Friel, Terry Gudaitis, Mark Rasch, Frank Schugar, and Errol Weiss. Thanks to Joan Ross for acting as a technical editor and reviewing the work. Any errors or omissions are mine alone. As always, thanks to my wife, Amy McBurnie, for all her support and encouragement. Russell Shumway

Part I: Introduction to Wireless Network Security

Chapter List:
Chapter 1: Introduction to Wireless Networking Chapter 2: Wireless Threat Analysis Chapter 3: Behind the Threat

In This Part:
Wireless data communication is a rapidly evolving technology that is enjoying wide deployment in all types of enterprise, small office, and residential networks. Like most developing information technologies, wireless suffers from many security problems that place the operator at risk. Hopefully, as wireless networking matures, most of the current security issues will be resolved, and the only new problems will be vendor or implementation specific. In the interim, this book offers detailed coverage of current security problems and how to manage each of them. Part I briefly introduces wireless networking, different types of wireless threats, and the types of people who take advantage wireless security problems.

Chapter 1: Introduction to Wireless Networking

Overview
In This Chapter There are several types of wireless communication in use today. Specifically, this chapter introduces you to the following:

802.11b or WiFi wireless networks HomeRF Bluetooth Wireless Application Protocol (WAP)

Its important to remember that this chapter aims to familiarize you with the most popular types in use today. It is not intended to be a detailed technical analysis of specific protocols or standards, nor will it cover technologies that only exist in small markets or those whose future is unclear.