Full Disclosure mailing list archives
Re: Wireless Security
From: "Joel R. Helgeson" <joel () helgeson com>
Date: Fri, 28 Nov 2003 21:27:05 -0600
Hey Paddy, I've been doing wireless security ever since Cisco acquired the Aironet Product line. I was working for Cisco at the time. I was also there when they developed the LEAP architecture and it was my team that implemented the first large-scale roll-out of it for the Chicago Board of Trade & the Currency Exchange. What I'm trying to say is that when it comes to wireless security, I've been there, done that. There has always been a Holy Grail that has been sought when working with Wireless Security. The trade-off always seems to be Flexibility vs. Security. This was always the case until I came across wireless gateways. I've now been working with wireless gateways for over a year now and I can say that they have solved every problem I've encountered with wireless security. A wireless gateway is similar to a firewall with some key differences. Just as a firewall is designed and customized to secure internet communications, a Wireless Gateway is customized to secure wireless to wired communications. A firewall segments internal from external networks, whereas a gateway segments wired and wireless. I would recommend that you take a look at the Reefedge product. It is by far the most scalable and secure solution I have found to date. www.reefedge.com In the interest of FD: I do not work for a wireless gateway provider, but my company does resell them. We resell them because until they came along, wireless security was a pain in the arse. I am not a paid endorser of any product, nor do I have any financial interest in any wireless gateway company. I'm pretty sure they can now export the product overseas. Regards, Joel R. Helgeson Director of Networking & Security Services SymetriQ Corporation "Give a man fire, and he'll be warm for a day; set a man on fire, and he'll be warm for the rest of his life." ----- Original Message ----- From: "Patrick Doyle" <patrick.doyle () bbc co uk> To: <full-disclosure () lists netsys com> Sent: Friday, November 28, 2003 8:40 AM Subject: [Full-disclosure] Wireless Security
Hope this question isn't off topic, I am currently looking at securing wireless networks using Cisco hardware
and wanted to check what peoples thoughts are on security.
I have read about using LEAP and also IPSEC, my concerns about using LEAP
would be that although the client and access point send hashes of the username and password, and also dynamically create WEP keys, the process is still vulnerable to brute force attacks. Now i know you can lock down the Access Point (AP) to specific MAC addresses, however, in our environment i can see wireless being used for meeting rooms etc, so the users would be random which would mean the constant addition / removal of MACs to the AP which would probably not be possible or practical all of the time. Although policy could dictate that when a wireless card is given out, the MAC address in added to the AP, however if you have multiple APs in different areas of building, being administered by different IT depts then this could soon become be a problem.
To me IPSEC looks like be the better solution using SecurID tokens (one
time passwords) to authenticate users, any thoughts would be appreciated.
BBCi at http://www.bbc.co.uk/ This e-mail (and any attachments) is confidential and may contain personal
views which are not the views of the BBC unless specifically
stated. If you have received it in error, please delete it from your system. Do
not use, copy or disclose the information in any way nor act in
reliance on it and notify the sender immediately. Please note that the BBC
monitors e-mails sent or received.
Further communication will signify your consent to this. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Wireless Security Patrick Doyle (Nov 28)
- RE: Wireless Security Simon Hailstone (Nov 28)
- Re: Wireless Security jan . muenther (Nov 28)
- Re: Wireless Security Jonathan A. Zdziarski (Nov 28)
- Re: Wireless Security jan . muenther (Nov 28)
- RE: Wireless Security Ben Nagy (Nov 28)
- Re: Wireless Security Dennis Opacki (Nov 28)
- Re: Wireless Security Joel R. Helgeson (Nov 28)
- RE: Wireless Security Michael Chenetz (Nov 30)
- <Possible follow-ups>
- RE: Wireless Security Patrick Doyle (Nov 28)
- Re: Wireless Security Chris Adams (Nov 28)
- RE: Wireless Security Simon Hailstone (Nov 28)