Electronic Systems Technology ESTEEM195EP BASE STATION TRANSMITTER User Manual CHAPTER 2

Electronic Systems Technology BASE STATION TRANSMITTER CHAPTER 2

SECURITY

APPENDIX E SECURITY Revised: 1 Aug 05 APX E-1 EST P/N AA107G OVERVIEW The security for the ESTeem Model 195Eg, like all network security, must be multi-layered. One level of security is never enough to make sure that data does not end up in the wrong hands. Please review the following security levels and decide what is the most appropriate for your network. 128-BIT WEP The 128 WEP uses a particular algorithm called RC4 encryption to encode and decode traffic that is based on a 104-bit encryption key and a 24-bit Initialization Vector (IV). RC4 starts with a relatively short encryption key (104 bits) that is expanded into a nearly infinite stream of keys to accompany the stream of packets. The basic concept of RC4 is good, but the way it’s implemented in WEP leaves it open to compromise. The researchers that test the integrity of the system usually focus on one piece of the implementation, the Initialization Vector (IV). The IV (24 bits) is the algorithm component that’s supposed to keep expanded keys from repeating. From the researcher’s point of view, a high-volume access point is mathematically guaranteed to reuse the same key stream at least once a day. When this happens, it’s called an IV collision this becomes a soft spot to enter the system. The researchers aren’t saying that it’s easy to break into the system, or that it’s being done on a regular basis, only that it is possible and that administrators should consider ways to reduce the possibility. WPA Wi-Fi Protected Access with Preshared Key (WPA PSK) WPA, which uses 802.1x, was introduced in 2003 to improve on the authentication and encryption features of WEP. All authentication is handled within this access point device. WPA has two significant advantages over WEP: 1. An encryption key differing in every packet. The TKIP (Temporal Key Integrity Protocol) mechanism shares a starting key between devices. Each device then changes their encryption key for every packet. It is extremely difficult for hackers to read messages even if they have intercepted the data. 2. Certificate Authentication (CA) can be used, blocking a hacker posing as a valid user. Wi-Fi Protected Access with Enterprise Server (WPA Enterprise) Like WPA PSK, WPA Enterprise uses 802.1x. However, a backend authentication server handles the authentication decision. The most commonly type of authentication server is a RADIUS server. The ESTeem Model 195Eg can be configured to operate with an established RADIUS server on the network. WPA is server/client relationship from a software driver on a computer’s wireless LAN (WLAN) card to an Access Point. The scope of WPA is limited in use to this configuration only. The ESTeem Model 195Eg can support WPA Enterprise and PSK as an Access Point, but the level of security on the Bridging layer is configured separately. ACCESS CONTROL LIST (ACL) The ACL is one of the simplest yet most secure methods of network security. The ACL is a configurable MAC filter in the Model 192E that can be set to allow specific MAC address on the wireless network by individual address or address ranges. The same filter can also be set to reject individual MAC addresses or address ranges. The MAC address is a unique, 6 hexadecimal field address assigned at the manufacturer that can not be changed. The MAC address is traceable through the IEEE governing body to the manufacturer and is the “fingerprint” for all Ethernet devices.
APPENDIX E SECURITY Revised: 1 Aug 05 APX E-2 EST P/N AA107G Using a combination of both the WPA or 128-Bit WEP encryption and the ACL filter provide the ESTeem an extremely secure wireless networking layer. DISABLING BROADCAST PROBES AND HIDING SSID A simple but very effective way of securing a network is to make the network difficult to find. By disabling broadcast probes and hiding the Service Set Identification (SSID), wireless and network “sniffers” will not be able to find your ESTeem Model 195Eg network. To gain access to the wireless network, you would be required to have the SSID and all security loaded in the WLAN card software prior to entering the network. PROPRIETARY BRIDGE COMMUNICATION Although the ESTeem Model 195Eg is compatible with the open communication standards IEEE 802.11g and 802.11b, the repeater communication between the units is a proprietary communication link. No other manufacturer of wireless hardware can access the ESTeem repeater network when bridging between Ethernet networks. This proprietary communication layer, in combination with the other security settings, allows you as the user to reject wireless clients into the network if so desired. When used in conjunction with the Access Control List the 802.11g and 802.11b client access can be removed. The security level of the bridge communication link is configurable for 64-Bit WEP, 128-Bit WEP or TKIP and is completely independent of the client access level or any other communication link level. For example, an ESTeem Model 195Eg can be configured for WPA Enterprise for client level access, communicate to another ESTeem Model 195Eg using a TKIP bridge link and also communicate 128-Bit WEP to our older ESTeem Model 192E radio modems all running simultaneously. MASQUERADE MODES When the ESTeem Model 195Eg is configured in either the Access Point Masquerade or the Client Masquerade modes, the wireless modem functions as a network firewall. If access to the wired network is the greatest concern, place the ESTeem in the Masquerade mode and the wireless network will be completely isolated from the wired Ethernet network. INCREASING NETWORK SECURITY The following are a few suggestions to help improve the overall security of your wireless network: 1. Enable the security. If you research all of the articles regarding hackers, they have gotten into the user’s network due to the security not being enabled. 2. Set the ACL filter to include only those MAC address of the wireless Ethernet device being used on the network. 3. Set "Hide SSID" to True. As you take your access point out of the box, broadcast SSID is enabled which means that it will accept any SSID. By hiding the SSID configured in the client must match the SSID of the access point. 4. Make sure the keys are not reused in your company, since reuse increases the statistical likelihood that someone can figure the key out and change the default password on your access point or wireless router 5. Change the default SSID of your product. Don't change the SSID to reflect your company's main names, divisions, or products. It just makes you too easy to target. 6. As a network administrator, you should periodically survey your company using a tool like NetStumbler to see if any "rogue" access points pop up within your company without authorization. All of your hard work to "harden" your wireless network could be wasted if a rogue AP was plugged into your network behind the firewall.
APPENDIX E SECURITY Revised: 1 Aug 05 APX E-3 EST P/N AA107G 7. Many access points allow you to control access based on the MAC address of the NIC attempting to associate with it. If the MAC address of your NIC isn't in the table of the access point, you won't associate with it. And while it's true that there are ways of spoofing a MAC address that's been sniffed out of the air, it takes an additional level of sophistication to spoof a MAC address. The downside of deploying MAC address tables is that if you have a lot of access points, maintaining the tables in each access point could be time consuming. Some higher-end, enterprise-level access points have mechanisms for updating these tables across multiple access points of the same brand. 8. Consider using an additional level of authentication, such as Remote Access Dailin User Service (RADIUS), before you permit an association with your access points. While it's not part of the 802.11b standard, a number of companies are optionally including some provision for RADIUS authentication. 9. If you're deploying a wireless router, think about assigning static IP addresses for your wireless NICs and turn off Dynamic Host Configuration Protocol (DHCP). If you're using a wireless router and have decided to turn off DHCP, also consider changing the IP subnet. Many wireless routers default to the 192.168.1.0 network and use 192.168.1.1 as the default router. 10. Don't buy Access Points or NICs that only support 64-bit WEP. 11. Only purchase Access Points that have flashable firmware. There are a number of security enhancements that are being developed, and you want to be sure that you can upgrade your access point. 12. A simple security technique used by the military is to have the administrator periodically change the key for the system i.e. weekly, monthly, etc.

Navigation menu