Secure and Manageable Enterprise WLANs

TECH NOTE Secure and Manageable Enterprise WLANs Sumit Deshpande Office of the CTO May 2004 Secure and Manageable Enterprise WLANs ireless local area networks (WLANs) are being deployed in enterprises all over the world. W Enterprises recognize the value of wireless networks and are using this technology to increase workforce productivity and improve customer service. However, WLANs are plagued with security and management vulnerabilities that threaten more widespread acceptance. It is critical for enterprises to understand the areas of risk and take the right measures to mitigate them. Although basic security measures are available, they are not sufficient to safeguard the enterprise network. The right solution to manage and enforce WLAN security is crucial in order for enterprises to fully leverage wireless networks to fulfill their business objectives. Computer Associates International, Inc. (CA) fully understands the benefits and challenges of adopting wireless technology, and provides comprehensive security and management solutions to enable organizations to successfully deploy safe and manageable wireless computing environments. The following paper discusses the various types of wireless networks available today, the challenges involved in managing and protecting them, and the ways in which CA solutions can help organizations overcome these challenges. Wireless Technology Today Wireless technology has advanced tremendously in recent years and is now considered a viable enterprise solution. The media has often portrayed wireless technology as the panacea for the ongoing challenge of keeping mobile employees connected to the enterprise network and information resources without hampering their productivity. Cultural and social changes are driving more and more people to work while “on the road” or from home. These changes require the enterprise IT infrastructures to support mobile and remote employees. Meanwhile, mobile device manufacturers have been promoting visions of high-capacity handheld devices. This is getting closer to reality as mobile devices today boast of 64 MB RAM and 400 MHz processors — configurations that rival currently available low-end desktops. By 2005, it won’t be surprising to find handheld devices with processing capabilities equal to or even greater than today’s high-end desktops. While miniaturization facilitates high-capacity mobile computing, wireless technology is what keeps the mobile worker connected to the enterprise. Many enterprises are deploying WLANs to enable their mobile employees to stay connected to the corporate network while doing their work. In fact, experts have predicted that within the next few years, all end-user computing will be wireless. WLAN Options are Increasing Over the years, wireless communication has significantly advanced. Wireless frequency spectrum has been released by government agencies to be used for commercial purposes. The unlicensed 2.4 GHz band is used by several kinds of wireless devices, including two-way communicators, baby monitors, cordless phones and WLAN access points. Some wireless devices are also using the 5 GHz band. The availability of the spectrum has played an important role in facilitating the acceptance and growth of wireless technology within the enterprise. The Institute of Electrical and Electronics Engineers1 (IEEE) has developed several specifications for WLAN technology, the names of which read like a veritable alphabet soup. Here are some of the specifications that are available today or are in the works. 802.11b This specification operates at 2.4 GHz frequency with a proposed throughput of 11 Mbps and a range of 200 to 300 feet. This specification is the most widely used and is good for basic WLAN deployment in the enterprise or at home. The 802.11b WLAN specification is being deployed in many enterprises today in an experimental manner, and in some 1 cases even in limited production. Most industry analysts agree that enterprises must go ahead and deploy 802.11b WLANs and leverage the experience they get from this to then deploy more robust specifications as they are released. 802.11b WLANs are relatively inexpensive to set up and many enterprises have derived immediate benefits. However, since they operate in the unlicensed and extremely crowded 2.4 GHz band, there have been many complaints about interference with devices using the same band for their wireless communications. Although 802.11b offers 11 channels for communication using Direct Sequence Spread Spectrum Modulation2, only three, or maximum four, can realistically be used with minimal interference. This limits the number of unique channels that enterprises can use for wireless data transfer without interfering with, or being interfered by, WLANs belonging to other organizations in facilities that are physically close to one another. 802.11g This specification, ratified in mid-2003, operates at 2.4 GHz frequency with a throughput of 54 Mbps and a range of 100 to 200 feet. Many enterprises are seriously considering moving to 802.11g due to its higher throughput, even though the associated costs might be a bit higher. Many access points today support both 802.11b and 802.11g. It is quite possible that 802.11g will take over 802.11b as the next WLAN standard. However, there are several performance issues that need to be sorted out with 802.11g before that happens. 802.11a This specification operates at 5 GHz frequency with a proposed throughput of 54 Mbps and a range of 50 to 60 feet. 802.11a provides up to 12 channels for communications using Orthogonal Frequency Division Multiplexing3 (OFDM). Its high performance and throughput is in demand for bandwidth-hungry applications. However, their range is much shorter, and multiple 802.11a access points are required to cover the same range provided by one 802.11b access point. This makes it more expensive to install and manage. Yet many enterprises prefer to bear the cost rather than risk interference and compromise security and quality of service. 802.11h This specification is a European variant of 802.11a with additional optimization features. These two 5 GHz standards are nearly identical, except that 802.11h adds Transmit Power Control (TPC), which limits the wireless network card from emitting more radio signal than is needed, and Dynamic Frequency Selection (DFS), which lets the device listen to what is happening in the airspace before picking a channel. TPC and DFS are both required features in Europe. 802.11i This specification, still in progress, is an overlay to existing WLAN specifications and will have enhanced security measures such as stronger encryption and access control. The IEEE is working on other specifications, each with a specific goal, that are likely to be released in the near future. Some of them include: • 802.11c — to improve interoperability between devices • 802.11d — to improve roaming • 802.11e — for improved quality of service • 802.11f — to regulate inter-access point handoffs No matter which WLAN specification is employed, the basic concepts of deployment and security are the same. 2 WLAN Infrastructure A typical WLAN is set up as an extension of the existing corporate network, as shown in Figure 1. This enables mobile employees to remain connected to the enterprise while being on the move. A basic WLAN configuration includes the following components: • Wireless Access Point. This is a router that enables wireless devices to access the wired network. Access points are usually placed outside the firewall to facilitate convenient access, but this also makes them vulnerable to attacks. Access points support specific WLAN types, for example 802.11b. Dual- band access points, such as the ones that support both 802.11b and 802.11a WLANs, are also available. Access point manufacturers include vendors such as Cisco, Intel, Linksys and others. • Mobile Devices. These include laptops, personal digital assistants (PDAs), Tablet PCs and other similar devices that mobile workers can carry with them to do their work. However, unless the mobile devices are geared with wireless network capability, they cannot access the WLAN. • Wireless Network Interface Cards (NICs). Wireless NICs enable mobile devices to communicate with the access point using radio frequency transmissions. Each card has a unique Media Access Control (MAC) address, which can be used for authentication purposes. The wireless NIC must be compatible with the access point. For example, if a person has an 802.11b access point, he or she needs an 802.11b NIC. Dual-mode NICs, similar to dual-mode access points, are also available. • Security Server. Most WLANs have a server that Figure 1. A typical WLAN setup in the enterprise enforces and manages security policies to help ensure that wireless users can access the appropriate information on the corporate network, while keeping intruders at bay. There are several ways WLANs can be used to cut costs, increase productivity and enable organizations to achieve their business goals. • Nurses and doctors can now access patient records using their wireless-enabled handheld device instead of taking notes on paper and reentering them at the end of the day. • Workers in manufacturing plants can access design specifications and enter diagnostic information to the central computer using their wireless devices from the floor, saving time.