Wireless Security Basics

1. Wireless Security Basics A Discussion Motivator For Technology Coordinators of NWOCA Owner-Member Schools

2. Vision Statement • In the future NWOCA member school districts will implement wireless network access points in a consistent, easily managed mode, and in a manner that protects network integrity for all NWOCA member school districts.

3. Today’s Goals and Objectives • Achieve a basic understanding of terminology and related technologies • Provide suggestions for short-term rudimentary security mechanisms that should be implemented for all wireless devices

4. Today’s Goals and Objectives • Initiate a dialogue that leads to the development of a wireless security policy that is embraced by NWOCA and all its member school districts

5. Today’s Situation • Most district wireless access points are “wide open”, with no security mechanisms implemented • Some “rogue” (not implemented or managed by the district technology staff or NWOCA) wireless access points exist in the network

6. Today’s Situation • Many NWOCA school districts are (unknowingly) providing unsecured wireless access in public areas outside of their buildings • Most districts don’t understand the “hidden” costs of wireless total cost of ownership (TCO) [see next two slides]

7. Wired vs. Wireless TCO • Gartner Research (June 2004) • Wired Lan Cost - $453/user/year • Wireless LAN Cost - $1,026/user/year • Mixed Wired and Wireless LAN Cost - $1,043/user/year • Cost differential is primarily in personnel costs for administering wireless vs. wired networks

8. Gartner Recommendations • Wired LANs are more reliable, secure, and faster than their wireless counterparts • Understand that wireless has a much higher TCO than wired LANs and assess whether the productivity gains or convenience outweigh the additional costs

9. Today’s Situation • Wireless access points are SNMP-managed gateways to the network, and (technically) are required to be under the management of NWOCA personnel per NWOCA’s network management policy adopted by the member school district boards of education

10. Today’s Situation • Unauthorized network usage represents a financial liability for the school district, with a penalty being the potential loss of E-Rate, ODE, and OSN technology funding; and/or criminal/civil liability under the Family Educational Rights to Privacy Act (FERPA) and HIPAA

11. Today’s Situation • A good security strategy is like an onion. It has to have multiple and varied layers to be any good. • Security enforcement at each NWOCA district has a direct effect on the security of all other districts served by NWOCA … “weakest link” syndrome

12. How Did We Get Here? • Wireless access points can be easily, cheaply, and quickly implemented when overall network security and user authentication strategies are not taken into consideration • Wireless access points are cheap and can be used to provide access to areas that would remain otherwise unserved

13. Terminology/Definitions • 802.11 ~ IEEE specification for over-the-air wireless networks • 802.11i ~ Proposed specification for “next generation” WLAN security standards • 802.1x ~ IEEE specification for port-based access control

14. Terminology/Definitions • AES ~ Advanced Encryption Standard • EAP ~ Extensible Authentication Protocol • FAST ~ Flexible Authentication via Secure Tunnel • LAN ~ Local Area Network (Intra-Building)

15. Terminology/Definitions • LEAP ~ Lightweight Extensible Authentication Protocol • MAC ~ Media Access Control • MD5 ~ Message Digest Encryption Algorithm #5 • MSCHAP ~ Microsoft Challenge-Handshake Authentication Protocol

16. Terminology/Definitions • PEAP ~ Protected Extensible Authentication Protocol • PKI ~ Public Key Infrastructure • RF ~ Radio Frequency • SSID ~ Subsystem Identification • TCO ~ Total Cost of Ownership

17. Terminology/Definitions • TLS ~ Transport Layer Security • TTLS ~ Tunneled Transport Layer Security • VPN ~ Virtual Private Network • WAN ~ Wide Area Network (Inter-Building) • WAP ~ Wireless Access Point

18. Terminology/Definitions • WEP ~ Wired Equivalent Privacy • Wi-Fi ~Wireless Fidelity • WLAN ~ Wireless Local Area Network • WPA ~ Wi-Fi Protected Access • WPA2 ~ Wi-Fi Protected Access using AES

19. Available Options • Do nothing – ignore the issue • Potentially catastrophic strategy • Financial/civil liabilities for districts • Network disruption potential • Adopt a multi-strategy approach • Try to eliminate or minimize financial/civil liabilities for districts • Strengthen overall security within NWOCA’s network – “weakest link” syndrome

20. Recommended Strategies • Education & Training • Problem awareness and understanding is key to success • Establish consensus for minimum agreed-upon wireless security measures to be implemented for all wireless implementations within NWOCA’s network

21. Recommended Strategies • Convene a committee of technology coordinators and NWOCA personnel to develop and propose a comprehensive WLAN security policy for adoption and implementation for all NWOCA member school districts

22. Strategy: Education • This session • What other educational/information sessions are needed by NWOCA member district coordinators?

23. Strategy: Minimal Security Steps • Change default wireless access point administrative password • Eliminate casual access to administrative functions of the wireless access point • Change SSID away from vendor default • Do not make the SSID “obvious”, and change it every school year if administratively feasible

24. Strategy: Minimal Security Steps • Set SSID broadcast to “NO” • Avoid broadcasting the name of your wireless network and making it easier for casual hackers to attempt unauthorized accesses • Note: Some wireless access points do not support this feature. • Should there be a “standard” for wireless access points in the NWOCA network?

25. Strategy: Minimal Security Steps • Enable WEP Encryption • If your volume of wireless devices permits, enable WEP encryption to provide a more secure transmission of data wirelessly. This is especially important if student data is being transmitted wirelessly.

26. Strategy: Minimal Security Steps • Enable WEP Encryption • Create WEP keys creatively using a mixture of nonsense words and numbers using the highest encryption level possible (128-bit) • Change WEP keys each school year if administratively feasible

27. Strategy: Minimal Security Steps • Enable MAC Filtering • If your wireless device volume permits, enable MAC (Media Access Control) filtering. This creates an access control allowing only registered devices to access the wireless network. • Can be spoofed, but it is like adding another lock on your front door. The more obstacles you present, the more likely hackers will try less secure organizations.

28. Strategy: Minimal Security Steps • Ensure you own the “footprint” of all WLAN access points • Test your wireless access points to determine whether they are providing coverage outside your facilities. If so, move them so that doesn’t occur, or install directional antennas to focus the footprint. Some access points have adjustable power levels to assist with this problem.

29. Strategy: Minimal Security Steps • Install or enable a personal firewall on all laptops authorized to use a wireless interface, and lockdown visibility and changes to network control settings on those that have been authorized. • Link open ports to specific IP addresses and ranges as needed

30. Strategy: Minimal Security Steps • Educate district personnel that connecting unauthorized wireless access points to the school network is not permitted

31. Strategy: Minimal Security Steps • Use Static IP Addressing for Wireless Clients • Static IP addressing forces wireless clients to have a legitimate IP address before access to the network is granted. Static IP addressing forces hackers to know the network addressing scheme and manually allocate an address and gateway.

32. Strategy: Optional Next Steps • Cede management control of all wireless access points to NWOCA. • Implement EAP, LEAP, or PEAP • Have NWOCA redesign your district network to put all access points on mandatory VPN connections

33. Security Policy Development • Understanding the need • Understanding the benefits • Essential Components of a wireless policy • Delegation of authority and responsibility • Risk assessment • Network segregation

34. Security Policy Development • Essential Components of a wireless policy (cont’d.) • User authentication • Confidentiality • Availability • Logging and Accounting • Wireless Access Point Security

35. Security Policy Development • Essential Components of a wireless policy (cont’d.) • Client-Based Security • Firewall • Anti-Virus • Ad-Hoc Wireless Communications • Wireless Scanning • Education and Awareness

36. Recommended Next Steps • Can we agree on the mandatory implementation by all NWOCA member districts of the minimal steps outlined in this document? • What should be the timeline for the implementation of the mandatory minimal steps?

37. Recommended Next Steps • Districts desiring to implement optional steps outlined in this document, or having questions regarding the minimal steps, should contact the NWOCA Network Services Group (mail_staff_hw@nwoca.org)

38. Recommended Next Steps • Convene a committee of district technology coordinators and NWOCA personnel to develop a wireless network security policy as outlined in this document. • Volunteers? • Timeframe?

39. Wireless Security Basics Questions/Answers/Discussion

40. Contact Information Duane Baker, Chief Technology Officer Northwest Ohio Computer Association 22-900 State Route 34 Archbold, Ohio 43502 Phone: (419) 267-5565 Ext. 2519 Email: baker@nwoca.org