 |
| Wi-Fi Security |
PREFACE
Security is now an essential element that forms the cornerstone of every corporate network. Without privacy, however, your solution is incomplete! My expertise in the areas of security and privacy has provided me with a valuable perspective that has enabled me to save my clients hundreds of thousands of dollars of what would have been revenue lost to hackers.
Many of my clients ask me to work with their organizations as either a contractor or consultant to assist them in implementing effective security measures because there is no greater cost to an organization than falling prey to a plethora of security vulnerabilities.
As a Director of CyberSecurity for IBM Global Consulting Services for over a decade, I established myself as the leading expert in both network security and enterprise resource planning in several IT sectors. I have published 11 best-selling computer books and have written over1000 articles for the trade magazines. Today, I am always involved in writing specialized, private analyses for customers interested in acquiring my consulting services.
My experience comes from my extensive work with most of the Fortune 500 companies through my company, Executive Information Services. I work well with personnel to handle the most difficult computing problems, as I am dedicated to creating solutions that specifically meet my clients’ individual computing needs.
My core offerings include my work in the following areas:
1. Business and Strategy Development
Project management services that oversee any consulting service
through my eyes as an efficiency expert giving you the most “bang for
your buck.” My expertise is in all areas of security, privacy, and realworld
enterprise IT. My company creates the most professional technical
writing in white papers, brochures, books, articles, manuals, press
releases, and industry “focused” tear sheets.
2. Powerful Market Research
I don’t settle for regurgitated market data that puts anyone behind the
business curve, and neither should you! In this book and through my
company, I provide “real” data, customized to my client’s needs to
increase both their marketing and sales. I make sure I always stay at
the cutting edge of technology by writing comprehensive white papers
(technical and/or marketing), market research reports (better than any
research service), and effectively targeted PowerPoint presentations for
greater customer relationship management (CRM). My clients engage
me to help them create unique product and business strategies; I then
develop that information into computer-based training (CBT) modules to
train both staff and clients.
3. Cost-Effective IT Product Selection
Purchasing any IT security product is often prohibitively expensive; my
forté is that I save my clients a great deal of money by creating a personalized
product comparison matrix to help them get the most functionality
for the least amount of money. I cut through the red tape so
that my clients should never have to overpay for extra costly features
they don’t require. My work with Fortune 500 companies is so well
received because my clients get exactly what they need, resulting in savings
of several hundred thousand dollars over the long term.
My sole interest in writing this book is to describe the constantly
changing face of the wireless world of security and privacy. With information
this important, I don’t believe anyone should ever be treated like
a second-class citizen when it comes to getting the right information for
their needs and consulting projects.
I have always stuck by one motto: I treat, work, and consider any
client’s project as though I am working only for that one client.
If I can be of assistance in fulfilling your technical writing or analysis
needs, please contact me and I will be pleased to assist you in satisfying
both your business needs and mission-critical requirements.
Table of Contents
Security is now an essential element that forms the cornerstone of every corporate network. Without privacy, however, your solution is incomplete! My expertise in the areas of security and privacy has provided me with a valuable perspective that has enabled me to save my clients hundreds of thousands of dollars of what would have been revenue lost to hackers.
Many of my clients ask me to work with their organizations as either a contractor or consultant to assist them in implementing effective security measures because there is no greater cost to an organization than falling prey to a plethora of security vulnerabilities.
As a Director of CyberSecurity for IBM Global Consulting Services for over a decade, I established myself as the leading expert in both network security and enterprise resource planning in several IT sectors. I have published 11 best-selling computer books and have written over1000 articles for the trade magazines. Today, I am always involved in writing specialized, private analyses for customers interested in acquiring my consulting services.
My experience comes from my extensive work with most of the Fortune 500 companies through my company, Executive Information Services. I work well with personnel to handle the most difficult computing problems, as I am dedicated to creating solutions that specifically meet my clients’ individual computing needs.
My core offerings include my work in the following areas:
1. Business and Strategy Development
Project management services that oversee any consulting service
through my eyes as an efficiency expert giving you the most “bang for
your buck.” My expertise is in all areas of security, privacy, and realworld
enterprise IT. My company creates the most professional technical
writing in white papers, brochures, books, articles, manuals, press
releases, and industry “focused” tear sheets.
2. Powerful Market Research
I don’t settle for regurgitated market data that puts anyone behind the
business curve, and neither should you! In this book and through my
company, I provide “real” data, customized to my client’s needs to
increase both their marketing and sales. I make sure I always stay at
the cutting edge of technology by writing comprehensive white papers
(technical and/or marketing), market research reports (better than any
research service), and effectively targeted PowerPoint presentations for
greater customer relationship management (CRM). My clients engage
me to help them create unique product and business strategies; I then
develop that information into computer-based training (CBT) modules to
train both staff and clients.
3. Cost-Effective IT Product Selection
Purchasing any IT security product is often prohibitively expensive; my
forté is that I save my clients a great deal of money by creating a personalized
product comparison matrix to help them get the most functionality
for the least amount of money. I cut through the red tape so
that my clients should never have to overpay for extra costly features
they don’t require. My work with Fortune 500 companies is so well
received because my clients get exactly what they need, resulting in savings
of several hundred thousand dollars over the long term.
My sole interest in writing this book is to describe the constantly
changing face of the wireless world of security and privacy. With information
this important, I don’t believe anyone should ever be treated like
a second-class citizen when it comes to getting the right information for
their needs and consulting projects.
I have always stuck by one motto: I treat, work, and consider any
client’s project as though I am working only for that one client.
If I can be of assistance in fulfilling your technical writing or analysis
needs, please contact me and I will be pleased to assist you in satisfying
both your business needs and mission-critical requirements.
Stewart S. Miller
Director, Executive Information Services
Phone: 1-800-IT-Maven
E-Mail: WiFi@ITMaven.com
Table of Contents
Preface xvii
Chapter 1 Introduction to Wireless LAN Security Standards
Wireless Defined 2
Factors of Security 2
Theft 3
Access Control 4
Authentication 4
Encryption 5
Safeguards 6
Intrusion Detection Systems 7
IEEE 9
WECA 9
Wi-Fi 9
The Many Flavors of 802.11 9
FHSS 10
DSSS 11
OFDM 12
Bluetooth 12
Differences between the Wireless Standards 13
Conclusion: How Security Applies 14
Chapter 2 Technology
Comparisons 17
HomeRF 18
802.11 versus SWAP 18
SWAP Specification 19
Integrating Wireless Phone and Data 19
Bluetooth 19
Wireless Hacking 20
NetStumbler 20
NetStumbler Software Uses 22
Script Kiddies 22
Facts 24
Bluetooth Technology 25
Bluetooth Background 25
What Gives Bluetooth Its Bite? 26
Bluetooth Spectrum Hopping 27
Bluetooth Connections 28
Enforcing Security 30
Link Me Up! 31
Conclusion: The Future of the WLAN 32
Chapter 3 Wireless LAN Security Factors
Enabling Encryption Security 35
WEP Encryption 36
Encrypting 802.11b? 36
Network Interface Cards 36
Cross-Platform Hacking 37
Eavesdropping 39
Breaking In! 40
Counterfeiting 40
Wireless DoS Attack 41
Points of Vulnerability 42
Your Best Defense Against an Attack 45
Conclusion: Keeping Your WLAN Secure 47
Chapter 4 Issues in elWessir Security
The State of Wireless LAN Security 50
Securing Your WLAN 50
Authenticating Data 51
Client Authentication in a Closed System 53
Shared Key Authentication 53
RC4 53
Ensuring Privacy 54
Keeping Data Intact 55
Managing Keys 56
WLAN Vulnerabilities 58
Subtle Attacks 59
Common Security Pitfalls 59
Poor Security, Better than No Security at All! 59
Short Keys 59
Initialization Vectors 60
Shared Keys 60
Checks and Balances for Packets 60
Authentication 61
Location! Location! Location! 61
Attack Patterns 62
Active Attack Patterns 62
Passive Attacks 63
Conclusion 63
Chapter 5 The 802.11 Standard Defined
The 802.11 Standard 66
Issues to Consider 66
Expanding the Network Standard 69
Ad Hoc Networks 69
Extended Service Set 69
Wireless Radio Standard 70
The Standard Algorithm 71
Address Spaces 72
The 802.11 Standard in Security 72
Encryption 73
Timing and Power Management 73
Speed 75
Compatibility 75
Standard “Flavors” of 802.11 76
802.11a 76
802.11b 77
802.11d 77
802.11e 78
802.11f 78
802.11g 78
802.11h 79
802.11i 79
Conclusion: Evolution of the 802.11 Standard 80
Chapter 6 802.11 Security Infrastructure
Point-to-Point Wireless Application Security 84
Point of Interception 84
Wireless Vulnerability 86
Building a Private Wireless Infrastructure 88
Vulnerable Encryption 89
Commercial Security Infrastructure 89
Building a Private Infrastructure 90
Items to Compromise 91
Deploying Your Wireless Infrastructure 92
Determining Requirements 92
Choosing a Flavor of 802.11 93
Security Design 96
Monitoring Activity 97
Conclusion: Maintaining a Secure Infrastructure 97
Chapter 7 802.11 Encryption: Wired Equivalent
Privacy 99
Why WEP? 100
Defending Your Systems 100
WEP Mechanics 103
Wireless Security Encryption 103
Insecure Keys 104
Taking a Performance Hit 104
Wireless Authentication 105
Known WEP Imperfections 107
Access Control 108
IRL Security 109
Points of Vulnerability 109
Conclusion: Finding Security in an Unsecured World 111
Chapter 8 Unauthorized Access and Privacy
Privacy in Jeopardy 114
Passive Attacks 114
Broadcast Monitoring 115
Active Attacks 116
The “Evil” Access Point 117
Data Privacy 117
Compromising Privacy in Public Places 118
Protecting Your Privacy 118
Public or Private? 120
Safer Computing 120
The “Human” Factor 122
Defining the Bullet Points in a Security Policy 122
Training 124
Physical Security 124
Wireless Range 126
Conclusion: Common Sense Access Controls 127
Chapter 9 Open System Authentication
What is Open System Authentication? 132
802.11 Networks on Windows XP 133
User Administration 134
Managing Keys in an Open System 135
Authentication Concerns 135
802.11b Security Algorithms 136
Authentication Support 137
Shared-key Authentication 138
Secret Keys 138
The WEP Algorithm 138
Static Vulnerabilities 139
NIC Security 139
Wireless NIC Power Settings 140
Open System to WEP Authentication 141
Port-based Network Access Control 141
Securely Identifying Wireless Traffic 143
Extensible Authentication Protocol 144
Conclusion: Open System versus Closed
System Authentication 146
Chapter 10 Direct Sequence Spread Spectrum
802.11 DSSS 148
Standardization 148
MAC Layers 149
CSMA 150
Roaming 150
Power Requirements 151
Increasing Data Transmission 151
FHSS Security 154
Hop Sequences 155
FHSS versus DSSS 155
Frequency Allocation 156
Open System Security 158
It’s All About…Timing 159
System Roaming 160
Conclusion: Spectrum Safety! 160
Chapter 11 Wi-Fi Equipment Issues
Issues in Wi-Fi Deployment 164
Wireless Equipment Vendors 164
WLAN Equipment Considerations 165
Equipment Vendors 167
Market Trends 168
Technology Issues 169
Access Point-centric Configuration 170
Mobile Device Configuration 170
Building Extensions to Access Points 171
Directional Broadcasting 172
Cost Concerns 172
The Costs of Effective Security 174
Wired versus Wireless Security 176
Vendor Trials 176
Conclusion: Next-generation Wireless Equipment 178
Chapter 12 Cross-Platform Wireless User Security
WLAN Assignment Applications 182
Cost Concerns 182
Macintosh WLANs 183
Lindows OS 185
Orinoco Wireless 185
Handheld Devices 186
Cross-platform Wireless Security Concerns 187
Initialization Vector Collisions 188
Key Reuse 188
Evil Packets 189
Real-time Decryption 189
802.11 Security Issues 189
Windows XP Wireless Connectivity 192
Windows XP WEP Authentication 192
Windows XP Wireless Functionality 194
WLAN NIC Vendors 194
Conclusion: All Vendors Must Get Along! 195 197
Chapter 13 Security Breach Vulnerabilities
Intercepting Wireless Network Traffic 198
Wireless 802.11b 199
Proximity Attack 199
Securing Your Network 201
WAP Attack! 201
Encryption 201
Commonsense Measures 203
PnP Networked Devices 203
Windows Users 204
Macintosh Computers 205
Linux Boxes 205
Hacking the Network Printer 206
Printer Servers 207
Defending Against Attacks 208
Conclusion: Limiting Your Vulnerabilities 211
Chapter 14 Access Conotl r Schemes
Authentication 216
Windows XP Access and Authentication Schemes 217
Access Control Procedures 217
Physical Security 218
Controlling Access to Access Points 219
Physical Access Point Security 220
Secure Access Point Management Issues 221
Preventive Measures 225
MAC the Knife 225
VPN 225
IP Addressing Issues 227
Conclusion: Ensuring “Secure” Access Control 229
Chapter 15 Wireless Laptop Users (PC and Mac)
Laptop Physical Security 232
Protection 232
Hardware Solutions 233
Public Key Infrastructure 237
Portable Biometrics 237
Reducing WEP Vulnerabilities 239
Securing the WLAN 241
Platform Bias 241
Wireless Laptop Network Support 242
Enhancing Mobile Security 243
Remote Users 243
Conclusion: Evolving Laptop Security 244
Chapter 16 Administrative Security
Authentication Solutions 248
Passwords 249
Building the Firewall 249
Intrusion Detection Systems 250
Host-based IDS 252
Network-based IDS 253
Host IDS versus Network IDS 253
Why Have an IDS? 253
The Computer as the Decision Maker 254
Real Live People 255
Security Vulnerability Assessment 256
Risk Assessment 257
Conclusion: Best Defense Is a Good Offense! 260
Chapter 17 Security Issues for Wireless Applications (Wireless PDAs)
Protecting Information 264
PDA Data 264
Seeking Security 265
Security Functionality 266
Access Control 266
HotSync 266
Infrared 266
Building an Effective Mobile Security Policy 268
Protecting Mobile Resources 268
Wireless Connectivity 268
HotSync Security 270
Infrared Authentication 270
Establishing a Security Policy 271
Privacy Concerns 272
Why PDAs Require Privacy 272
Maintaining Access Control 273
Data Encryption 273
SecurID 273
Intranet Access with Your PDA 274
How Hackers Fit into the Equation 275
Security Concerns 275
PDAs as Diagnostic Tools 275
PocketDOS 276
Wireless Service Providers 277
GoAmerica Communications 277
SprintPCS 277
AT&T Wireless IP Network 278
Conclusion: Mobile Wireless Computing 279
Chapter 18 The Future of Wi-Fi Security?
Privacy Regulations 282
Patriot Act, 2001 (USPA) 282
Graham-Leach-Billey (GLB) Act, 2001 282
Fair Credit Reporting Act, 1970, 1996 (FCRA) 282
Children’s Online Privacy Protection Act
of 1998 (COPPA) 283
Health Insurance Portability and Accountability
Act (HIPPA) [August 21, 1996] 283
Pervasive Computing 283
Wireless Mobile Computing 284
Evolving Security 284
Basic Encryption 285
WEP 285
Protecting Access 285
Denial of Service Attacks 286
Evolving Standards 286
Competing Standards 287
Enhancing Your Wireless Security 289
Biometrics 290
Assessing WLAN Strengths and Weaknesses 290
Combining Future WLAN Technology 291
Smart Systems 292
Scrambled Data 292
OS Platform Evolution 292
Windows XP Security 293
Macintosh OS X 294
Palm and PocketPC 294
Linux 294
Lindows OS 295
Preventing Network Intrusion Attempts 295
Network Servers 296
File Servers 296
Printer Servers 297
Conclusion: The Future of Wireless Networking 297
Index 299
● Screenshot ●
Purchase Now !
Just with Paypal
Just with Paypal
Product details
Price
|
|
|---|---|
File Size
| 4,969 KB |
Pages
|
332 p |
File Type
|
PDF format |
ISBN
| 0-07-141073-2 |
Copyright
| 2003 by The McGraw-Hill Companies, Inc |
●▬▬❂❂▬▬●
●▬❂▬●
●❂●
═════● ●═════
