Beneath the surface: Wireless LAN security

Earlier this month, I passed along some wireless LAN security tips from the Wireless Ethernet Compatibility Alliance. These came in the wake of recent reports of security holes in the Wired Equivalent Privacy algorithm, the baseline security scheme built into 802.11b wireless LANs. WEP is a bare-bones scheme used to prevent unauthorized access to

a wireless network and to protect wireless communication from eavesdroppers who can sniff airborne data packets.

Much of the recent brouhaha surrounding wireless LAN security in the press stemmed from research conducted at the University of California at Berkeley, which published a document identifying a number of security flaws in WEP. Before you panic, remember that even many of the wireless LAN vendors will advise you that basic WEP alone is not sufficient as a complete security strategy.

The 802.11b standard, as I understand it, is pretty vague on how to implement many of its specifications. This is typical in the communications standards world in general, which is why you're always hearing about interoperability testing and certification.

Anyway, WEP implementations do vary from vendor to vendor. Some wireless LANs, for example, are based on first-generation static WEP implementations that use a symmetric cipher (the same key in both directions) and only one or a few keys. Security and scalability are at issue here: If one laptop is lost, so is the key, and security of the entire wireless LAN is compromised. Thus, network interface cards of the entire wireless LAN user base must be reconfigured or your wireless LAN is at risk.

Newer 802.11b WEP implementations, and enhanced security features on top of WEP, exist to make security more robust. This is where you must do your homework among vendors. Dynamic WEP - rather than static WEP - is emerging in some implementations, for example, so that a user's WEP key is valid only during the duration of a session (thus foiling a laptop thief). Some implementations decouple the authentication and encryption functions for added privacy assurance.

These are among the security enhancements that are being proposed by Cisco, Microsoft, Intel and others to the 802.11 standards committee for stronger security capabilities in the standard. These are being considered under the auspices of the 802.1x security initiative.

Joanie Wexler is an independent networking technology writer/editor in Campbell, Calif., who has spent most of her career analyzing trends and news in the computer networking industry. She welcomes your comments on the articles published in this newsletter, as well as your ideas for future article topics. Reach her at joanie@jwexler.com.

Network World Wireless archive
Past newsletters.

UC-Berkeley detailed WEP study

Cisco response to CU-Berkeley 802.11 security flaws

Enterasys ups high-speed wireless ante
Network World, 04/30/01