WLAN

Securing Wireless LANs: A Practical Guide for Network Managers, LAN Administrators and the Home Office User. Gilbert Held

Copyright  2003 John Wiley & Sons, Ltd. ISBN: 0-470-85127-9

a p p e n d i x a

Wireless LAN Security Checklist As previously noted in this book, there are a range of hardware and software products we can collectively refer to as tools and also many techniques you can consider to harden your organization’s wireless LAN. In this appendix those tools and techniques are listed within broad categories in the form of a checklist. You can consider each of the entries in the checklist based upon the current infrastructure of your network, the type of data transmitted over your wireless network, economics, and the potential threat to your organization. Doing so will result in some items being of more value than others to different readers or more accurately, reader organizations.

In the table that follows we grouped the tools and techniques discussed in this book into the collective area of ‘category/features.’ While the categories are listed alphabetically, their listing does not indicate their relative importance. Thus, both potentially trivial as well as key techniques and tools are simply listed within defned categories, placed in alphabetical order as a mechanism to structure the contents of the table. When using this checklist you can either indicate your specifc requirement for a particular security feature or place a notation concerning its use. In fact, you can also use this checklist to compare vendor products by adding two or more columns to compare and contrast vendor features against your requirements.

Category/Feature Requirement

Access Control Authentication of Hardware

245

246 wireless LAN security checklist

Category/Feature Requirement

Open System Shared Key MAC Address Port based access (802.1x)

Access Point Change access point location Change default SSID setting Disable SSID broadcasting Change default management password Enable WEP or another encryption method Disable DHCP and assign static IP addresses to clients Change default IP address of access point and, if possible, use a different subnet

Antenna operation Orient antenna Lower transmit power Shield antenna

Authentication Enable user authentication

CHAP Extensible Authentication Protocol (EAP) MS CHAP Kerberos MAC address Digital certifcates

Encryption Enable WEP Use automatic key exchange Use Temporal Key Integrity Protocol Use software to avoid weak keys Use separate uplink/downlink keys

Firewall Install frewall between access point and wired network Confgure frewall to restrict data traffc from wireless clients based on organizational policy

Network scan Measure signal strength

wireless LAN security checklist 247

Category/Feature Requirement

On other foors in building Outside building

Use tool like NetStumbler to locate rogue access points Use tool like AiroSnort to attempt to recover encryption key in use

Physical Security Establish mechanism for reporting loss of hardware

Server-based authentication Use Cisco’s proprietary LEAP Use Extensible Authentication Protocol (EAP)

SNMP Verify ASN1 problem fxed Obtain latest software patch, if available Enable/disable capability Restrict access via IP address Restrict use via alphanumeric community string

VPN Use tunnel to server on wired LAN

Use PPTP Use L2TP with IPSec