[ Pobierz całość w formacie PDF ]
.To recap, lets walk through each of the pieces and list what security rolethey play.The client machines must protect themselves from other machines on thenetwork.They must also properly communicate with the access point andthe gateway to ensure security.If WEP is being used, the client needs tohave the correct keys.If IPsec or 802.1x is being used, the client mustsupport the protocol and be configured properly.Further up the chain is the access point.Many access points have securityissues in their firmware, allowing attacks against their SNMP servers oradministration consoles.The services provided by these access points shouldbe minimized, and desired security features such as WEP enabled.If theaccess point is a HostAP system, the computer must also be locked downfollowing standard procedures for securing a server.The gateway provides separation between the wireless network, any localwired networks, and the Internet.It treats the wireless network and theInternet as untrusted sources of traffic, shielding the wired network fromthem.It also provides services to computers on the wireless network such asNAT, DHCP, and DNS.IPsec tunnels from wireless clients are terminated atthe gateway, and it may act as a captive portal or 802.1x authenticationserver.Each of these pieces is vital to the security of the network.Remember that ifany one of them fails it can lead to compromises of the network.By havingthe multiple layers of host security, authentication, and encryption, however,many layers of protection are provided.Each of these layers must breachedfor an attacker to gain further access, and the layers serve to limitcompromises.Defense in depth is a solid security practice, and we hope thatthis book will help you to implement your system with a layered set ofdefenses.15.2 User KnowledgeIn the end, the network needs to be convenient for users as well as secure.The users are the reason the network is there, and if they can't use thenetwork, it isn't serving its purpose.Security is often seen as a direct trade-off with convenience, but it does nothave to be an either/or situation.If a security mechanism is difficult to use,users will seek to bypass it whenever possible.When security is bypassed, itisn't working.So, when implementing security mechanisms, strive to makethem both usable and secure.Security mechanisms don't have to impedeusability.As an example, MAC address filtering is mostly transparent to the end user.It does not impose a burden on them, so most users are not going to try tosubvert the filtering.The only time it affects them is when they need to get anew network card added to the filter lists.The burden of work (andinconvenience) for MAC filtering lies with the system administrator.Beingthe person who implemented the security mechanism, the systemadministrator will hopefully be diligent in maintaining the list of allowedMAC addresses and not try to defeat his own security mechanism.A bad example, where security makes it inconvenient for users, is the defaultmethod of WEP-key management.The user is responsible for entering theright WEP keys into the system and keeping them up to date.A change tothe keys, which should happen on a regular basis, requires every user tochange settings or have someone do it for them.The shared static keys ofWEP also encourage users to talk about them openly, in an effort to helpother users.Automatic key distribution mechanisms and authenticationsystems that distribute keys help shield the user from the morass of keymanagement and prevent problems.Authentication systems such as captive portals and 802.1x, which are bothdiscussed in Chapter 14, provide authentication methods to help manageidentification of users in a wireless network and authorize use of services.When properly integrated, these tools can provide security that isunobtrusive to users, yet quite robust.The security pitfalls of wireless networking underscore a problem that hasnot been well addressed so far: the security of client machines is just asimportant as the security of servers, firewalls, and networks.Even with all ofthe widespread worms and attacks against broadband users' homecomputers, most users do not have a good handle on maintaining the securityof their systems.It is important to convey the importance of client securityto your users and teach them the basics of host security, so that they can dotheir part to keep the network secure.At the same time, you should strive toease as much of this burden on the user as possible.Wireless networks exaggerate this problem, as they in most cases expose thetraffic between the clients and the gateway.This can lead to direct access toclient machines without having to pass through the gateway's firewall.VPNsoftware, IPsec tunnels, and WEP are good tools for limiting this exposure,but users need to be aware of the risks.Travelers that use their laptops inhotels, airports, and at conferences need to take special care with theirsystems, as all of these environments often contain hostile traffic and peopleactively looking for systems to attack.Explaining the security mechanisms in use to your users, making sure theyunderstand them, and instilling a sense of responsibility has multiplebenefits.Users will be better able to contribute to the overall security of thesystem with a good understanding of the things they need to be wary of andthe things they need to do.15.3 Looking AheadMany of the current problems with 802.11 protocols stem from designissues.WEP suffers from cryptographic design problems.Access pointswere designed to act as layer 2 bridges to facilitate roaming, which openedthe network up to extensive ARP attacks.The focus on ease of use and quicksetup has led to manuals that don't mention key security issues or safeconfigurations [ Pobierz całość w formacie PDF ]