|
Mobile Security Architecture and Integration |
Sph3r3 understands the values and risks associated with wireless implementation. Our goal is to help yourself and your organization achieve a secure solution. Wireless insecurity is not a new phenomena. Past years have brought problems surrounding wireless garage door openers, car alarms, cellular phones, and even television remote controls using short range RF, CDMA and infrared. In fact, in November of 2004 a company released a key chain infrared remote control with an “Off” button that can successfully turn off nearly all televisions manufactured. Pointedly, the security threat is not just the 802.11 protocols; however, these protocols generally provide access to corporate information. Sph3r3 recommends every organization use a multistep process to evaluate their wireless security posture: - What wireless security technologies, standards and protocols should be chosen?
- Do the benefits outweigh the costs (associated with a risk matrix)?
- What is needed to safeguard confidentiality, integrity and availability of wireless based information?
- What detection mechanisms are appropriate to identify unauthorized wireless activity?
Download Sph3r3's Free Mobility and Wireless Security Presentation The mobile continues to proliferate at unprecedented rates. Of course highly mobile information and control imparts a great amount of security risks on those mobile assets. As the asset owner or custodian it is up to you to either secure the asset, accept the risk, insure the asset or relinquish yourself of the asset entirely so that there is no direct asset risk. This presentation discusses the current mobile and wireless threats and then details some high level principles to protecting information and control. The topics included are: - Discuss the types of wireless transmissions receiving devices and industry applications
- Review the types of known attacks against wireless transmissions and stations
- Define simple principles with industry examples to architect and secure your wireless transmission and the transmitting and receiving stations
Download the presentation here. |  |
Deploying a secure wireless infrastructure for your organization The demand and available technologies for computing mobility continues to expand at an unprecedented rate. This highly fluctuating environment has created, and continues to create, an undirected, volatile workforce that is not effectively using the technology that is at our disposal. Information Technology must guide mobile knowledge workers in the correct direction based upon their functional business requirements. These business requirements are much more stable in nature and can be referenced throughout the IT life cycle to provide adequate growth and evolution. Once the business requirements are identified security technologies can be appropriately mapped to ensure the continued confidentiality, integrity, and availability of information residing on and transmitted to and from mobile systems. Example Wireless Network Vulnerabilities: - Denial of Service—RF Interference
- Information Disclosure
- Unauthorized Network Access
- Rogue Access Points—Attempt to trick hosts to authenticate with a rogue access point
- Signal Leakage—Wireless signal can leak for several miles dependent upon application
- Unauthorized Access Points—Employee deployed or laptop factory integrated
Example Wireless Audits: - Validate approved access point configurations
- Review wireless workstations security installation requirements (firewalls, anti-virus, hips, data encryption)
- Review network architecture and wireless integration points
- Understand business requirements for wireless deployments
- Review implemented wireless security policies, procedures, standards and guidelines
- Be aware of regulatory compliance requirements (HIPAA, SOX, CIP, PCI)
Example Wireless Architecture Recommendations: - Understand wireless data requirements (QoS, Privacy)
- Access Point Placement—Limit Signal Exposure
- Define Trusted Systems and Perimeter
- Wireless Transmission Data Encryption
- Limit Known Exposures
- Protect the Wireless Hosts
- Enable Rogue Wireless Network Detection
- Place in Untrusted Zone with VPN
- End User Security Awareness Training
|  Figure 1. Implementing Wireless for the Mobile Knowledge Worker Figure 2. Recommended Wireless Security Infrastructure | |
