Unlike wired systems, which can be physically secured, wireless networks are not confined to the inside of buildings. They can be picked up as far as 1,500 feet outside of the premises with a laptop and a hi-gain directional antenna. This makes wireless LANs inherently vulnerable to interception. To protect your valuable data, you need to design a secured wireless network, unless you will suffer serious security exposures from deploying WLANs without implementing the proper security.

Knowing this, the 802.11 committee added a first line of defense called Wireless Equivalency Protocol (WEP) for legacy wireless standards 802.11b and wireless 802.11g. WEP is an encryption protocol that provides the same level of security that wired cables provide. The standard provides both 40-bit and 128-bit (really only 104-bit) encryption at the link layer using the RC4 algorithm. This is the first defense for secured wireless network.

The newest wireless security standard Wireless Protected Access (WPA/WPA2) was created by the Wi-Fi Alliance for secured wireless network in response to several serious weaknesses researchers had found in the previous system, Wired Equivalent Privacy (WEP). WPA/WPA2 will only work to the newer wireless standards draft 802.11n and some enhanced 802.11g devices. But this WPA/WPA2 will not be compatible with legacy 802.11b/g devices.

WPA2 replaced WPA; like WPA, WPA2 requires testing and certification by the Wi-Fi Alliance. WPA2 implements the mandatory elements of 802.11i. In particular, it introduces a new AES-based algorithm, CCMP, which is considered fully secure. Certification began in September, 2004; from March 13, 2006, WPA2 certification is mandatory for all new devices to bear the Wi-Fi trademark. So, for secured wireless network – make sure to use WPA2 if all the clients and the wireless APs support this WPA2 encryption.

Basic 802.11 Security and Its Known Problems

When IEEE 802.11b was first defined, its security depended on two basic security mechanisms: the SSID and WEP. Some manufacturers have added MAC address filtering to their products for more secured wireless network.

Service Set ID (SSID)

Wireless devices have a default wireless network name or Service Set Identifier (SSID) set by the factory. This is the name of your wireless network, and can be up to 32 characters in length. Each wireless product has their own default SSID as the default wireless network name.

The SID is a string used to define a common roaming domain among multiple access points (APs). Different SSIDs on APs can enable overlapping wireless networks. The SSID was once thought to be a basic password for secured wireless network without which the client could not connect to the network. However, this claim can be easily overridden since APs broadcast the SSIDs multiple times per second and any 802.11 analysis tool can be used to read it. Because users often configure clients, this so-called password is often widely known.

For a better secured wireless network, you should change your SSID regularly. Although the SSID does not add any layer of security, it should be changed from the default value so that other people do not accidentally use your network.

MAC Address Filtering

Besides the two basic secured wireless network mechanisms that 802.11 provides, many companies implement MAC address filtering in their products. This mechanism is not flawless either.

The MAC address filter contains the MAC addresses of the wireless network interface cards (NICs), which may associate with any given AP. Some vendors provide tools to automate the entry and update processes; otherwise, this is an entirely manual process. A MAC filter is also not very strong secured wireless network since it is easy to discover known good MAC addresses with a sniffer. Then, using Linux drivers available on the Internet for most 802.11 client access cards, you can configure the sniffed MAC address into the card and gain access to the network. Although not perfectly secure, MAC address filtering is one more layer on the onion—it makes it more difficult for someone to gain access.

The other two steps mentioned by the Wi-Fi Alliance, use of session keys and a VPN system, are good, workable solutions for secured wireless network. In order to understand how much security is needed for a particular application, it is important to understand the threats and potential attacks.

Check also:

• Wireless security checklists for related secured wireless network
• Wireless USB network adapter – a list of known USB wireless adapters
• Building home wireless network – a simple wireless computer network
• DSL Wireless modem – a list of known modem-router with AP integrated
• TRENDnet Wireless USB Printer – a multifunction 2 Port USB Print Server