Wireless Network Physical Security

As always all security initiatives start with the physical and wireless networking is no different. However; before we get into the nitty-gritty of improving our wireless networking physical security there are a couple of important points that we must remind ourselves of.

First of all comes the inherent lack of “out of the box” security exhibited by most wireless devices after which we will take a look at how the CIA (Confidentiality, Integrity and Accessibility) of network and computer security specifically relates to wireless networking physical security.

Wireless Device Default Setup and Configuration Parameters are Inherently Insecure

It is a fact of life that “out of the box” wireless networking devices are notoriously lacking on the security front. The result of this is that both wireless networking in general and wireless networking security technologies are perpetually confronted by well armed villains with access to an ever increasing library of counter-counter measures it is imperative that we stay on top of the game.

With manufacturers making details of the default setup and configuration parameters of their products publically accessible on their websites not only can “legitimate” users obtain this information, so too can those with malicious intent. Fortunately this state of affairs does not mean that there is no hope.

The reason for implementing a factory preset device default configuration is that doing so improves the devices Plug ‘n’ Play characteristics thereby elevating the “user friendly” aspect. Thus we find that by default manufacturers will ship their wireless networking capable devices with a basic set of default configuration parameters set in order to make the production environment implementation and setup configuration of the wireless capable device considerably easier and far more simplified than would otherwise be the case.

Because of this manufacturers tend to religiously point out that the first thing a user should do upon successfully deploying their wireless device and confirming network connectivity and network resources accessibility is to modify the default parameters.

Wireless Networking Physical Security Strategies

Over the years the best means of doing this from the security standpoint has proven to be the adoption of systems that implement security initiatives as a suite rather than a collective of loosely connected and related complimentary threat specific strategies. The beauty of this strategy is that the deployment of a suite of security initiatives where more than one tool address different vulnerabilities at different points of susceptibility goes a long way to eliminating any single points of failure scenarios.

Wireless Access Points (WAPs) Location and Fixing

This means to make sure that the placement of your Wireless Access Points (WAP) allows the desired coverage whilst maintaining minimal likelihood of displacement, tampering or unauthorized removal. All wireless enabled networks risk collapse if enough Wireless Access Points go out of commission. This is most important in areas where public access is possible. Another point to consider here is that the wind can cause a WAP to become out of true alignment.

Tie Downs and Camouflage - Make sure that all of your Wireless Access Points (WAPs) are physically secured. Tie downs and camouflage are great ways to do this. Both camouflaged and secreted devices (located in suspended ceilings, planter boxes, wiring closets, inside hollow core walls etc) have the added security benefit of being hidden from general view.

The old adage “out of sight out of mind” immediately springs to mind. What cannot be seen is often out of mind and therefore less likely to go walk-about. WAPs can be secreted in suspended ceilings, wiring closets or fixtures such as ornaments and planter pots. This makes for an all round far more aesthetically pleasing approach.

Restrict unauthorized access to all Wireless Access Points - Depending on the location and placement of your WAPs it may be practical to implement pass-through point security initiatives. These need not necessarily required dedicated personal since placing WAPs in suspended ceilings will requiring ladder access means staff can readily spot attempts at interference.

Network Monitoring and Site Surveys - In monitoring the attributes of a wireless network, tools such as Airsnort, WireShark (formerly Ethereal), NetStumbler and Kismet are your friends. They can be employed when conducting your initial site surveys and subsequent site monitoring for aberrations, signal leakage and as physical interference indicators.

Test to ensure that your wireless access covers those areas you wish to cover whilst maintaining zero leakage or as close to zero as you possibly can. Remember that it is always advisable to place your wireless access points such that they face inward. This can dramatically reduce your exposure and subsequent security vulnerability to external mobile devices.

The use of directional antenna is a possibility that merits consideration at the planning stage of deployment. The fewer “freeloaders” your network is exposed to the better your overall security will be. Some organizations even go to the extent of using signal jamming technologies to ensure that any leakage is rendered useless and piggy-backing cannot take place.

War Driving - The practice of “war driving” using wireless scanning software with portable devices such as laptops and notebooks will not pose as great a risk if drive-bys don’t have a detectable signal coming their way.

Line of Sight - Line of sight requirements need to be assessed carefully from the perspectives of both the current scenario and extrapolated into making predictions of the most likely conditions that will be prevalent at various predefined times in the future. Trees for example have a habit of growing.

So where a clear line of sight exists today the possibility that this will not be so in the future must be evaluated. In the case of trees one solution might entail lopping every other year in order to preserve said clear line of sight. No matter the terms or conditions, the establishment and implementation of a documented policy, schedule or regime that addresses these types of issues will need to be set forth.

Quality of Service (QoS) - The wireless network’s ideal is to provide adequate connectivity and accessibility throughout the entire area of intended coverage (no drop-out zones) and with a specified level of Quality of Service (QoS) for said area but no more. The Quality of Service (QoS) factor may be defined by either meeting or failing to meet specific performance metrics such as transfer rates or strength of encryption. Signal degradation due to EMI, noise and other interference all need to be entered into the equation.

Signal Leakage Metrics - The geographical network confinement parameters are generally characterized and measured by the degree of signal leakage beyond a specified intended perimeter of coverage. The distance, signal strength, signal quality and degree of availability both within and beyond the designated network perimeter are the parameters that define and delineate that point at which signal leakage and signal degradation becomes unacceptable.

Naming and Labeling – Develop and implement an appropriate secure customized naming convention complete with a fully complementary secure labeling system. This is generally of higher importance for a business wireless networking environment where there may be considerable numbers of WAPs and roaming network member devices than is usually the case for the home wireless network.

Functional Reliability - Do not overlook the need for equipment reliability and robustness along with adequate emergency situation operating functionality. It is imperative that in the event of an emergency or catastrophe that your wireless network remains fully functional unless circumstances dictate otherwise. Remember that communications are usually the most valuable resource in times of doubt and uncertainty. So take this into consideration when designing your wireless network and making decisions upon device selection from a range of possible contenders. It is no good going off the air every time an electrical storm passes you by.

Conclusion

As always, security starts at the physical level. Initiatives that all of us can employ include lock-down and lock-up. Ensure your mobile devices are secure. Whenever left unattended, they seem to have a habit of growing legs. Restricting physical accessibility and signal leakage further reduces your systems security threats exposure and remember to factor device performance, reliability and robustness into your selection criteria.