Enterprise Wireless Security

M

MISMCSA

2[H]4U
2FA
Joined
Sep 6, 2001
Messages
2,193
I'm wondering if anyone here could give me a brief overview of enterprise wireless security.

Specifically, what types of measures do large corporations take to protect their wireless networks.

Thanks for any input!
 
Individually Firewalled AP's

MAC Access Control List

MAC-Controlled DHCP or Static Assignment with an ACL

Turn of broadcasting of the AP's SSID, etc.

Smartcard/Certificate Controlled Authentication for Active-WEP/key.
 
I think generally, larger corporations establish a VPN connection across the wireless. That way even if the WEP or WPA key is broken, they still only get a bunch of VPN packets..

Riley
 
Skud said:
I think generally, larger corporations establish a VPN connection across the wireless. That way even if the WEP or WPA key is broken, they still only get a bunch of VPN packets..

Riley
Click to expand...

What I would do at the minimum, money not being an object of course, is implement 802.1x for authentication as soon as someone connects to the wireless network. Once they're authenticated with 802.1x then I'd require them to have a VPN client before they're allowed into the rest of the network. At that point I'd have downloadable ACL's and domain policies restricting what that user could do on the network.

An addition onto 802.1x is to use some sort of policy enforcement tool (such as Cisco's NAC) to make sure that AV signatures/personal firewall policies are up to date before someone is allowed onto the network. A legit user could still have worms on their machine.

I would also try my best to make sure that the radio signals do not escape the building.
 
Boscoh said:
What I would do at the minimum, money not being an object of course, is implement 802.1x for authentication as soon as someone connects to the wireless network. Once they're authenticated with 802.1x then I'd require them to have a VPN client before they're allowed into the rest of the network. At that point I'd have downloadable ACL's and domain policies restricting what that user could do on the network.

An addition onto 802.1x is to use some sort of policy enforcement tool (such as Cisco's NAC) to make sure that AV signatures/personal firewall policies are up to date before someone is allowed onto the network. A legit user could still have worms on their machine.

I would also try my best to make sure that the radio signals do not escape the building.
Click to expand...


with all that being said. I'll state the ovious. Don't use it when ever possible. you need to look at it long and hard. do we REALLY NEED wireless technology or are we doing it for the cool factor. the safest wireless security is to not have wireless at all!
 
We're going to use SonicWALL SonicPoints with VPN Clients. That's the most secure solution I've seen so far.
 
I use MAC authentication as Well as Radius Authentication through ISA server. WEP keys are in place as well. I never thought of adding VPN on top. I use mostly SNAPGear myself it has PPTP and IPSEC which are very secure.. Users are the problem most of the time.
 
NetJunkie said:
We use Cisco's LEAP.
Click to expand...


LEAP has some holes in it - be very careful about using that alone. I'm going to refrain from posting links to articles to avoid issues with the [H]rules, but it's a little scary. :(
 
[H]Rabbit said:
LEAP has some holes in it - be very careful about using that alone. I'm going to refrain from posting links to articles to avoid issues with the [H]rules, but it's a little scary. :(
Click to expand...

I'm aware of the holes. They aren't that bad.
 
NetJunkie said:
I'm aware of the holes. They aren't that bad.
Click to expand...

Agreed that they aren't that bad - just so long as they are known. :)

Has anyone here done anything with server 2k3 and WPA access?
 
You must log in or register to reply here.
Back
Top