u8.9 802.11b Safeguards

Treat Wireless as an untrusted NW
1. Firewall between wireless LAN and internal network
2. Intrusion detection at wireless LAN/internal network junction
3. Vulnerability assessments of wireless access points and other wireless infrastructure
4. VPN from wireless station into internal network, providing end-to-end encryption across the untrusted wireless network into the trusted network. However, consider whether the VPN can handle the changes when a station roams from one access point to another.
Security Policy & Architecture
1. define a policy for how wireless networks are to be used
  1. specify what is allowed and what is not allowed
    1. What services, devices, protocols or departments can use the Wirelss LAN
Discover unauthorised use
1. search regularly in the following ways for unauthorised access points or wireless LAN cards.
  1. Port Scanning
    1. Searching for unknown SNMP agents, web or Telnet interfaces that might indicate that an access point is present on the network
  2. MAC Address sniffing
    1. Searching for MAC addresses that lie within known MAC ranges for access point and WLAN NIC manufacturers.
  3. Warwalking
    1. Manual Scanning
      1. be aware you will detect signals that are not in your building
Access point audits
1. Standard configuration
2. Passwords should be strong and community strings should be correctly set.
3. Unnecessary administration interfaces should be shut down, and the remaining administration interfaces should use secure protocols to prevent administrator passwords being intercepted.
4. Access control lists on firewalls and routers should be used to ensure only administrators have access to the access point administration interfaces.
5. WEP keys should be strong (not generated from alphanumeric pass phrases) & should be secret. Backups of access point configurations should not store the WEP keys.
6. Stop transmitting SSID
Station Protection
1. Stations should have personal firewalls, IDS, AV
2. Standardises configs for stations.
3. Check stations regularly for config standards
Location of AP's
1. spread of the wireless radio signal outside the building should also be considered, to try to limit the possibility of the wireless signal being intercepted.
2. If access points have omni-directional antennae, they should be located in the centre of a building and not located by windows or on external walls.
3. The line of sight from the location of the access point to the outside should be limited.
4. Transmission strength should be turned down from the default maximum to limit the spread of the signal outside the building,
MAC Address locking
1. Use MAC address ACL's to allow only devices with MAC's in the ACL to connect to an AP
  1. MAC's are spoofable so this is only good for low risk environments

Siguiente

u8.9 802.11b Safeguards

Descripción

Resumen del Recurso

Similar

	Creado por Craig Parker hace casi 11 años