A lot of companies believe that airborne packets are less secure than those traveling through a physical cable. Some considering wireless LAN deployment worry that a competitor could drive into an organization's parking lot and "sniff" its packets as they travel through the air, for example. Fortunately, wireless users are not so unprotected. Encryption options are available in the IEEE 802.11b wireless LAN standard as well as specific vendor implementations.
The security features built into the IEEE 802.11b standards are known as Wired Equivalent Privacy (WEP). These algorithms enable RC4-based, 40-bit data encryption to prevent an intruder from accessing the network and capturing wireless LAN traffic. In addition to encryption, WEP allows an administrator to define a shared key for authentication. Access is denied to anyone who does not have an assigned key. However, be aware that users who are allowed to connect to the network use the same key. So this authentication method is only able to verify that a particular user belongs to a group with access rights to the network; there is no way to distinguish one mobile user from another. In addition, be sure to ask bidding wireless LAN vendors if their 802.11b equipment is WEP-enabled. WEP is an optional component to the standard - because a product is 802.11b-compliant does not mean it automatically ships with WEP features.If you do not consider 40-bit encryption to be robust enough, several vendors ship 128-bit Layer 2 encryption with their wireless LAN products. Note, though, that these are proprietary implementations and will not interoperate among vendors, if you plan to mix and match suppliers at any point.The Layer 2 security in WEP works well for smaller networks, as it is configured to work between end nodes and wireless access points. As a LAN network grows, however, a scalability issue can arise. Network administrators must program each access point with information about each wireless LAN user; as a user roams throughout a campus, each access point must be able to authenticate that user so connections to the network can be maintained. Some vendors, such as 3Com, have extended their enterprise remote access authentication schemes and access lists at Layer 3 to embrace the wireless LAN population. I'll talk more on this centralized security alternative in an upcoming newsletter.RELATED LINKS
Joanie Wexler is an independent networking technology writer/editor in Campbell, Calif., who has spent most of her career analyzing trends and news in the computer networking industry. She welcomes your comments on the articles published in this newsletter, as well as your ideas for future article topics. Reach her at joanie@jwexler.com.
Network World Wireless archive
Past newsletters.
Network World, 03/06/00.Tivoli tackles mobile network device security
Network World, 06/19/00.Archive of Network World on Wireless newsletters
