* Wireless clients are misbehaving
A database of wireless LAN threats compiled by Network Chemistry tracks the activity of a mix of different vendors’ wireless access points and end devices to assess risk. Heterogeneity in enterprise WLANs today is not an uncommon phenomenon.
The company’s Wireless Threat Index has been gathering data from about 700,000 client devices of varying types running the company’s RFprotect monitoring software in enterprise environments. The company’s security data correlation engine, which runs in server software, allows customers to opt in to share wireless data with the company.
Among the most recent findings, according to Brian de Haaff, Network Chemistry vice president of product management and marketing:
* Contrary to popular belief, wireless connections are frequently made to unknown networks: 36% of all wireless client connections were made to unknown APs.
* A similar number of endpoints (37%) reportedly operated with network bridging enabled (a potential intrusion threat).
* A whopping 63% of endpoints analyzed had ad-hoc mode turned on, posing the threat of data theft directly from the client device or a possible entryway into the corporate LAN.
* Despite the heavy use of VPN client software to protect devices and networks, 68% of endpoints reportedly experienced violations of VPN policy.
Network Chemistry has now announced an appliance, called RFprotect Scanner, which includes a database of devices that threaten enterprise networks and data (coincidence? I think not!). It can be configured to automatically shield the network from connections to rogue devices. Such a tool can come in particularly handy in enterprise environments with “no wireless” policies, such as many financial institutions.
