* How Principal Financial ensures its environment is WLAN-free
While sophisticated wireless management products are very important to enterprises deploying wireless LANs on a large scale, they also play a key role in organizations with policies to keep WLANs out.
Such is the case at Principal Financial Group, a financial services company that must comply with a large number of privacy regulations, domestically and internationally. Its current policy is to allow no internally connected WLANs.
Chris Schear, IT network security associate lead at the Des Moines company, says he uses the laptop and handheld versions of AirMagnet’s Mobile Suite of WLAN management products to make sure no wireless gear sneaks in.
“We use AirMagnet to site-survey our infrastructures anytime we acquire a company or form a partnership, when a vulnerability assessment is performed,” Schear says.
Why does Principal Financial exclude wireless networks?
“We’re an 18,000-user company with 400 sites internationally,” Shear explains. “We haven’t developed a corporate-wide plan for wireless yet. And we don’t want 14 different flavors of networks being introduced by various business units. We want a well-architected solution.”
Principal Financial does allow WLANs that connect only to the Internet, though. These connections are firewalled off from the intranet.
The company uses AirMagnet’s access control feature to verify the legitimacy of these access points and to make sure they’ve been configured with the proper security. Why care about security in access points that don’t touch the internal network?
“We own these APs, and we don’t want to be liable if they are used to attack someone else,” Schear explains. He says the company wants to keep freeloaders from piggybacking on Principal Financials’s Internet connection.
“I would hate to see the next Blaster worm launched from our access point via someone in a parking lot,” he says.
AirMagnet last week enhanced the mobile versions of its WLAN management products to detect 802.11g products (as well as prestandard 802.11g products). It already supported 802.11b and 11a radios.
In the case of Principal Financial, “we only allow 802.11b access points, so just detecting an 802.11g or 11a access point alerts us of a policy violation,” Schear says.
AirMagnet’s Mobile Suite of management software gained many other enhancements. Most identify behaviors and provide alarms with advice as to how to remedy the situation discovered.
For example, says Rich Mironov, AirMagnet vice president of marketing, “Centrino laptops automatically search for access points to talk to. But out of box, no 802.1x or WEP [security] is turned on. The software detects these unsecured connections and advise that these features be enabled.”
