SECURITY IN A MOBILE WORLD! ---- PART I

THE PRACTICAL APPLICATION OF SECURITY: LOCKING DOWN YOUR NETWORK

Ok, hopefully I have managed to convince you that it IS in your best interest to “Lockdown” your Router or Access Point. Along these same lines, there are many steps you can take to reduce or minimize your Security exposure. Here are a few of the more simple (yet exceedingly important) issues to consider:

1.) Change the default password: The default passwords used by the larger Router/AP manufacturers are well known among the hacking communities. Changing this setting should be your first priority once you plug in and log into the new Router/AP to begin configuring it. Always pick a password that will be extremely complicated and is not composed of words you would find in a dictionary (since you don’t want a dictionary attack on the password to succeed).

2.) Enable your Router/AP Firewall: Most every Router/AP has some kind of Firewall built into it, and most are enabled by default. If your Firewall is disabled by default, enable it as soon as is possible! If your Firewall is managed (that is to say, the manufacturer provides updates to the Firewall that include patches for the newest vulnerabilities, and updated definitions which teaches the Router how to recognize the newest hacking exploits.

Just installed your Firewall? Do you think your Internet connection is secure? A quick check (less than 3 minutes) at Gibson Research Corporation's ShieldsUP! website will tell you what (if any) ports your Router still has open.

3.) Change your “default” SSID name: Your (Service Set Identifier) name (or network name) should be changed from the default name to something that does not describe you, your company (for those in business environments), or your surroundings. Additionally, you should avoid basing this name on any personal information like your family name, address, apartment name/number, etc.

Continuing to use the SSID name that your Router came with (referred to as the “Default SSID”) makes a hacker’s job easier because each vendor uses a different default SSID name. This means that a hacker could tell what brand of Router/AP you own based on the default name, and would also know which vulnerability to take advantage of to hack your Router/AP.

For Example:
- 3COM=101,
- Agere=WaveLAN,
- Cisco=tsunami,
- D-Link=default,
- Linksys=Linksys,
- HP=HPInvent

You should follow these Naming Convention guidelines for creating your SSID name:
- Omit underscore [disliked by Windows] from SSID name.
- It has been rumored (but not confirmed) that the dash character may need to be omitted due to some incompatibility issues with Unix systems. If you do not interface with *nix systems, my experience is that this is a non-issue.
- Use only Alpha-Numeric Characters to compose the SSID name.
- Limit length of name to 32 Characters, with a minimum of 4 characters.

4.) Enable Encryption: Use the highest encryption mode your Router/AP is capable of providing which is compatible with your devices. This ensures that the transmission of Wireless Data is as secure as possible

- Good: WEP or Wireless Equivalent Privacy is widely known to be a weak encryption protocol, and is therefore easily deciphered by some of the more knowledgeable hackers. However, it will still provide an effective “first line of defense” by encrypting the traffic between your wireless device and your Router/AP, and will successfully deter general freeloaders and amateur hackers .

- Better: A better level of protection is to use WPA-PSK (Wi-Fi Protected Access – Pre Shared Key) Authentication with TKIP (Temporal Key Integrity Protocol) encryption. This encryption scheme rotates the encryption key every few packets to further obscure the original Key, making a hacker’s job far harder. This encryption has no published or real-world vulnerabilities, but there are several “theories” as to how it can be attacked.

- Best: The best level of protection to use is AES (Advanced Encryption System), but this type of encryption generally requires newer Routers with faster hardware to properly handle the massive complexity of the AES encryption and decryption algorithm. This encryption scheme is rated very high and is currently unbreakable, although plenty of brain-trusts have published articles which theorize on the particular weaknesses of this technology. As of the time of the writing of this article, no known exploits exist which can actually crack or break this encryption technology.