Deployment of 802.11 wireless networks in business environments bring many benefits as well as security threats. Wireless network is a gateway to the enterprise network, therefor it is necessary to prevent jeopardizing data and services, and provide access to legitimate users only.
Enterprise network can be compromised even before the establishment of the wireless network. The reason may be purely accidental, when an employee wants to facilitate access to the enterprise network thought illegal access point, or when a notebook is connected to the enterprise network and at the same time establishes a direct ad-hoc network to exchange data. Due to the nature of the medium, wireless 802.11 network is itself dangerous. Because it is a shared medium, radio waves are freely propagated and any device that is on the same frequency channel may be eavesdropping on communications. Eavesdropping the network can be made from a considerable distance, completely unnoticed, the data obtained in this way and the data obtained through social engineering are the basis for the invasion of the corporate network, attack for denial of service or to intercept the desired information. Security in wireless business networks therefore requires a more complex design and implementation of security solutions that are different from those that are established in the domestic wireless networks.
Comprehensive concept of security of wireless enterprise network includes five basic components: confidentiality, AAA (Authentication, Authorization, and Accounting), segmentation of the traffic, control to protect from attacks and security policy. Authentication of the identity of the user is ensured by a strong 802.1X/EAP authentication method, which creates an encrypted TLS tunnel between the user and the authentication server for sharing identity credentials. A by-product of the process of authentication is the generation and distribution of dynamic encryption key, which encrypts data traffic and ensures the confidentiality of data. Once a user is successfully authenticated and his network resources allocated, we can, with VLANs separate user traffic on the network and in this way limit user access to certain resources or networks. Segmentation can still be interlaced with access control based on user role. With these mechanisms, we achieved data privacy and network resources protection, but it still requires constant supervision to protect from potential attacks, enabled by the device to detect and prevent intrusions. The cornerstone of wireless network security represents the security policy to assess the potential risks and threats, defines the components of protection, measures to be implemented and the performers. Only consistent implementation, control over the implementation and awareness of all involved, provides secure wireless business network.
|
