Archived NIST Technical Series Publication - Govinfo.gov

W IRELESS NETWORK SECURITYExecutive SummaryWireless communications offer organizations and users many benefits such as portability and flexibility,increased productivity, and lower installation costs. Wireless technologies cover a broad range ofdiffering capabilities oriented toward different uses and needs. Wireless local area network (WLAN)devices, for instance, allow users to move their laptops from place to place within their offices without theneed for wires and without losing network connectivity. Less wiring means greater flexibility, increasedefficiency, and reduced wiring costs. Ad hoc networks, such as those enabled by Bluetooth, allow datasynchronization with network systems and application sharing between devices. Bluetooth functionalityalso eliminates cables for printer and other peripheral device connections. Handheld devices such aspersonal digital assistants (PDA) and cell phones allow remote users to synchronize personal databasesand provide access to network services such as wireless e-mail, Web browsing, and Internet access.Moreover, these technologies can offer dramatic cost savings and new capabilities to diverse applicationsranging from retail settings to manufacturing shop floors to first responders.However, risks are inherent in any wireless technology. Some of these risks are similar to those of wirednetworks; some are exacerbated by wireless connectivity; some are new. Perhaps the most significantsource of risks in wireless networks is that the technology’s underlying communications medium, theairwave, is open to intruders, making it the logical equivalent of an Ethernet port in the parking lot.The loss of confidentiality and integrity and the threat of denial of service (DoS) attacks are riskstypically associated with wireless communications. Unauthorized users may gain access to agencysystems and information, corrupt the agency’s data, consume network bandwidth, degrade networkperformance, launch attacks that prevent authorized users from accessing the network, or use agencyresources to launch attacks on other networks.Specific threats and vulnerabilities to wireless networks and handheld devices include the following:!All the vulnerabilities that exist in a conventional wired network apply to wireless technologies.!Malicious entities may gain unauthorized access to an agency’s computer network through wirelessconnections, bypassing any firewall protections.!Sensitive information that is not encrypted (or that is encrypted with poor cryptographic techniques)and that is transmitted between two wireless devices may be intercepted and disclosed.!DoS attacks may be directed at wireless connections or devices.!Malicious entities may steal the identity of legitimate users and masquerade as them on internal orexternal corporate networks.!Sensitive data may be corrupted during improper synchronization.!Malicious entities may be able to violate the privacy of legitimate users and be able to track theirmovements.!Malicious entities may deploy unauthorized equipment (e.g., client devices and access points) tosurreptitiously gain access to sensitive information.!Handheld devices are easily stolen and can reveal sensitive information.!Data may be extracted without detection from improperly configured devices.ES-1

W IRELESS NETWORK SECURITY!Viruses or other malicious code may corrupt data on a wireless device and subsequently beintroduced to a wired network connection.!Malicious entities may, through wireless connections, connect to other agencies or organizations forthe purposes of launching attacks and concealing their activities.!Interlopers, from inside or out, may be able to gain connectivity to network management controls andthereby disable or disrupt operations.!Malicious entities may use third-party, untrusted wireless network services to gain access to anagency’s or other organization’s network resources.!Internal attacks may be possible via ad hoc transmissions.This document provides an overview of wireless networking technologies and wireless handheld devicesmost commonly used in an office environment and with today’s mobile workforce. This document seeksto assist agencies in reducing the risks associated with 802.11 wireless local area networks (LAN),Bluetooth wireless networks, and handheld devices.The National Institute of Standards and Technology (NIST) recommends the following actions:Agencies should be aware that maintaining a secure wireless network is an ongoing process thatrequires greater effort than that required for other networks and systems. Moreover, it isimportant that agencies assess risks more frequently and test and evaluate system security controlswhen wireless technologies are deployed.Maintaining a secure wireless network and associated devices requires significant effort, resources, andvigilance and involves the following steps:!Maintaining a full understanding of the topology of the wireless network.!Labeling and keeping inventories of the fielded wireless and handheld devices.!Creating backups of data frequently.!Performing periodic security testing and assessment of the wireless network.!Performing ongoing, randomly timed security audits to monitor and track wireless and handhelddevices.!Applying patches and security enhancements.!Monitoring the wireless industry for changes to standards that enhance security features and for therelease of new products.!Vigilantly monitoring wireless technology for new threats and vulnerabilities.Agencies should not undertake wireless deployment for essential operations until they haveexamined and can acceptably manage and mitigate the risks to their information, systemoperations, and continuity of essential operations. Agencies should perform a risk assessment anddevelop a security policy before purchasing wireless technologies, because their unique securityrequirements will determine which products should be considered for purchase.ES-2

W IRELESS NETWORK SECURITYAs described in this document, the risks related to the use of wireless technologies are considerable. Manycurrent communications protocols and commercial products provide inadequate protection and thuspresent unacceptable risks to agency operations. Agencies must actively address such risks to protect theirability to support essential operations, before deployment of wireless technologies. Furthermore, manyorganizations poorly administer their wireless technologies. Some examples include deploying equipmentwith “factory default” settings, failing to control or inventory access points, not implementing the securitycapabilities provided, and not developing or employing a security architecture suitable to the wirelessenvironment (e.g., one with firewalls between wired and wireless systems, blocking of unneededservices/ports, use of strong cryptography). To a large extent, most of the risks can be mitigated.However, mitigating these risks requires considerable tradeoffs between technical solutions and costs.Today, the vendor and standards community is aggressively working toward more robust, open, andsecure solutions for the near future. For these reasons, it may be prudent for some agencies to simply waitfor these more mature solutions.Agencies should be aware of the technical and security implications of wireless and handheld devicetechnologies.Although these technologies offer significant benefits, they also provide unique security challenges overtheir wired counterparts. The coupling of relative immaturity of the technology with poor securitystandards, flawed implementations, limited user awareness, and lax security and administrative practicesforms an especially challenging combination. In a wireless environment, data is broadcast through the airand organizations do not have physical controls over the boundaries of transmissions or the ability to usethe controls typically available with wired connections. As a result, data may be captured when it isbroadcast. Because of differences in building construction, wireless frequencies and attenuation, and thecapabilities of high-gain antennas, the distances necessary for positive control for wireless technologies toprevent eavesdropping can vary considerably. The safe distance can vary up to kilometers, even when thenominal or claimed operating range of the wireless device is less than a hundred meters.Agencies should carefully plan the deployment of 802.11, Bluetooth, or any other wirelesstechnology.Because it is much more difficult to address security once deployment and implementation have occurred,security should be considered from the initial planning stage. Agencies are more likely to make bettersecurity decisions about configuring wireless devices and network infrastructure when they develop anduse a detailed, well-designed deployment plan. Developing such a plan will support the inevitable tradeoffdecisions between usability, performance, and risk.Agencies should be aware that security management practices and controls are especially critical tomaintaining and operating a secure wireless network.Appropriate management practices are critical to operating and maintaining a secure wireless network.Security practices entail the identification of an agency’s or organization’s information system assets andthe development, documentation and implementation of policies, standards, procedures, and guidelinesthat ensure confidentiality, integrity, and availability of information system resources.To support the security of wireless technology, the following security practices (with some illustrativeexamples) should be implemented:!Agency-wide information system security policy that addresses the use of 802.11, Bluetooth, andother wireless technologies.ES-3

W IRELESS NETWORK SECURITY!Configuration/change control and management to ensure that equipment (such as access points) hasthe latest software release that includes security feature enhancements and patches for discoveredvulnerabilities.!Standardized configurations to reflect the security policy, to ensure change of default values, and toensure consistency of operation.!Security training to raise awareness about the threats and vulnerabilities inherent in the use ofwireless technologies (including the fact that robust cryptography is essential to protect the “radio”channel, and that simple theft of equipment is a major concern).Agencies should be aware that physical controls are especially important in a wireless environment.Agencies should make sure that adequate physical security is in place. Physical security measures,including barriers, access control systems, and guards, are the first line of defense. Agencies must makesure that the proper physical countermeasures are in place to mitigate some of the biggest risks such astheft of equipment and insertion of rogue access points or wireless network monitoring devices.Agencies must enable, use, and routinely test the inherent security features, such as authenticationand encryption, that exist in wireless technologies. In addition, firewalls and other appropriateprotection mechanisms should be employed.Wireless technologies generally come with some embedded security features, although frequently manyof the features are disabled by default. As with many newer technologies (and some mature ones), thesecurity features available may not be as comprehensive or robust as necessary. Because the securityfeatures provided in some wireless products may be weak, to attain the highest levels of integrity,authentication, and confidentiality, agencies should carefully consider the deployment of robust, proven,and well-developed and implemented cryptography.NIST strongly recommends that the built-in security features of Bluetooth or 802.11 (data link levelencryption and authentication protocols) be used as part of an overall defense-in-depth strategy. Althoughthese protection mechanisms have weaknesses described in this publication, they can provide a degree ofprotection against unauthorized disclosure, unauthorized network access, and other active probing attacks.However, the Federal Information Processing Standard (FIPS) 140-2, Security Requirements forCryptographic Modules, is mandatory and binding for fede

NIST Special Publication 800-48 Wireless Security: 802.11, Bluetooth and Handheld Devices November 2002 July 2008 SP 800-48 is superseded in its entirety by the publication of SP 800-48 Revision 1 (July 2008). NIST Special Publication 800-48 Revision 1 Guide to Securing Legacy IEEE 802.11 Wireless Networks