Comments on: The State of WiFi security http://www.gnucitizen.org/blog/the-state-of-wifi-security/ Information Security Think Tank Sat, 02 Feb 2013 17:50:40 +0000 hourly 1 http://wordpress.org/?v=3.4.1 By: frank kern http://www.gnucitizen.org/blog/the-state-of-wifi-security/comment-page-1/#comment-127703 frank kern Tue, 11 Aug 2009 01:26:44 +0000 http://www.gnucitizen.org/blog/the-state-of-wifi-security/#comment-127703 Now I get cleared my doubts in WiFi security,thank you very much. Now I get cleared my doubts in WiFi security,thank you very much.

]]> By: sebastian nielsen http://www.gnucitizen.org/blog/the-state-of-wifi-security/comment-page-1/#comment-117677 sebastian nielsen Sun, 30 Mar 2008 20:52:51 +0000 http://www.gnucitizen.org/blog/the-state-of-wifi-security/#comment-117677 Client side security is inneccesary, and can always be bypassed. For example using a linux cd to boot up the computer and access every file on the computer. Its always good to adhere to the following rule: "If you have physical access to a computer, nothing prevents you to read or access the data stored on it". read or access means in some way downloading or reading data. The data may be unreadable (encrypted) but then you take the data with you and do a offline attack. So the best is to place all security as centrally as possible. A good idea is to never store anything on the laptop. But instead store everything on central servers. These servers can then verify user in some way. But keep in mind that user can still copy data that he gets from the server to a USB memory, or just take photos of screen and then OCR them. So use a VERY strict need-to-know policy, and make sure that if the system is in doubt of if a people is really needing a specific information, make it go through approval by manager before allowing the employer access. So this means a worker who is working on a software part is only need access to that part of software. This means that EVEN if a attacker gets physical posession of his laptop, or gets hold of a employer's authorization card or gets access to a logged-in computer, the attacker cannot access more than the employer is able to access.. Let the users be administrators on their clients, and control access to documents, files and data by storing them at a central server. Client side security is inneccesary, and can always be bypassed. For example using a linux cd to boot up the computer and access every file on the computer.

Its always good to adhere to the following rule:
“If you have physical access to a computer, nothing prevents you to read or access the data stored on it”.

read or access means in some way downloading or reading data. The data may be unreadable (encrypted) but then you take the data with you and do a offline attack.

So the best is to place all security as centrally as possible. A good idea is to never store anything on the laptop.
But instead store everything on central servers. These servers can then verify user in some way.

But keep in mind that user can still copy data that he gets from the server to a USB memory, or just take photos of screen and then OCR them.

So use a VERY strict need-to-know policy, and make sure that if the system is in doubt of if a people is really needing a specific information, make it go through approval by manager before allowing the employer access.

So this means a worker who is working on a software part is only need access to that part of software.

This means that EVEN if a attacker gets physical posession of his laptop, or gets hold of a employer’s authorization card or gets access to a logged-in computer, the attacker cannot access more than the employer is able to access..

Let the users be administrators on their clients, and control access to documents, files and data by storing them at a central server.

]]> By: pdp http://www.gnucitizen.org/blog/the-state-of-wifi-security/comment-page-1/#comment-117322 pdp Mon, 24 Mar 2008 12:35:45 +0000 http://www.gnucitizen.org/blog/the-state-of-wifi-security/#comment-117322 Aod, I agree although I could add that attackers will move to an easier target but probably still within the scope of their goals. Probably, hacking into a network where employs are connecting to, hoping to get control over their computers and use them as a stepping stone to access the secure network, as I explained in the post. But as you said, <q>nothing is fool proof</q>. thanks Aod, I agree although I could add that attackers will move to an easier target but probably still within the scope of their goals. Probably, hacking into a network where employs are connecting to, hoping to get control over their computers and use them as a stepping stone to access the secure network, as I explained in the post.

But as you said, nothing is fool proof.

thanks

]]> By: Aodhhan http://www.gnucitizen.org/blog/the-state-of-wifi-security/comment-page-1/#comment-117319 Aodhhan Mon, 24 Mar 2008 12:30:40 +0000 http://www.gnucitizen.org/blog/the-state-of-wifi-security/#comment-117319 To increase security for user log in, increase the required authorization factors. For our secure internal network, you must use a smartcard (PKI of course) along with a pass-phrase (something you have and something you know). You can always add fingerprint scan to give you, "something you are". Although nothing is fool proof, a hacker will most likely move on to an easier target. With WiFi, there are plenty of them. -Aod- To increase security for user log in, increase the required authorization factors. For our secure internal network, you must use a smartcard (PKI of course) along with a pass-phrase (something you have and something you know). You can always add fingerprint scan to give you, “something you are”.

Although nothing is fool proof, a hacker will most likely move on to an easier target. With WiFi, there are plenty of them.

-Aod-

]]> By: DailyWireless » Blog Archive » Friday Links: VoiceCon, Intel’s WiFi/WiMax Chip http://www.gnucitizen.org/blog/the-state-of-wifi-security/comment-page-1/#comment-117293 DailyWireless » Blog Archive » Friday Links: VoiceCon, Intel’s WiFi/WiMax Chip Mon, 24 Mar 2008 02:26:56 +0000 http://www.gnucitizen.org/blog/the-state-of-wifi-security/#comment-117293 [...] GNUCitizen has a mega post on WiFi security. It runs the gamut from physically breaking in to hacks. Read it here. [...] [...] GNUCitizen has a mega post on WiFi security. It runs the gamut from physically breaking in to hacks. Read it here. [...]

]]> By: Steve http://www.gnucitizen.org/blog/the-state-of-wifi-security/comment-page-1/#comment-117128 Steve Sat, 22 Mar 2008 00:54:36 +0000 http://www.gnucitizen.org/blog/the-state-of-wifi-security/#comment-117128 But what if the attackers deploy nanopirates against your nanorobots... But what if the attackers deploy nanopirates against your nanorobots…

]]> By: pdp http://www.gnucitizen.org/blog/the-state-of-wifi-security/comment-page-1/#comment-117109 pdp Fri, 21 Mar 2008 15:06:40 +0000 http://www.gnucitizen.org/blog/the-state-of-wifi-security/#comment-117109 mike, easy. we promote brain augmentation via nano robots which are connected to a security management console :) mike, easy. we promote brain augmentation via nano robots which are connected to a security management console :)

]]> By: Mike http://www.gnucitizen.org/blog/the-state-of-wifi-security/comment-page-1/#comment-117107 Mike Fri, 21 Mar 2008 13:11:33 +0000 http://www.gnucitizen.org/blog/the-state-of-wifi-security/#comment-117107 Many enterprise start discussing training, training, training, but I'm pretty sure you are all aware of how well that is going. If human behavior is part of that link (and will probably be the weakest part the majority of the time), how do we cope with human error? Many enterprise start discussing training, training, training, but I’m pretty sure you are all aware of how well that is going. If human behavior is part of that link (and will probably be the weakest part the majority of the time), how do we cope with human error?

]]> By: commercials http://www.gnucitizen.org/blog/the-state-of-wifi-security/comment-page-1/#comment-117105 commercials Fri, 21 Mar 2008 12:21:45 +0000 http://www.gnucitizen.org/blog/the-state-of-wifi-security/#comment-117105 "...but we keep the best ones for ourselves"... “…but we keep the best ones for ourselves”…

]]> By: pdp http://www.gnucitizen.org/blog/the-state-of-wifi-security/comment-page-1/#comment-117104 pdp Fri, 21 Mar 2008 10:58:43 +0000 http://www.gnucitizen.org/blog/the-state-of-wifi-security/#comment-117104 Geoffrey, exactly :) Geoffrey, exactly :)

]]> By: Geoffrey Lee http://www.gnucitizen.org/blog/the-state-of-wifi-security/comment-page-1/#comment-117103 Geoffrey Lee Fri, 21 Mar 2008 10:55:47 +0000 http://www.gnucitizen.org/blog/the-state-of-wifi-security/#comment-117103 I think another way to say it is that your security is only as strong as the weakest link, and human behavior is part of that link. I think another way to say it is that your security is only as strong as the weakest link, and human behavior is part of that link.

]]> By: Sid http://www.gnucitizen.org/blog/the-state-of-wifi-security/comment-page-1/#comment-117101 Sid Fri, 21 Mar 2008 10:28:56 +0000 http://www.gnucitizen.org/blog/the-state-of-wifi-security/#comment-117101 Well, Wi-Fi security might be after all just a bad answer in a flawed security model. Instead of trying at all cost to prevent people from entering the network by securing layer 2, maybe we should think more of securing layer 3. And bye bye 802.1x, WPA, NAC and similar expensive stuff... In the end, an open Wi-Fi network with an IPSEC gateway might be easier to deploy. Well, Wi-Fi security might be after all just a bad answer in a flawed security model. Instead of trying at all cost to prevent people from entering the network by securing layer 2, maybe we should think more of securing layer 3. And bye bye 802.1x, WPA, NAC and similar expensive stuff…

In the end, an open Wi-Fi network with an IPSEC gateway might be easier to deploy.

]]> By: LUPUS http://www.gnucitizen.org/blog/the-state-of-wifi-security/comment-page-1/#comment-117098 LUPUS Fri, 21 Mar 2008 09:54:50 +0000 http://www.gnucitizen.org/blog/the-state-of-wifi-security/#comment-117098 Thanks :) Thanks :)

]]> By: pdp http://www.gnucitizen.org/blog/the-state-of-wifi-security/comment-page-1/#comment-117097 pdp Fri, 21 Mar 2008 09:53:54 +0000 http://www.gnucitizen.org/blog/the-state-of-wifi-security/#comment-117097 well, that business model will change soon. well, that business model will change soon.

]]> By: malkav http://www.gnucitizen.org/blog/the-state-of-wifi-security/comment-page-1/#comment-117096 malkav Fri, 21 Mar 2008 09:46:54 +0000 http://www.gnucitizen.org/blog/the-state-of-wifi-security/#comment-117096 red teams/tiger teams should be the standard, as should be the threat modeling based on objective/assets. but we have a big problem here. users (so clients) where educated technology centric, and are vastly unaware of real world attackers practice. why would i spend time on exploiting your network when i can get the password i need to access your assets with a drunk manager at a local bar ? or in the trash ? i hope that by offering this kind of services to my clients, some of them will become aware of how easily vital IP can be stolen/destroyed, but the contacts i had proves me wrong for the moment, people still wants NAC, automated nessus scan, and many other pretty useless energy consumption. red teams/tiger teams should be the standard, as should be the threat modeling based on objective/assets.

but we have a big problem here. users (so clients) where educated technology centric, and are vastly unaware of real world attackers practice. why would i spend time on exploiting your network when i can get the password i need to access your assets with a drunk manager at a local bar ? or in the trash ?

i hope that by offering this kind of services to my clients, some of them will become aware of how easily vital IP can be stolen/destroyed, but the contacts i had proves me wrong for the moment, people still wants NAC, automated nessus scan, and many other pretty useless energy consumption.

]]>