70-299 : 10 Planning and Implementing Security for Wireless Networks

To configure wireless network security by using a GPO, follow this procedure:

1.Open a blank Microsoft Management Console (MMC) console, and add the Group Policy Object Editor snap-in. Open the GPO you will use to apply the wireless network configuration settings.
2.Expand the GPO, Computer Configuration, Windows Settings, and then Security Settings. Click Wireless Network (IEEE 802.11) Policies.
3.By default, there are no policies. Right-click Wireless Network (IEEE 802.11) Policies,and then click Create Wireless Network Policy. The Wireless Network Policy Wizard appears.
4. Click Next.
5. Type a name for the policy, and then click Next.
6.Select the Edit Properties check box, and then click Finish. The properties dialog box appears.
7.Click the General tab, as shown in Figure 10.8. The security-related settings are Networks To Access, which specifies whether the client is allowed to connect to ad hoc networks, and Automatically Connect To Non-Preferred Networks, which you might want to disable to prevent clients from connecting to potentially dangerous, untrusted wireless networks.
8.Click the Preferred Networks tab.This tab lists preferred networks, which are networks that Windows XP will automatically connect to. There are no preferred networks by default.
9. Click Add.The New Preferred Setting Properties dialog box appears, as shown in Figure 10.9.
The Network Properties tab allows you to specify whether WEP encryption will be used. Generally, you should select the Data Encryption and The Key Is Provided Automatically check boxes. Leave the Network Authentication check box cleared to use open network authentication.
10.Click the IEEE 802.1X tab. Select the Enable Network Access Control Using IEEE 802.1X check box.
11.If you want to be able to manage the computer across a wireless network when no user is logged on, select the Authenticate As Computer When Computer Information Is Available check box.
12.Click the EAP Type list to select either Smart Card Or Other Certificate or Protected EAP. This setting must correspond to the setting specified on the IAS server.
13.Click the Settings button to configure the selected EAP type. This dialog box is exactly the same as the dialog box used to configure wireless clients locally.
14. Click OK three times to return to the MMC console.

Note that you can only create a single wireless network policy for each GPO.

Configuring WAPs :
The final step of the wireless network configuration process is to configure and enable your WAPs. Unfortunately, the user interface varies for each WAP. At a minimum, you will need to configure the following settings:
■ Select WEP or WPA encryption and the encryption level.
■ Specify 802.1X authentication and the authentication method.
■ Specify the SSID.
■ Specify the IP address of the IAS RADIUS servers.
■ Specify a shared key corresponding to the shared secret specified during the IAS configuration.

70-299 : 10 Planning and Implementing Security for Wireless Networks

Lesson 2: Configuring Wireless Security

Although almost anyone can set up a wireless network in a few minutes, configuring a wireless network with security features is significantly more complex. Fortunately, Windows Server 2003 provides all of the software you need to deploy a wireless infrastructure with authentication, encryption, message integrity, and dynamically changing WEP shared secrets. At a high level, you will follow these steps to configure a wireless network infrastructure:

1. Plan wireless access policies.
2. Create a structure for authorizing users and computers to access the wireless network.
3. Plan the certificate infrastructure, and optionally deploy a PKI.
4. Configure IAS servers, including assigning a certificate and creating remote access policies (RAPs).
5. Update and configure wireless clients with the SSID and security settings.
6. Configure WAPs with security settings and the IP addresses of the IAS servers.

Planning Wireless Access Policies :
There are several aspects to planning wireless access policies. First, it is important to plan wireless access policies to help prevent WAPs from being installed in your organization with insufficient security. You should draft a policy that, at a minimum, defines the following requirements for new WAPs:
■ Authentication requirements. Generally, you should require that all wireless users are authenticated and specify whether PEAP or EAP-TLS will be used. If you plan to allow guests to access your wireless network, you should make provisions for creating WAPs providing limited access to your internal network that will be used only by guests.
■ Encryption. Some level of encryption should always be required. Unless you have wireless devices that do not support it, your policy should mandate the highest level of encryption available.
■ Physical security. Just like any other piece of network equipment, WAPs should be protected by lock and key to prevent attackers from tampering with the hardware.
■ SSID broadcast and naming conventions. Your policy should specify whether WAPs are configured to broadcast the SSID, and it should detail naming conventions for SSIDs.
■ Actively maintained list of WAPs. You must maintain a list of all WAPs on your network that at a minimum includes the SSID, the security settings, the administrator’s name, and patching equirements.
■ Auditing requirements. You should specify how usage information is gathered and how logs are archived.

10 Planning and Implementing Security for Wireless Networks

Lesson 1: Wireless Network Security Fundamentals

Wireless networks have these weaknesses too, but they lack the inherent physical security of wired networks. In fact, most corporate wireless networks can be accessed by people with mobile computers in the business’ parking lot. To make matters worse, attackers have significant motivation to abuse wireless networks. Accessing a wireless network might grant an attacker access to resources on an organization’s internal network. Or it might allow the attacker to access the public Internet while hiding his or her identity, which would allow the intruder to attack hosts on remote networks while disguised with the organization’s IP addresses.

The concerns over the abuse of wireless networks are far from theoretical. Intruders have a wide variety of tools available for detecting, connecting to, and abusing wireless networks. As with most aspects of security, there are technologies available that can help you to limit the vulnerabilities presented by wireless networks. Specifically, you can require wireless communications to be authenticated and encrypted. This provides assurance similar to that offered by the physical security of wired networks. The game between security experts and attackers continues, however, and early wireless authentication and encryption technologies can now be easily defeated by an intruder.

Security Threats :
Because wireless communications are not contained within the physical medium of a wire, wireless networks are more vulnerable to several types of attacks, including:
■ Eavesdropping. Attackers can capture traffic as it is sent between a wireless computer and the WAP. Depending on the type of antenna used and the transmitting power, an attacker might be able to eavesdrop from hundreds or thousands of feet away.
■ Masquerading. Attackers might be able to gain access to restricted network resources by impersonating authorized wireless users.
■ Attacks against wireless clients. Attackers can launch a network-based attack on a wireless computer that is connected to an ad hoc or untrusted wireless network.
■ Denial of service. Attackers can jam the wireless frequencies by using a transmitter,preventing legitimate users from successfully communicating with a WAP.
■ Data tampering. Attackers can delete, replay, or modify wireless communications with a man-in-the-middle attack.

WEP :
WEP is a wireless security protocol that helps protect your information by using a security setting, called a shared secret or a shared key, to encrypt network traffic before transmitting it over the airwaves. This helps prevent unauthorized users from accessing the data as it is being transmitted.

Unfortunately, some smart cryptographers found several theoretical ways to discover WEP’s shared secret by analyzing captured traffic. These theoretical weaknesses were quickly implemented in freely available software. The combination of free tools for cracking WEP encryption, the ease of capturing wireless traffic, and the dense proliferation of wireless networks have led WEP to become the most frequently cracked network encryption protocol today.

Besides weak cryptography, another factor contributing to WEP’s vulnerability is that WEP is difficult to manage because it doesn’t provide any mechanism for changing the shared secret. On wireless networks with hundreds of hosts configured to use a WAP, it is practically impossible to regularly change the shared secret on all hosts. As a result, the WEP shared secret tends to stay the same indefinitely. This gives attackers sufficient opportunity to crack the shared secret and all the time they need to abuse their ill-gotten network access.