Security Watch | Matt Hines » RSA: Encryption plugging wireless security leaks

June 18, 2007 | Comments: (0)

RSA: Encryption plugging wireless security leaks

TAGS: Security

According to a new report published by EMC's security business unit -- RSA -- more companies are adopting wireless encryption and successfully defending their airborne networks.

Based on an experiment carried out by an unnamed independent security firm hired by RSA to look for unprotected wireless networks in major financial hubs (New York, London and Paris), the security company said the test found fewer open access points from which business data could be easily scooped than it has discovered in its previous tests.

(RSA said the experiment was carried out using a laptop and commercial software that was set to search for both broadcasting and non-broadcasting access points in the 802.11a, b and g frequencies. When networks were detected, the software identified the channel and service set identifier (SSID) before disconnecting from the source. The company said the software it used had no way of capturing or retaining the data content it scanned on any networks.)

According to the test, the largest year-over-year increase in sheer wireless network usage was found in London, where there were 160 percent more access points transmitting in 2007 than it found in similar experiments in 2006.

Wireless network use in New York jumped by a sizeable 49 percent, while in Paris it rose by 44 percent.

In terms of growth of wireless access points under use by businesses, RSA said that London also had the most significant increase, with a 180 percent gain over 2006, compared to an increase of 57 percent in New York, and 45 percent in Paris.

The key determinant in observing the security standing of any networks discovered under the test was to scan them to check for use of either advanced encryption or Wired Equivalent Privacy (WEP).

According to RSA, London experienced a "notable improvement" in the securing business wireless networks over the last year, with 81 percent of corporate access points armed with some form of encryption, compared to 74 percent in 2006.

However, the wireless security gains in New York and Paris were less dramatic, RSA reported. In New York, some 76 of wireless networks were protected using encryption, compared to 75 percent one year ago. In Paris, roughly 80 percent of networks were encrypted, compared to 78 percent in 2006.

While there are well-known concerns with the overall security of WEP (namely that it has been cracked by hackers and researchers alike), RSA said the increased use of any type of encryption should be viewed as encouraging as it makes it look like businesses are finally "getting it."

Across all three cities, the experiment also found evidence of growing use of advanced encryption, based on the number of networks it found protected by 802.11i and Wi-Fi Protected Access (WPA) systems.

In London, some 48 percent of the secured wireless business access points RSA detected were using advanced forms of encryption, and in New York roughly 49 percent were similarly protected. In Paris, only 41 percent of the access points scanned in the experiment used any form of advanced encryption.

The test equipment also recorded the number of wireless networks it found that were still configured according to default, using out-of-the-box settings that can make such access points far more susceptible to attack.

According to the test results, in London some 30 percent of wireless access points utilized default settings, a significant falloff from the 22 percent discovered in 2006. In New York, 24 percent of access points were found to use default settings, down from 28 percent in 2006. In Paris, some 13 percent of access points had default settings enabled, down from 21 percent last year.

Another risk vector included in the experiment were public Wifi hotspots, seen as an increasingly strategic venue for hackers to ply their trade, as otherwise well-protected business users may forget themselves and log on unprotected while buying a cup of coffee or sitting in an airport.

RSA said that the sheer number of Wifi hotspots has increased noticeably. In 2006, the company found 364 public wireless access points in London, compared to 461 in 2007, or a 27 percent increase. In New York the annual growth rate was 17 percent, and 15 percent of all wireless access points were found to be hotspots –the highest percentage across the three cities. In Paris, the volume of hotspots increased 37 percent and represented 11 percent of all access points.

Overall, the wireless security outlook is improving said Toffer Winslow, vice president of product marketing at RSA, but there is still a learning curve for business users who are adopting wireless into their workdays.

"Some might say that since WEP has been defeated so publicly it hardly qualifies as secure access anymore, but when you consider that about 25 percent of all business access points are using no form of encryption, it's a start," Winslow said. "The good news is that we are seeing a decent number of companies using WPA or 802.11a, but there are still a shocking number of unprotected networks outthere."

Just as wireless access remains nascent, so does the adoption of protection for the systems, said the expert.

"Often times the people putting these things up are not very sophisticated about managing security, that's why you see so many access points with out-of-the-box settings, people broadcast the SSID without knowing the implications," he said. "However, as we have learned in other areas of security, it will likely only take a few high-profile incidents where wireless is the entry point to convince some of the less sophisticated users to get savvier about protecting themselves."

Posted by Matt Hines on June 18, 2007 12:04 PM

RATE THIS ARTICLE: