Trust Symposium highlights the security perils of WLANs

While implementations of wireless local area networks (WLANs) are increasing, there are still some relevant concerns around security. At a recent Trust Symposium held by NamITrust, these very issues were addressed as part of the larger issue of enterprise security.

NamITrust is the enterprise security solutions provider (ESSP) within the NamITech group, specialising in securing the digital domain. The symposium was the first in a series planned for the coming 12 months and featured guest speaker Darren Smith, Editorial Director of Technews, publisher of eSecure and Network Times.

According to Smith, wireless networks can be highly insecure, to the point that anyone in the vicinity would be able to gain access to private computers and the Internet.

"In a recent FBI public notification, the hacking technique identified as 'Wardriving` was highlighted," says Smith. "This practice involves driving around in a vehicle, using a laptop computer equipped with the necessary hardware and software to detect wireless networks used in commercial or residential areas. The equipment required is fairly simple: a laptop computer with at least a Pentium 100, an Ethernet card and software that supports general operating systems such Windows.

"Once a vulnerable wireless network has been identified, the access point is often `warchalked` allowing public access to these private networks. Of course, the potential for a system compromise also exists."

The threat of `drive-by hacking` raised by Smith was well-supported by Chris Davis, Executive, NamITrust. "We recently conducted a small sample survey of detectable WLANs in the Sandton and Midrand area. While simply driving around the areas using an adequately equipped laptop, we were able to detect one open unencrypted WLAN, 11 closed but still unencrypted and only two encrypted WLANs, on of which was NamITech`s!"

All of these unencrypted WLANs are vulnerable to hacking, providing further substance to the argument that IT security needs to become a real strategic management issue. It should form an integral part of a risk management policy that ideally encompasses management structure, operational risk and reputation risk.

"Often companies are not security smart. Their core business lies elsewhere and when it comes to implementing IT security, they have few expertise within the organisation that are adequately equipped to deal with it," explains Davis. "More and more, companies are turning to an ESSP such as NamITech, to provide, monitor and manage its digital security."

There are many tangible benefits for organisations that do elect to go the ESSP route such as reduced cost of total ownership, having skilled professional staff available 24 x 7 and knowing that the service provider remains up to date with global security trends.

"A reputable ESSP will also be able to assist management in meeting its corporate governance requirements. Basically, what we do as a security service provider is allow the company to focus on its core business, safe in the knowledge that someone they trust is handling its security environment," concludes Davis.