This latest vulnerability on Cisco WLAN (AP Skyjacking) points out the importance for customers to deploy overlay WIPS to have a zero day response capabilities in place. Making changes to your WLAN controller, APs, and firewalls takes time and new vulnerabilities like this will continue to surface.
A dangerous exploit that can be carried out using this vulnerability is for a hacker to route an enterprise customer’s Cisco AP to WLC deployed out in the Internet and change the Guest SSID to map to an internal enterprise VLAN (using REAP mode supported on Cisco APs); see below for Pravin’s comments.
AirTight is the only WIPS vendor who can detect this dangerous exploit (i.e. Guest SSID mapped to incorrect VLAN) and prevent this scenario. Using AirTight WIPS, you can map WLAN SSID-to-VLAN security policy (i.e. wireless-to-wired security policy mapping) thus allowing you to detect this misconfiguration and prevent a hacker from exploiting this. Using Cisco WLC+WCS+MSE or other third-party WIDS/WIPS, this scenario will go undetected for sometime thus allowing the hacker access into the customer’s enterprise network.
Customers should pay immediate attention to this vulnerability and change their default settings on their Cisco APs (i.e. out of the box configuration) and put zero day response strategy for vulnerabilities like this in the future.
Sri Sundaralingam Best practices, Wireless security Cisco, Cisco WLAN Vulnerability, skyjacking
Recently we did a webinar with one of our health care customers (Maine Medial Center) and it was interesting to note how Wi-Fi networking has become mission critical in health care driven by applications. Various patient care applications enabled via Wi-Fi networking increases patient care quality, improves efficiency, and drives down overall cost. Given all the current discussion regarding healthcare reform and driving down costs, this is interesting to note how a technology like Wi-Fi networking can help you do that.
Healthcare is one of the few industries where Wi-Fi networking has become more and more mission critical. Customers need to pay attention to security, availability, and reliability of the Wi-Fi deployment in order to enable mission critical applications via Wi-Fi connectivity.
This webinar can be found at http://www.airtightnetworks.com/home/news/webinars.html
Sri Sundaralingam Best practices, Wireless security Health care
Today Network World released an interesting real-life case study of data leakage in the enterprise – refer to http://www.networkworld.com/news/2009/051109-data-leak-audit.html?page=1
The auditor found unencrypted confidential data being sent by internal employees through email & web communication (via the company’s firewall). While customers need to deploy Email & Web DLP systems to protect themselves against these risks they also need to worry about data leakage via wireless connectivity.
A recent study by AirTight found unencrypted Access Points connected to financial networks were leaking out confidential information regarding internal users & corporate IT network resources. Refer to http://www.airtightnetworks.com/home/resources/knowledge-center/financial-districts-scanning-report.html . Internal users can also connect to neighboring Wi-Fi networks and send confidential data (i.e. bypass the corporate security gateways).
This is an area where customers need to pay attention to make sure their corporate network is protected against data leakage via unsecured & unauthorized wirleess connectivity.
Sri Sundaralingam (VP, Product Management @ AirTight Networks)
Sri Sundaralingam Best practices, Compliance, Wireless security
