Banking on wireless? Ken Newman, Director and Infrastructure Security Assurance Manager for a major global financial institution, shares his strategies for securing wireless.

KEN NEWMAN is Director and Infrastructure Security Assurance Manager for a major global financial institution. He is responsible for implementing an information security program to ensure the secure operation of technology infrastructure. In previous roles at this bank, Mr. Newman managed security products, information security consulting, and perimeter security and operations. He has worked closely with vendors and IT teams on implementation and strategy. Ken also recently worked with the bank's network engineering team to design a secure Wi-Fi access model for deployment within the organization.

Prior to joining his current company, Ken worked for another Fortune 50 firm, where he was responsible for the deployment and management of access control and anti-virus security products. Ken has more than 15 years of practical IT experience working with systems, networks, and applications, plus a proven track record of more than 10 years of providing security solutions in financial services.

ONE ON ONE

ADVISOR: Please tell me a little bit about your background and what you do in your role as a Infrastructure Security Assurance Manager (ISAM)?

NEWMAN: I've been in information security in financial services for about 11 years. During that time, I've been involved with a little bit of everything. The operational side of security: account administration, monitoring, etc.; the technology side of security: introducing products and technologies to provide control and reduce risk; and, the risk management side: assessing and analyzing technology risk as it applies to business processes and helping businesses identify appropriate controls to manage that risk. Right now, my focus is on making sure security related technologies are properly configured for the environment.

ADVISOR: What does the role of ISAM entail?

NEWMAN: I look at policies and standards around managing infrastructure components, like a wireless network, and I update processes, procedures, or tools to address any gaps in security.

ADVISOR" I'd imagine that, given the data with which they're dealing, financial institutions are on the bleeding edge of security technology. Is that accurate?

NEWMAN: I would say that's probably true. The need is certainly there. Banks are obviously heavily regulated here in the U.S. and all the countries in which they do business around the world. There are regulatory bodies that monitor how they're allowed to handle transactions, as well as how they must maintain the security of their information.

ADVISOR: Does wireless technology play a large part in the financial industry?

NEWMAN: Generally speaking, wireless is probably starting to playa more substantial part in financial services, for much the same reason it does in many other industries: the collaborative ability and increased productivity that come from a mobile workforce. These workers can come together and work in different ways and not be so constrained by traditional wired environments. The difference for financial services is, from a regulatory standpoint, there's a greater mandate and requirement for controls. There has been a strong demand from the business to make the technology available, and you should focus on bringing it to business users in a way that meets their needs, with an appropriate amount of control.

ADVISOR: When you're looking at rolling out a mobile solution, how do you decide which employees merit access to mobile data?

NEWMAN: I would look at it a little bit differently. Rather than looking at what employees are appropriate to be mobile, assess what types of information and applications are appropriate to be accessible via mobile devices, regardless of the type of user. Let business management decide which users should be mobile since they're paying for it.

ADVISOR: Can you give me an example of how that decision-making process plays out?

NEWMAN: At a high level, it makes sense for a business user to have access to market data that isn't confidential--it's subscription based, but isn't necessarily private--or, various types of non-proprietary information companies make available to all employees just by virtue of placing it on the corporate intranet. Certain kinds of directories or common services are good examples of this kind of data. Right now, it's better to focus on mobilizing supporting data rather than confidential, transactional, or mission critical data.

ADVISOR: How are other industries using wireless technologies, and what issues have they been encountering?

NEWMAN: Retailers are doing some interesting things with wireless. They're using wireless most commonly on the point-of-sale (POS) side. I assume a number of them are using it for inventory as well, but there's a clear driver at the register to use wireless technology to deliver information to back-end processing systems; inventory systems could also automatically key off those. However, there have been security issues with wireless POS. For example, when a well-known consumer electronics store started selling Wi-Fi technology to the masses, it ran into a problem with customers who were buying Wi-Fi cards. They'd leave the store and immediately want to test out their new gadget, sometimes not even making it out of the parking lot. They'd plug the cards into their laptops and start fiddling around and suddenly be associated to the store's wireless network.

I'm sure not everybody took advantage of the unsecured network, but an unscrupulous users could use wireless sniffers to pick up purchase information going back and forth. The same thing happened to a large retail book store here in New York. It's located in midtown near where a computer group called 2600 meets. When the group started getting interested in wireless, in one issue of its magazine, 2600 published a list of all the books at that location sold during the course of one of their meetings. The store apparently had an open wireless POS system, and the all the purchase information was readily available.

ADVISOR" When you say "all the purchase information," does that include credit card numbers and customer names?

NEWMAN: Potentially, in both cases--both the consumer electronics store and the book seller. By now, I'm sure those stores have taken steps to rectify that situation.

ADVISOR: Wi-Fi went mainstream pretty quickly, but it's sophisticated technology for the average user.

NEWMAN: Yes, Wi-Fi took off before most people knew the kinds of issues it would introduce. I've seen technology programs on TV that show owners of brand-new mobile equipment how to sniff for open networks they might be allowed to access. The problem, of course, is they might be connecting to someone else's network without even realizing it, connecting to a network they shouldn't, or have the opportunity to collect information crossing that network.

ADVISOR: Microsoft Windows XP makes this even easier by giving users an interface that lets them easily scan for open networks.

NEWMAN: Yes, it's one of the things that makes XP much easier to use. In previous versions of Windows, when you bought your wireless PCMCIA card, you had to install the client software from Cisco or Linksys--or whatever vendor you happened to be using--to configure and use it. XP built all that into the operating system, so you can take almost any wireless card you want, plug it into an XP machine, and just start using the networking applet in XP to completely manage a wireless connection. A window pops up to let you know what wireless networks are available, and which ones are encrypted or not encrypted. You just click on one of the unencrypted ones and you're part of that network.

ADVISOR" When you're using your Wi-Fi connection, have you noticed that many of the wireless networks out there are still unencrypted?

NEWMAN: I have an apartment in a large urban area with a number of high-rises around me. I use a very small portable--nothing nearly as powerful as a full-sized laptop, no external antenna--and I'm able to use NetStumber to see wireless networks. NetStumber is a very heavily downloaded wireless tool. It easily installs on Windows, and you don't have to do much to configure it. It acts just like a client and looks for an available connection, then finds every connection in range and gives you information about it.

From my apartment, I took a sample in September 2002, then again in the spring of 2003 and saw a three-fold increase in the number of unencrypted networks. Some were home, and/ some were probably business networks. Someone with the same equipment would be able to connect to any one of them.

ADVISOR: So, rather than the trend being an increase in an understanding of the technology and more people locking down their networks, the trend is a base increase in the number of wireless networks, and because people simply aren't protecting them, an increase in the number of unsecured networks.

NEWMAN: From everything I've experienced and read, I'd have to say that's correct. The volume is certainly out there, and all the product gurus are correct: Wi-Fi is exploding. But, as the volume increases, the percentage of properly configured environments isn't increasing. If you look at the statistics from the group that does the World Wide War Drives, you'll see the percentage of well-configured systems--enabling encryption and changing default properties such as network names--appears to be decreasing.

ADVISOR: Wi-Fi has taken a beating in the press for its lack of security, specifically weaknesses with Wired Equivalent Privacy WEP, which is being replaced with WPA. But, how much of the problem should be attributed to weaknesses in Wi-Fi security, and how much is attributable to the fact that users aren't using any security on their networks?

NEWMAN: Things would be a lot better if everybody used 128-bit WEP. Certainly, WEP is flawed, but then again, I know only a handful of people who have taken the time to break it. enterprises should not rely on WEP alone for security, but for home users, small businesses, and quick and dirty network setups, it may be fine. And, WPA corrects most of the flaws in WEP. Microsoft even has a Service Pack that adds WPA support into XP the way WEP is today. That could produce phenomenal improvements across the market as more vendors provide support. In many cases, just turning on WEP would be an improvement; and, WPA is a substantial improvement.

The problem is many people don't know about WEP or WPA. Wi-Fi products are often put on the market with insecure default configurations. They're sold to be plug-and-play and easy to use. Whenever you do that, security is going to take a back seat. Wi-Fi products should be sold with either better configuration in place or clearer instructions and tools to help users make them secure.

So, to answer your question, I put more of the blame on how the products are configured and sold, and not as much on the technology itself. If you take sophisticated technology and sell it like toasters, people are going to use it like toasters. They aren't going to be concerned about whether their toaster is secure, they just want it to do its job.

ADVISOR: What other dangers does Wi-Fi's ease of use introduce?

NEWMAN: If you're in a corporate environment, you might have a scenario where you have a user who has a piece of equipment that's Wi-Fi-enabled. Perhaps you've given him permission to access the access point, or maybe the user has a top that's Wi-Fi-enabled out-of-the-box. Either way, he's connected to your network. And, say someone outside your company sets up an access point with a stronger signal and user's XP machine automatically associates to it. That laptop is now potentially bridging your internal network to somebody else's network.

ADVISOR: With Wi-Fi's ability to go through walls and its theoretical range of several hundred feet, that could happen fairly easily in a densely populated area or in an office building.

NEWMAN: Exactly. I have seen wireless walks through some office buildings to scan for the presence of access points; in a lot of cases, you can't tell if an access point is in your building and belongs to you, or is across the street and belongs to somebody else.

ADVISOR: So, what happens when you scan a building for access points, you find one, and you're somehow able to determine it doesn't belong to you? What do you do? It isn't as if can go next store and ask the neighboring company to shut down its wireless network.

NEWMAN: There's very little you can do. One option is to them you found an open access point, and that for their own protection, they should lock it down. Maybe they'll do something about it, maybe they won't. Maybe it's a public hotspot. The only thing you can do on your side is make sure your user's equipment is properly configured so that either wireless connectivity is disabled in areas where you don't want to make it available or that your users' machines can only talk to your access points with your WEP keys, and so forth. But, even that's a challenge because, if users want to take their laptop home at night, they're going to want it to talk to their wireless network at home.

ADVISOR: What is "information leakage"?

NEWMAN: That goes back to how people configure access points. I've seen a number of access points that use the company name and/or location as the SSID in the network name. That's like waving a flag, saying, "Hey, here's a big company, and here's exactly where it is." Not only do you want to get rid of the default network name, you want to have a network name that doesn't let someone scanning from blocks away know what kind of business you're doing and where you are.

ADVISOR: So far, we've discussed a lot of things people unknowingly do to make their networks vulnerable. What about intentional attacks that hackers might launch?

NEWMAN: The entree for those attacks is usually the accidental steps we've discussed. Maybe somebody's laptop associates with another network and acts as a bridge. Or, perhaps a user simply doesn't understand the risk and decides he wants wireless connectivity in his area or conference room. So, he just goes down to CompUSA, buys an access point, and plugs it into the wall. Everyone in the area can use it, and it's an open path to the network. Anybody on the outside with basic equipment can find that access point, discover that it's open, and simply connect to it. At that point, the attacker is on your network and can do anything he wants to do. He's gone by the firewalls, and bypassed any other measures you implemented to protect your network. After he's on your internal network, every other traditional attack applies, whether it's just looking for information, trying to bring down your system, or trying to produce transactions that weren't supposed to happen. Even if he can't associate to your network because you've implemented some level of security, he can try to collect unencrypted traffic and learn information without ever being connected.

There have also been cases of potential spammers who have been identified driving around looking for open wireless networks. After they find one, they look for a mail server and use it to send spam. That makes you the source of someone else's spam and everyone comes back and complains to you. It's unauthorized use of your services, denying your users the use of your services, getting you into trouble with other people, and potentially--depending on your industry, and depending on the legal direction the government continues to take--getting you into trouble with various regulators for not taking reasonable minimal steps to protect your assets.

ADVISOR: Let's talk about solutions, starting with usage policies. What policies should companies put in place regarding wireless usage and how do they enforce them?

NEWMAN: As a starting point, an organization should already have a fundamental set of policies, standards, and guidelines from a technology point of view. If a company doesn't have that, it's well behind the curve and has a lot to do. You need to set up policies, standards, and guidelines around when and how to use wireless technology, and how to configure it to integrate into existing technology. You must communicate this on a couple of different levels, so your users know what they should and shouldn't do, both at home and at work, what's appropriate use and what isn't, and what they should and shouldn't access.

You also have to communicate to your technology people what they are and are not allowed to plug in, where they're supposed to plug in, and who needs access and who doesn't. There should be a high-level policy statement that demands only authorized, approved, standard Wi-Fi devices are allowed anywhere in your environment. You also need a standard that specifies a list of approved devices and the areas in which they can be deployed. There also has to be a guideline that defines exactly how the devices should be configured, the technology with which they must integrate, and what employees are approved to use them for what purpose. At a high level, that's probably a good starting point.

ADVISOR: In terms of standards for configuration, what categories of software do you recommend to protect wireless connections, access points, networks, and data on Wi-Fi-enabled laptops?

NEWMAN: My recommendation is multiple levels of protection for in-depth defense. For example, look at having multiple layers of encryption. You can use standard WEP encryption today between the client radio and the access point. But--because you realize WEP is flawed and want to be able to maintain a higher standard--you can use a VPN on top of that. WEP acts as a basic layer of encryption just above the hardware to assure the connection is secured as much as the technology permits. Then, at a higher level, you have a VPN providing stronger IPSEC user authentication and encryption.

In terms of the overall environment, the best recommendation is to make sure access points aren't connected directly to the internal network. Instead, you should connect them to an external segment outside the firewall. That firewall can then filter based on what services are and aren't allowed. In conjunction with that firewall, you should have the traditional types of network controls that any organization must implement: up-to-date anti-virus software checking the traffic going back and forth, intrusion detection software looking for inappropriate activity, etc.

Going back to the client side, the client itself should also have current anti-virus software. The client should have a personal firewall as well as some kind of encryption, either low-level encryption or file-level encryption. If the laptop is using Wi-Fi, the user could inadvertently roam to someone else's network, potentially giving them access to his system whether he's connected to the enterprise network or not.

To sum up, these are the kinds of things you need on the client: anti-virus, personal firewall, and encryption, as well as VPN software to improve the level of encryption and authentication basic Wi-Fi architecture provides. On the server side, all wireless communication should go through firewalls with rules to control the kind of traffic that's accessible. You also need intrusion detection, anti-virus at that level, and any other kinds of standard network controls your company is using. You should view traffic through this connection the same way you view external users coming from over the Internet: as untrusted.

ADVISOR: We've been focusing exclusively on Wi-Fi. What about mobile devices such as smartphones connecting through mobile phone carrier networks?

NEWMAN: That's a little more difficult. Most of those devices don't yet support the same range of protection-VPN, encryption, etc. I wouldn't let those types of devices connect directly to a corporate network without comparable controls. That's still in a bit in the future for most companies.