Successfully reported this slideshow.
white paper        october 2011TIRED OF ROGUES?Solutions forDetecting andEliminatingRogue WirelessNetworks
White paperSolutions for Detecting andEliminating Rogue Wireless Networks                           Tired of Rogues?      ...
White paperSolutions for Detecting andEliminating Rogue Wireless NetworksExperts and industry analysts agree that given th...
White paperSolutions for Detecting andEliminating Rogue Wireless Networks 1. Evolution of Rogue WLANsJust as employees fir...
White paperSolutions for Detecting andEliminating Rogue Wireless NetworksVirtual Wi-Fi                                    ...
White paperSolutions for Detecting andEliminating Rogue Wireless Networks 2. What is at Risk?Because WLANs operate in an u...
White paperSolutions for Detecting andEliminating Rogue Wireless Networks 4. Techniques to Detect Rogue WLANsOnce an organ...
White paperSolutions for Detecting andEliminating Rogue Wireless NetworksWhile this process requires the physical presence...
White paperSolutions for Detecting andEliminating Rogue Wireless Networks7. AirDefense 24x7 Centralized                   ...
White paperSolutions for Detecting andEliminating Rogue Wireless Networks 5. The Motorola AirDefense SolutionThe centraliz...
White paperSolutions for Detecting andEliminating Rogue Wireless NetworksThreat-Based Rogue Management                    ...
Motorola, Inc.1303 E. Algonquin RoadSchaumburg, Illinois 60196 U.S.Amotorola.com/wmsMOTOROLA, MOTO, MOTOROLA SOLUTIONS and...
Upcoming SlideShare
Loading in …5
×

Wns rogues wp_1011_v3

350 views

Published on

Published in: Technology, Business
  • Be the first to comment

  • Be the first to like this

Wns rogues wp_1011_v3

  1. 1. white paper october 2011TIRED OF ROGUES?Solutions forDetecting andEliminatingRogue WirelessNetworks
  2. 2. White paperSolutions for Detecting andEliminating Rogue Wireless Networks Tired of Rogues? Solutions for Detecting and Eliminating Rogue Wireless Networks This paper provides an overview of the different types of rogue wireless devices, risks faced by enterprises due to their proliferation and multiple approaches to detecting and mitigating them. The Motorola AirDefense solution allows enterprises to effectively detect and eliminate all types of rogues. PAGE 2
  3. 3. White paperSolutions for Detecting andEliminating Rogue Wireless NetworksExperts and industry analysts agree that given the proliferation of WLANs, there is a very high probability of unauthorizedWLAN devices showing up on an enterprise’s network. Any unauthorized wireless device that connects to an enterprise’sauthorized network or device is defined as a rogue wireless device. Rogue wireless devices pose one of the greatest risks toan enterprise’s network security. Figure 1 shows typical rogue device scenarios that compromise contemporary wired andwireless networks, circumventing traditional security mechanisms such as firewalls and perimeter protection.Figure 1 – Rogue devices compromise traditional wired and wireless security PAGE 3
  4. 4. White paperSolutions for Detecting andEliminating Rogue Wireless Networks 1. Evolution of Rogue WLANsJust as employees first brought personal computers to the The Real Rogue Threat:office in the 1980s for their many benefits, employees are Wireless Stations & Not APsinstalling their own WLANs to corporate networks when WLANs are comprised of APs that are attached toIT departments are slow to adopt the new technology. the enterprise network and WLAN access cards forAccording to Gartner, enterprises that have not deployed laptops, hand-held devices, and desktop computers. Bothwireless are at a higher risk of exposure from rogue unauthorized APs and unauthorized activity from WLANwireless devices. access cards can pose significant security risks. As more and more confidential information is locally storedEven enterprises that are deploying wireless must tackle on mobile laptops equipped with WLAN access, thesethe problem of rogue WLANs from employees who do not become the weakest link in the security infrastructure.have wireless access, contractors, auditors, vendors, etc., Wireless laptops often run supplicants designed towho bring in their own equipment while operating within effortlessly connect to available wireless networks makingthe office, or potential espionage traps. them vulnerable to wireless attacks.Rogue Access Points Devices with Built-in WLAN AccessRogue WLANs most commonly refer to rogue Access Major computer vendors are selling almost all laptopsPoints (AP) that when attached to the corporate network with built-in WLAN access cards. A rogue WLAN hasbroadcast a network connection. A rogue AP is any AP traditionally been thought of as a physical AP unsanctionedunsanctioned by network administrators and connected to by network administrators. Today rogue WLANs are furtherthe wired network. Most rogue APs are improperly secured defined as laptops, handhelds with wireless cards, barcodewith default configurations that are designed to function scanners, printers, copiers or any WLAN device. Theseright out of the box with no security features turned on. devices have little to no security built in making it easyEmployees or even business units seeking to enhance for intruders to find an entry point. Increasingly, we aretheir productivity deploy rogue APs innocently without seeing ad-hoc networks in new networked devices such ascomprehending overall security risks. unnoticed, and can be printers, projectors, gaming consoles, etc. A simplelocated anywhere. printer with an open, unauthenticated, peer to peer adhoc wireless network (typically present for ease of use, troubleshooting, etc.) can provide a bridge to the wired- side network to which it is connected making them vulnerable to wireless attacks. PAGE 4
  5. 5. White paperSolutions for Detecting andEliminating Rogue Wireless NetworksVirtual Wi-Fi Accidental andWindows 7 has added the ability to create a Virtual Access Malicious AssociationsPoint that shares the wireless interface. Virtual Wi-Fi Accidental associations are created when a neighboringis not an adhoc network, but an actual virtual access AP across the street or on adjacent floors of a buildingpoint that behaves, lives, and breathes like an actual bleeds over into another organization’s airspace triggeringAccess Point. This allows the user to share their network its wireless devices to connect. Once those devicesconnection with others. Wireless networks may use connect with the neighboring network, the neighbor hasauthentication and encryption, BUT the user can share that access back into the organization. Accidental associationsconnection with others, allowing those users to connect between a station and a neighboring WLAN are recognizedto the corporate network with weaker authentication & as a security concern.encryption. There are applications available (some free)that enable this functionality or users can simply type a A malicious association is when a company laptop iscouple of commands. This new form of rogue needs to be induced to connect with a malicious device such asaddressed in every Enterprise using Windows 7. a Soft AP or laptop. The scenario also exists when a malicious laptop connects with a sanctioned AP. Once theStealth Rogue Devices association has been made the hacker can use the wirelessSeveral new and sneaky rogue WLAN devices are device as a launch pad to attack servers and other systemsconstantly being exposed. Examples include rogue APs on the corporate network.that look like power adapters plugged into a wall jack.These devices have a WLAN AP built in and use power-line Ad-Hoc Networkscommunications as the wired-side link! Such a device Similar to rogue APs, ad-hoc wireless networks representwill never be detected by wired-side network scanners. another major concern for WLAN security because theyNevertheless, it can be within the enterprise perimeter can put a network at risk without security managers everluring unsuspecting corporate users to connect wirelessly seeing the vulnerability. WLAN cards enable peer-to-peerand reveal confidential information to a hacker well networking between laptops without an AP. These ad-outside the perimeter. Other examples include stealth hoc networks can allow an authorized user to transferrogue APs that are completely silent until they hear a private corporate documents and intellectual propertyspecial “knocking” sequence over the air, upon which they to unauthorized users without going over the corporatewake up, communicate and go back to silent mode. Yet network. While WLAN cards operate in ad-hoc mode,another stealthy rogue uses the AP’s scheduling system the user must be able to trust all stations within rangeto turn off the radio until a predetermined time when the because ad-hoc networks offer little or no authenticationattacker returns. Once back on the rogue, they schedule management. A hacker’s station could directly connect tothe next appointment and turns off the radio. It remains an authorized user, access local information and potentiallyoff until their return. These rogues cannot be detected by gain access to the rest of the wired network if the useroccasional walk-around tests with handheld sniffers. They happens to be connected to the wired network as well.require, 24x7 “always on”, monitoring of the airspace. PAGE 5
  6. 6. White paperSolutions for Detecting andEliminating Rogue Wireless Networks 2. What is at Risk?Because WLANs operate in an uncontrolled medium, are • Financial data, leading to financial losstransient in the way they connect, and come with insecure • Reputation, damaging the efforts spentdefault configurations, they provide an easy open door to building the brandthe wired network and wireless access devices. Insecure • Proprietary information, leaking tradewireless networks can easily be sniffed acting as a launch secrets or patentspad to the wired network and an organization’s corporate • Regulatory information, foregoing customerbackbone. Once accessed an insecured WLAN can privacy or ignoring government mandatescompromise: • Legal or regulatory ramifications • Wired infrastructure such as switches and routers 3. Requirements to Detect Rogue WLANsIn confronting the issue of rogue WLAN detection, a user Scalable and Cost Effectivemust consider the functional requirements and return on for the Enterpriseinvestment of the solution. IT security managers should Rogue detection must scale to fit the specific needs of anevaluate various approaches based upon technical enterprise. Some piece-meal solutions work for smallerrequirements, enterprise scalability, cost, and ability to organizations but do not scale for large enterprises withcover the future needs of network security. dozens or hundreds of locations around the globe. Large enterprises require a cost-effective solution that canFunctional Requirements be centrally managed. In determining the cost of rogueA comprehensive solution to detect rogue WLANs must detection, IT security managers must consider the initialdetect all WLAN hardware and activity that includes: costs of the solution and additional costs needed for on- • Detection of all rogue devices and associations going support. • Ability to classify and clearly distinguish rogues on the network from unauthorized wireless devices Future Proof sharing the airspace Rogue detection should scale to meet the future needs • Detailed forensic analysis of rogue devices of enterprise network security. An organization that bans and associations, and data transmitted all WLANs today is likely to move ahead with a pilot • Assessment of threat from a rogue device based deployment in the next year. At this time, an enterprise on present and past behavior with limited WLANs must maintain its rogue detection • Physical and network location of rogue devices for unauthorized areas and secure the pilot WLAN from • Termination of rogue devices using wired and accidental associations and ad-hoc networks. As WLANs wireless mechanisms are deployed throughout an enterprise, rogue detection must be complemented with 24x7 monitoring and intrusion detection. Other value added benefits that can be leveraged such as performance and network health monitoring should also be considered in the decision process. PAGE 6
  7. 7. White paperSolutions for Detecting andEliminating Rogue Wireless Networks 4. Techniques to Detect Rogue WLANsOnce an organization decides on a policy that bans WLANs However, SNMP polling of wired switches can revealcompletely or more precisely prohibits employees from MAC addresses of wireless devices connected to them.deploying their own networks, the organization must Intelligent analysis of this information with correlation ofdecide how to enforce that policy across the enterprise. wireless information can be used forThis section outlines several approaches that have been rogue detection.used to detect rogue WLANs and their strengths andweaknesses. 3. Wired-side Network Scanners 1.) Wired-side Intrusion Detection System Wired-side network scanners work similar to SNMP 2.) Wired-side SNMP Polling polling to identify IP devices attached the network and key 3.) Wired-side Network Scanners characteristics of those devices, such as MAC addresses 4.) Wireless Scanners and Sniffers and open ports. Rather than the SNMP protocol, scanners 5.) Wired-side Traffic Injection typically use TCP fingerprints to identify various types of 6.) Wireless Traffic Injection devices. 7.) AirDefense 24x7 Centralized Wired and Wireless Monitoring Network scans can also be extremely intrusive and they require that an IT security manager have access to all the1. Wired-side Intrusion IP devices on the network and know all IP addresses. ToDetection System locate every rogue AP, a scan would have to be performedWired-side intrusion detection system (IDS) offers virtually on the entire network, which would cause personalno ability to detect rogue WLANs but can be useful in a firewall alerts and multiple alarms from network intrusionlimited capacity. While intruders entering the network detection systems. Traditional wired-side networkthrough a rogue WLAN appear mostly as authorized users, scanners are not an effective solution for enterprise roguea wired-side IDS may alert IT security managers when the WLAN detection because wired-side scannersintruder tests wired-side security measures. A wired-side • Require an accurate database of all IP devicesIDS fails as an effective approach to detecting rogue • Are limited to subnets unless routers are reconfiguredWLANs because it cannot identify APs attached to the • Produce multiple false positives from network IDS andwired network, virtual Wi-Fi, accidental associations and personal firewallsad-hoc networks. These are typically below the radar for • Cannot detect virtual Wi-Fi, accidental associations,wired IDS. or ad-hoc networks.2. Wired-side SNMP Polling 4. Wireless Scanners and SniffersSimple Network Management Protocol (SNMP) polling Wireless sniffers and scanners differ greatly from wired-can be used to query information from IP devices attached side tools because wireless sniffers and scanners captureto the wired network, such as routers, stations, and and analyze WLAN packets from the air. By monitoringauthorized APs. This process requires that the IT security the airwaves for all WLAN activity, wireless sniffers andmanager conducting the SNMP poll to know the IP address scanners detect most APs and active wireless stationsof all devices being polled, which must also be configured within range. They also can provide detailed informationto enable SNMP. For these reasons, SNMP polling by itself about the configuration and security employed by eachis not an effective approach to detecting rogue WLANs. device.The IT security manager is not likely to know the IP addressof the rogue AP, and the rogue AP is not likely to have Both sniffers and scanners are limited by their needSNMP enabled. In addition, an SNMP poll against an for a network administrator to physically walk the areaauthorized station operating as with virtual Wi-Fi enabled with a laptop or hand-held device running the sniffer orwould not detect any WLAN activity. SNMP polling scanner application. A research brief from META Groupalso would not detect accidental associations or ad-hoc questioned the viability of wireless sniffers and scannersnetworking between stations. for enterprise security. PAGE 7
  8. 8. White paperSolutions for Detecting andEliminating Rogue Wireless NetworksWhile this process requires the physical presence and 5. Wired-side Traffic Injection “WIDS mustvaluable time of a network manager, the effectiveness is Some vendors have used dedicated wired-side devices to continuously scan forlimited because it only samples the airwaves for threats inject special broadcast frames over the wired networkat any given time. New rogue APs and other vulnerabilities and detect authorized segment. These broadcast frames are then transmittedcan arise after a scan and will not be detected until the over the air by any wireless APs present on the same and unauthorizednext time a network administrator surveys the network. In network segment. By detecting these frames over the air, activities. Continuousaddition, since handheld sniffers do not have wired-side using wireless sniffers, and analyzing the transmitter’s scanning is 24 hours/information, determining a rogue is typically done by MAC address, the user is able to determine if any day, 7 days/week.”walking right up to it and making sure it is connected to the unauthorized APs are connected to that network segment.wired network. Stealth rogue devices might go undetected The primary drawback of this method is that it requires Gartneras would transient station associations. a wired traffic injector in every network segment. This might make it infeasible with multiple VLANs. In addition,This approach is particularly unreasonable for enterprises this method fails to detect any rogue APs that have builtoperating dozens of offices around the country or retailers in routers. Routers will separate broadcast domains andwith hundreds of stores. Even if these organizations could the special wired broadcast frame will not be transmittedfeasibly devote a network administrator’s full attention over the air. Since most common consumer APs that endto survey each site on a monthly basis, rogue APs and up as rogues have built in routers, this method is not veryother vulnerabilities can pop up the minute the survey is effective. Further, this technique provides zero client sidecompleted. rogue detection function.Smaller organizations operating in a single location without 6. Wireless Traffic Injectionpotential for growth may find sniffers and scanners to This method is similar to wired traffic injection except itbe their most cost-effective solution if the organization relies on a wireless device to inject a special frame overis willing to accept the threat of rogue WLANs popping the air. If a sniffer sees an unauthorized AP, it tries toup between network audits. The vast limitations of connect to it wirelessly and subsequently inject a framephysical site surveys and the demands for personnel that can be traced on the wired-side by a server or bytime, limit the effectiveness of sniffers and scanners for another sniffer connected on the wired-side.large enterprises. Sniffers and scanners are simply notcost-effective for an enterprise with multiple locations While this technique works with rogue APs that have builtor sensitive information that cannot risk rogue networks in routers, it fails if the rogue AP has security enabled. Ifoperating between security audits. In addition, IT security security is enabled, the sniffer will not be able to connectadministrators would find this decentralized approach with the device. Further, this technique exposes theextremely difficult to manage and collect information for wireless IPS system by forcing it to transmit frames overmultiple locations. the air in an effort to detect rogues. PAGE 8
  9. 9. White paperSolutions for Detecting andEliminating Rogue Wireless Networks7. AirDefense 24x7 Centralized and a central security station analyzes the incoming videoWired and Wireless Monitoring for security risks. The video cameras reduce the need forEnterprise rogue WLAN detection requires a scalable costly security guards to walk through the building just assolution that combines the centralized management of the remote sensors of the AirDefense Services Platformwired-side scanners and radio frequency analysis of replace the need for handheld manual wireless scanners.wireless scanners. The AirDefense Services Platformprovides this comprehensive solution with an innovative The server appliance also maintains a detailed minute-by-approach to WLAN security that includes a distributed minute forensic database of every wireless device in thearchitecture of remote sensors to monitor the airwaves airspace. By intelligently correlating real-time wirelessfor all WLAN activity and report to a centrally managed information and wired-side data with historical behavior,server appliance. The remote sensors are equivalent to the Motorola AirDefense system is able to determine andwireless scanners but add 24x7 monitoring to provide eliminate all rogues with the lowest false positive rate of100% coverage against rogue WLANs the minute they any system available today. Table 1 compares the detectionare connected to the network or enter the coverage area. performance of several techniques under different rogueThis approach to rogue WLAN detection and mitigation scenarios. The AirDefense system is capable of detectingis akin to the security of physical buildings whereby video virtually any type of rogue device.cameras are deployed at key locations for 24x7 monitoring Sensor SNMP Wireless Wired Rogue Device Based Lookup Traffic Traffic AirDefense Scenarios Detection Detection Injection Injection AP Consumer AP YES YES YES YES YES Consumer AP with security YES YES NO YES YES Consumer AP/Router YES YES YES YES YES with NAT Consumer AP/Router YES YES NO YES YES with NAT & security Consumer AP/Router YES YES YES YES YES without NAT Consumer AP/Router YES YES NO YES YES without NAT & security Enterprise AP YES YES YES YES YES Enterprise AP with MBSSID YES YES YES YES YES Enterprise AP with security YES YES YES YES YES Enterprise AP with YES YES YES YES YES MBSSID & security Client Enterprise AP with YES MAYBE NO NO YES MBSSID & security Rogue Client connecting to MAYBE NO NO NO YES Authorized AP Authorized Client with YES NO NO NO YES Ad-Hoc connection Authorized Client with YES NO NO NO YES Ad-Hoc connection PAGE 9
  10. 10. White paperSolutions for Detecting andEliminating Rogue Wireless Networks 5. The Motorola AirDefense SolutionThe centralized management and 24x7 monitoring of the Detection of All Rogueairwaves provides a scalable and cost-effective solution WLAN Devices and Activitythat enables enterprise WLAN detection throughout AirDefense recognizes all WLAN devices, which includemultiple locations of an organization. A few sensors are APs, WLAN user stations, virtual Wi-Fi, and specialtydeployed in each location to provide comprehensive, 24x7 devices such as printers, wireless bar code scannersdetection of rogue WLANs. As new offices are opened, for shipping or inventory applications, etc. AirDefensethe AirDefense Services Platform easily scales to secure also identifies rogue behavior from ad-hoc or peer-to-that office with the addition of sensor(s) deployed in the peer networking between user stations and accidentalnew location. AirDefense provides comprehensive and associations from user stations connecting to neighboringadvanced rogue management capabilities that go beyond networks.simple alerts of broadcasting APs. The functionalityincludes:Figure 2 – AirDefense Services Platform - Rogue Threat AnalysisFigure 3 – AirDefense Services Platform - Rogue Device Information PAGE 10
  11. 11. White paperSolutions for Detecting andEliminating Rogue Wireless NetworksThreat-Based Rogue Management Rogue Termination “The companyMotorola AirDefense goes beyond simple detection of Motorola AirDefense not only detects all intruders and has only a smallrogue devices and assesses the risk associated with an rogue devices in an enterprise’s airwaves, but allows them Cisco WLAN, butunknown device. Clearly not every unauthorized AP is a to actively protect and respond to threats manually orrogue device. In a business park, one is likely to see many automatically using predefined policies. AirDefense uses it uses Motorolaunauthorized devices from neighboring buildings. Motorola multiple methods to ensure that the wireless network is AirDefense to monitorAirDefense uses patented techniques to determine if a secure and protected. WLAN activity.rogue is connected to the internal network, pinpointing (AirDefense Servicesthose unauthorized APs that present the highest threat AirTermination Platform) letspotential. AirDefense’s advanced threat assessment Motorola AirDefense can protect against wireless network managerscapabilities enable the user to focus their attention on real threats via the air by terminating the wireless connectionthreats and safely ignore neighboring APs. between any rogue device and an authorized device using immediately and AirDefense patented methods. remotely disable aRisk and Damage Assessment rogue device with aMotorola AirDefense tracks all rogue communication and Wired-side Port Suppression single keystroke.”provides forensic information to identify when the rogue The Port Suppression feature enables the administrator tofirst appeared, how much data was exchanged, and the suppress the communications port for any network device. Frederick Nwokobia,direction of traffic. With detailed analysis, AirDefense The Port Suppression feature turns off the port on the Lehman Brothersassists IT personnel assess the risk and damage from network switch through which a device is communicating.the rogue. Packet capture can also be enabled for furtheranalysis of the rogue in a packet analyzer. Conclusion With the proliferation of rogue wireless devices andRogue WLAN Location unauthorized wireless connections, it is imperative forTo find the location of the rogue device, Motorola organizations to understand the risks caused by theseAirDefense provides accurate location tracking using rogue devices and employ 24x7 real-time monitoringsignal strength triangulation and fingerprinting techniques. solutions to detect, locate and disable these devices. ByLocation tracking enables the IT administrator to locate and utilizing patented techniques that use real-time wirelesstrack rogue devices in real-time. Location determination and wired-side information along with historical behavior,is also available in Motorola AirDefense Mobile, a the Motorola AirDefense system is capable of detectingcomplementary product to the AirDefense Services and eliminating all types of rogue devices with the highestPlatform, which allows administrators to locate and track accuracy and effectiveness compared to any solutiondown rogue devices during walk around tests. available in the market today. About Motorola AirDefense Solutions We deliver seamless connectivity that puts real-time information in customers’ hands. Our proven solutions provide the agility needed to grow business or better protect and serve the public. Working seamlessly together with world-class devices, our portfolio includes indoor WLAN, outdoor wireless mesh, and voice over WLAN solutions. Combined with powerful software for wireless network design, security, management and troubleshooting, wireless network solutions deliver trusted networking and anywhere access to organizations across the globe.Figure 4 – The AirDefense Services Platform – Rogue DeviceLocation Tracking PAGE 11
  12. 12. Motorola, Inc.1303 E. Algonquin RoadSchaumburg, Illinois 60196 U.S.Amotorola.com/wmsMOTOROLA, MOTO, MOTOROLA SOLUTIONS and the Stylized M Logo are trademarks or registered trademarks of Motorola Trademark Holdings, LLC GO-29-118and are used under license. All other trademarks are the property of their respective owners. © 2011 Motorola Solutions, Inc. All rights reserved. Printed in USA 10/11

×