More City firms leaving themselves vulnerable

More than a third of companies in the City are leaving their corporate networks open to exploitation and attack, according to the fourth annual Wireless Security Survey of London.

The research shows that wireless security has worsened in the past year, with 36 per cent of firms failing to protect themselves from drive-by hackers.

This is up from 25 per cent the previous year (Computing, 29 January 2004) with more firms than ever overlooking the potential dangers of information theft, downtime and hijacking of corporate networks for criminal use by not safeguarding their wireless local area networks (WLan).

'Insecure wireless networks could support a whole number of illegal activities, from spam through to denial-of-service attacks,' said Phil Cracknell, chief technology officer of netSurity, which conducted the survey.

'The golden chalice for criminals is anonymity and they can use unsecured corporate networks knowing crimes won't be tracked back to them, but to the business instead.'

As well as the dangers of corporate information theft, companies could also be held financially and legally liable if criminal activities are unknowingly carried out using their IT systems, he says.

'Within two hours of a wireless network appearing, someone will try to connect to it,' said Cracknell.

Tim Pickard, area vice president of international marketing at RSA Security, which commissioned the survey, attributes the growth of unsecured WLans to two key factors: growing adoption of low-cost wireless products among smaller businesses, and the fact that 26 per cent of firms still use default settings.

Some 43 per cent of firms are still not using their access point's common encryption standard, Wired Equivalent Privacy, simply because it is not switched on as default, the survey says.

'We are seeing more small and medium-sized businesses adopting wireless technology because it's cheap and often included in the broadband services they are buying,' said Pickard. 'But they don't always have the same levels of security.'

IT departments in larger corporations must also regularly scan and audit their network security, because these low costs make it easy for individual departments to pay for and install rogue access points, says Pickard.

'It can be bought on departmental expense budgets and the IT department wouldn't even know about it,' he said.

But one of the biggest threats to businesses using wireless is the growth of public hotspots. The report says public WiFi points are creating a culture where wireless laptop users are becoming experienced in searching for accessible networks, and use unsecured business WLans by mistake.

It also says a lack of formal identification means corporate WiFi hotspots users could be unknowingly logging onto rogue hotspots aimed at capturing sensitive information.

Graham Titterington, principal analyst at Ovum, says while unsecured wireless networks can lead to data theft and network abuse, risks need to be put in context.

'It is possible to send out spam and other malicious traffic from someone's corporate network and there are potential legal implications,' he said.

'But the laws regarding prosecution of people for spam and data theft have yet to be rigorously enforced, so the potential impact on hacked businesses is still questionable.'

But securing wireless networks is not difficult (see box below) and should not overshadow the massive benefits mobile working can offer, says Pickard.

'Wireless technology took IT managers by surprise in terms of adoption rates but it now needs to be a major part of any IT security policy,' he said.

The most important thing businesses can do to protect themselves is check perimeters to ensure devices haven't been added, even if strict no-wireless rules are in place, says Pickard.

If the right measures are taken security need not be a concern, and the 62 per cent growth in access points throughout the City is proof that businesses are demanding IT departments install wireless networks, he says.

Wireless networks and portable computers can cut office overheads and cabling costs, while improving the way in which people work.

'Wireless frees people from being bound to their desk. Laptop users are able to move around the office and remain connected to email and other applications even when moving between meetings,' said Pickard.

'It's one of those technologies that is going to be part of the future. In 10 years' time cabling an office just isn't going to happen.'

Ten pointers to securing your wireless network

*Regularly audit security policies and wireless networks to identify rogue access points and vulnerabilities

*Make sure all access points, base stations and other wireless products using the corporate network are approved by the IT security department

*Register all wireless network interface cards used in laptops and desktop PCs with the IT department and, where possible, use their mandatory access control address for authentication

*Report lost or stolen cards immediately

*Users with wireless Lan (WLan) devices should use a company-approved virtual private network (VPN) for communication and authenticating users and encrypted traffic

*Direct wireless traffic through the VPN before it enters the corporate network, and configure it to drop all unauthenticated and unencrypted traffic

*Make the wireless Service Set Identifier (SSID), which broadcasts your WLan name to external viewers, vague so your company cannot be identified. Unless needed, disable your wireless network's SSID external broadcasting function

*Turn down power transmission or use directional antennae on access points near a building's perimeter to reduce the likelihood of drive-by hacks

*Use wired equivalent privacy to identify users, but only together with a method of strong two-factor authentication to help guarantee the identity of people entering the corporate network

*Educate all corporate users about using public WiFi hotspots and the potential security risks of connecting to a rogue hotspot

Source: Wireless Security Survey of London