Concerns about security have commercial and government enterprises moving quickly to reassess deployments of industry-standard wireless LANs. Experts say the security flaws are a potentially severe threat to networked systems within the nation’s critical infrastructure.
John Montgomery, chief technical officer at Embarcadero Systems Corp. in Alameda, Calif., said he’s working to improve the security of 802.11b wireless LANs that the company has installed at nine West Coast ports. Those wireless LAN infrastructures support container inventory control at the ports. They also track movement and dispatch operations. Cranes and lifts communicate data read from smart tags on cargo boxes to a central database.
When Embarcadero, a division of Oakland, Calif.-based Marine Terminals Corp., installed the wireless LANs, “the issues about security were not well known or publicized,” Montgomery said. But after last year’s terrorist attacks on the U.S. and heightened concerns over security, he “commissioned a security audit, which detected numerous holes.”
To address the problems, Embarcadero hired a staff dedicated to cybersecurity, installed firewalls on its routers and is working with third-party software vendors to provide additional encryption software.
TXU Electric & Gas in Dallas, meanwhile, has an ongoing wireless LAN pilot project at its Comanche Peak nuclear power plant in Glen Rose, Texas. But the company doesn’t plan wide-scale deployment until it completes a security study, said spokesman Rand LaVonn.
“We are well aware of the security vulnerabilities of wireless LANs,” LaVonn said. “We do everything we can do to make Comanche Peak dependable and safe.”
The U.S. Department of Energy’s Lawrence Livermore National Laboratory in Livermore, Calif., last month put a temporary ban on wireless LANs, which had been installed in nonclassified areas. Ted Michels, the lab’s acting CIO and principal deputy director for computation, said in the Jan. 18 issue of the lab’s newsletter that “wireless networks and their built-in security features have been found under testing to be very insecure. For this reason, the lab has decided to control the deployment of wireless technologies until solutions can be found to address their security vulnerabilities.”
Lawrence Livermore spokesman David Schwoegler said the lab would keep its wireless LANs shut down “as long as it takes to get it right.” He added that because of these security concerns, the DOE has a long-standing policy against the use of wireless LANs in classified areas.
U.S. federal agencies in general have started to clamp down on wireless LAN deployment, according to Alex Froede, manager of wireless security initiatives in the U.S. government division of Plano, Texas-based Electronic Data Systems Corp. “A number of agencies” have curtailed deployment until security can be built in upfront, he said.
David Dziadziola, CEO of San Francisco-based security consulting firm Wholepoint Corp., said he’s aware of wireless security audits that have successfully penetrated military facilities from up to 20 miles away. Some of those cases involved military labs that had other LANs attached to the wireless networks. “To detect these penetrations is next to impossible,” said Dziadziola.
Brian Ruf, an information assurance scientist at CACI International Inc., in Arlington, Va., said that in his view, running an insecure wireless LAN is “essentially the same as running a wire from your network out to the street and leaving the jack loose for anyone to plug in.”
Ruf added that large enterprises face another problem before they even try to deploy strong security: finding the wireless LANs. Wireless LAN installations have “run rampant in large organizations,” Ruf said, with users buying the relatively cheap gear and hooking it up to networks without the knowledge of the CIO or IT department.
David Halasz, manager of software development in the wireless networking business unit at Cisco Systems Inc. and chairman of IEEE 802 Task Group I, which is working on wireless LAN security enhancements, said enterprises already have more robust security tools to choose from than weak, built-in Wi-Fi encryption. And they will have even better tools later this year when vendors start adding the hard-to-crack Advanced Encryption Standard to their defensive arsenal.
Dennis Eaton, chairman of the Wireless Ethernet Compatibility Alliance, said he believes that although it’s prudent for organizations such as Lawrence Livermore to demand tight security, other enterprises can comfortably operate wireless LANs with today’s 40-bit Wired Equivalent Privacy security.
(Reporter Dan Verton contributed to this story.)
