Compaq nc6000 Wireless Security - Page 2

Executive Summary Today's mobile workforce increasingly demands convenient and secure access to the Internet using mobile devices (such as notebook and handheld PCs) with HP Wi-Fi and other mobile connectivity solutions. A secure solution enables a mobile worker to gain safe network access in areas where it is traditionally hard to deploy "wired" networks. It also enables such services as wireless access for CRM Data, file and database synchronization, and convenient network access to corporate resources on the intranet. However, as users find it easier than ever to connect to, synchronize with, and download corporate data, the need for device security becomes crucial. This paper addresses the security implications of Wireless LANs (WLANs), and makes recommendations regarding some available, but underutilized, security solutions and tools. A brief description of the evolution of wireless security is provided as an introduction to the available WPA and 802.11i solutions. Problem Statement Equipping today's mobile workforce with wireless equipment has the potential to increase productivity by providing mobile and wireless users access to corporate data from any remote location. The key to securing a wireless network lies in understanding the issues and available solutions through the entire system - from the moment the mobile user powers on the mobile device...through log-in...through application initiation....through the network firewall...through access to the network and data download. At every step, there are vulnerabilities. In addition, this paper highlights security issues for mobile devices that are unrelated to the wireless nature of the solution, but may be associated with other aspects of Mobility and Connectivity. Historical information/background Most security issues for mobile devices have little to do with using wireless connectivity, but with the mobile aspect of the devices - the fact that they are moved from place to place. Confidential data may be located on a device that can be physically stolen or misplaced outside secure corporate buildings. Other security issues stem from the fact that the devices are connected to the Internet or a corporate intranet. But regardless of whether the connection is DSL, GPRS, Phone Line Dial-up, 1XRTT, EDGE or UMTS - securing that connection is the issue. Before we discuss the tools developed for wireless security, it's important to address requirements for wireless solutions. All wireless devices must be supported using Encryption and Authentication. Recognizing that security needs to be addressed holistically, we have added client device security as a requirement. The aim of encryption is to provide a mechanism to ensure data privacy and integrity. Data should only be decrypted by authorized means. All transmitted packets should be originated from senders. Data integrity must be maintained under all circumstances. Authentication should be mutual - enabling wireless device clients and access points to authenticate one another. Authentication messages between clients, access points and authentication servers must be possible. Access points should be able to validate client credentials in order to grant access to the network Mobile device security is required not only to protect the client devices, but also to help ensure that client devices themselves do not become points of vulnerability that could be used to threaten the entire IT infrastructure. This is on important aspect of data integrity. 2