Alongside the freedom of wireless computing comes increased risk; losing the cable means that all those bits are now floating in the ether, ripe for plucking by crafty hackers. Is there a way to keep trespassers out while giving your users the freedom to roam?

To say that 802.11b wireless Ethernet has seen an exponential increase in usage during the past twelve months would be a massive understatement. In corporations and on campuses across the nation, workers have embraced the freedom given to them by wireless networking, no longer are they shackled to their offices or dorm rooms by the need for network cabling. But along with the freedom comes increased risk; losing the cable means that all those bits are now floating in the ether, ripe for plucking by crafty hackers.

To keep the black hats from sniffing packets, the IEEE 802.11 working group has defined a security policy called Wireless Encryption Protocol. WEP uses the RC-4 40-bit encryption algorithm to scramble all data before it is transmitted. Sounds great, but there are two major problems. Vendors can add proprietary encryption features to their software, taking the encryption level up to 128 bits. If you've purchased Vendor A's access points, folks that have Vendor B's PCMCIA wireless cards won't be able to access your network if you've enabled the proprietary encryption features.

That's not as big a problem as it may seem, however, because WEP isn't secure. And that's the real issue.

WEP was recently proven to be a cryptographically weak protocol. Researchers at U.C. Berkeley were able to break the encryption of WEP-encoded data in short order, theoretically, the bad guys could do the same to you. Practically, it's unlikely that they'll bother; running a wireless sniffer is a bit more complicated than setting up a garden-variety password grabber, and it's a lot riskier, because the hacker has to be in close physical proximity to the network instead of sitting comfortably in his living room on the other side of the country. It's much more likely that you'll face a different security risk when you set up a large-scale wireless network: trespassers.

The freedom that wireless networking provides is also one of its biggest security risks. Unlike traditional wired Ethernet, gaining access to the network doesn't require a hacker to enter a building. The radio signals can be intercepted from a parking lot or from across the street, giving hackers the opportunity to penetrate your network without setting foot on your property.

Controlling access to wireless networks is an increasingly difficult challenge for network administrators. Unlimited access means that anyone with a wireless network card could gain access to the network. On the other hand, highly restricted access negates the benefits of going wireless and annoys the users. Is there a way to limit access to your wireless infrastructure and keep trespassers out while giving your users the freedom to roam?

For small wireless networks, MAC address monitoring is the tool of choice. The Lucent AP-1000, the access point that's rapidly becoming the standard for use in corporate or campus networks, can store a list of as many as 492 MAC addresses that have permission to access the network. If a MAC address hasn't been added to the access point, it is rejected, and the user can't connect to the network. This technique has the added benefit of keeping the bad boys from spoofing IP addresses. If you can't get on the network, you can't spoof an address. Unfortunately, MAC address management doesn't scale beyond a few access points, keeping up with MAC address tables on multiple access points is a sure recipe for an administrative migraine.

So how do you handle a major wireless installation? Use a RADIUS server. RADIUS, the Remote Authentication Dial-In User Service protocol, is designed to handle the authentication of users in large-scale remote access situations. Most major ISPs use a variant of RADIUS to authenticate dial-up customers and track their usage.

Copyright © 2009 CBS Interactive, a CBS Company. All Rights Reserved.
ZDNET is a registered service mark of CBS Interactive. ZDNET Logo is a service mark of CBS Interactive.