Wi-Fi security dos and don'ts
Wi-Fi can be secure if you use the right security measures. Here are 11 tips for improving mobile security
Wi-Fi is inherently susceptible to hacking and eavesdropping, but it can be secure if you use the right security measures. Unfortunately, the Web is full of outdated advice and myths.
Here are some dos and don'ts of Wi-Fi security, addressing some of these myths.
[ Also in mobile security: Security Grinches' misleading scare tactics. | And find out which mobile OS is most secure in "iOS vs. Android vs. WebOS vs. the rest." | Stay ahead of advances in mobile technology with InfoWorld's Mobile Edge blog and Mobilize newsletter. ]
Watch a slideshow version of this story.
WiFi users blissfully ignorant about real security
1. Don't use WEP
WEP (wired equivalent privacy) security is long dead. Its underlying encryption can be broken quickly and easily by the most inexperienced of hackers. Thus you shouldn't use WEP at all. If you are, immediately upgrade to WPA2 (Wi-Fi protected access) with 802.1X authentication -- 802.11i. If you have legacy clients or access points that don't support WPA2, try firmware upgrades or simply replace the equipment.
2. Don't use WPA/WPA2-PSK
The pre-shared key (PSK) mode of WPA and WPA2 security isn't secure for business or enterprise environments. When using this mode, the same pre-shared key must be entered into each client. Thus, the PSK would need to be changed each time an employee leaves and when a client is lost or stolen -- impractical for most environments.
3. Do implement 802.11i
The EAP (extensible authentication protocol) mode of WPA and WPA2 security uses 802.1X authentication instead of PSKs, providing the ability to offer each user or client their own login credentials: username and password and/or a digital certificate.
The actual encryption keys are regularly changed and exchanged silently in the background. Thus to change or revoke user access all you have to do is modify the login credentials on a central server, rather than having change the PSK on each client. The unique per-session keys also prevent users from eavesdropping on each other's traffic -- which is now easy with tools like the Firefox add-on Firesheep and the Android app DroidSheep.
Keep in mind, for the best security possible you should use WPA2 with 802.1X, also known as 802.11i.
To enable the 802.1X authentication, you need to have a Radius/AAA server. If you're running Windows Server 2008 and later, consider using the Network Policy Server (NPS), or the Internet Authenticate Service (IAS) of earlier server versions. If you aren't running a Windows Server, consider the open source FreeRadius server.
